DevOps and regulatory compliance are two critically important ingredients in today’s connected organizations. DevOps enables you to move quickly and respond to change in an era where change is increasing at an exponential rate with no sign of slowing down. Regulatory compliance ensures that your organization takes the appropriate steps to follow relevant laws that appear to require adding burdensome processes and controls to your software development lifecycle. Brandon Carlson acknowledges that at first glance these two ideas seem incompatible, but they actually go together like peanut butter and jelly. While maintaining, analyzing, confirming, and reporting on the status of required information security, compliance, and privacy controls can be difficult, integrating these tasks within your DevOps/continuous delivery pipeline is easier than you think. Using examples from real-world projects in organizations just like yours, Brandon explains how to integrate compliance and reporting into your projects using tools you already know such as pair programming, Jenkins, Chef, Metasploit, and others. When it comes to compliance, it’s not oil and water. It’s peanut butter and jelly time.

1. DT7
DevOps & Regulation
6/8/2017 3:00:00 PM
DT7 DevOps and Regulatory
Compliance-Like Oil and Water or
Peanut Butter and Jelly?
Presented by:
Brandon Carlson
Lean TECHniques, Inc.
Brought to you by:
350 Corporate Way, Suite 400, Orange Park, FL 32073
888-­‐268-­‐8770 ·∙ 904-­‐278-­‐0524 - info@techwell.com - https://www.techwell.com/

2. Brandon Carlson
Lean TECHniques, Inc.
Brandon Carlson works for Lean TECHniques, Inc., an IT consultancy that helps
organizations deliver high-value, high-quality products to market. Since starting
his career in 1995, Brandon has held positions from development and
architecture to management-and he's still learning. Passionate about elevating
the performance of IT as a whole, he has helped numerous organizations from
startups to Fortune 100 companies improve their product development and
delivery systems. Brandon can be reached on Twitter @bcarlso and just about
everywhere else on the web as "bcarlso".

3. DEVOPS & REGULATORY
COMPLIANCE
Brandon Carlson
DevOps West 2017
Las Vegas, NV
June 5-9, 2017
OIL & WATER OR PB & J?
- Or -

4. Compliance Audit?

5. Key Players
Information Security: Person or people that
are responsible for your organization/
product’s information security.
Developer: Person or people that make your
lives hell on earth (I don’t differentiate
between “production” and “test” code, it’s
all just “code”)

6. Bit Players
Product Owner: Person or people that define the
requirements or features to be developed
Architect: Person or people that are
looking at higher level system design
Infrastructure: Person or people responsible for
systems and operations

7. Waterfall

8. Agile

9. Forgot Something…

10. Bring Production In!

11. DevOps

12. We’re Different…

13. Forgot Something…

14. Include Security!

15. Compliance Myths
All or nothing!
Documentation Centric
Heavyweight

16. Compliance Facts
Complex and Rapidly Changing
Necessary
You’re closer than you think!
Resource constrained

17. InfoSec is Busy
http://www.iso27001security.com/html/27002.html
http://www.isaca.org/cobit/pages/default.aspx
http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf

18. http://www.iso27001security.com/html/27002.html
http://www.isaca.org/cobit/pages/default.aspx
http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf
Don’t forget GLBA. Oh, and
PCI. Yes, and SOX.
Of course let’s not forget HIPPA…
InfoSec is Busy

19. Buy vs. Build

20. Buy vs. Build

21. Integrating Security
So we’re
gonna need…

22. Portfolio/Epics
Thanks for the
invite. Tell me about
this functionality…

23. Portfolio/Epics
This may
cause us to fall under
the provisions of the
GLBA…

24. Portfolio/Epics
If we
exclude this part, we
can ignore the GLBA
provisions…

25. Story Generation
Welcome
everyone. We need to
split this epic…

26. Story Generation
We’re going to
need some security
specific stories…

27. Story Generation

28. Story Generation

29. Infrastructure Stories

30. Infrastructure Stories

31. Acceptance Criteria
Here’s how
“Respond to Alarm”
should work…

32. Acceptance Criteria
That acceptance
criteria corresponds to
a NIST control…

33. Acceptance Criteria

34. Acceptance Criteria

35. Acceptance Criteria
We will
need some additional
acceptance criteria
here…

36. Acceptance Criteria

37. Acceptance Criteria

38. Acceptance Criteria
Why can’t the
username be their e-
mail address?

39. Acceptance Criteria
I see. That makes
perfect sense.

40. Sprint Activities?
Now what do we do…

41. Scenario Creation
We need a scenario
for that…

42. Scenario Pairing
This verifies that
audit logs contain the
proper info…

43. Scenario Mobbing?
This verifies that
audit logs contain the
proper info…

44. Infrastructure Story?
Here are the docs for
securing /var/tmp…

45. Infrastructure Mob
Here are the docs for
securing /var/tmp…

46. Implementation

47. Implementation
If only I could link
the tests to these
scenarios…

48. Implementation

49. Implementation

50. Implementation

51. Implementation

52. Implementation

53. Implementation
I need to automate
this server config…

54. Implementation

55. Documentation?
?

56. Documentation?

57. Documentation?
You’ve already
done this!

58. Your Tests are written and
tagged to pass the AC
Your scenario tests are
mapped to Security
Controls
Epics are broken down and acceptance
criteria defined with security controls
Documentation?

59. Documentation?
These are standards, these are
processes, these are procedures.
Just make a formal template and
they become governance
documents!!!

60. Documentation?
The Role of Continuous Delivery

61. Documentation?
The Role of Continuous Delivery

62. Automated Reports!

63. 3rd Party Licenses

64. Web Attack/Audit

65. Other Integrations
• Vulnerability Scan
• Automated Penetration Test
• Configuration Scan
• Fuzzer
• Directory Buster
• Privacy Data Reporting

66. Automate It All?
• Penetration Testers embedded as pair
testers in the dev teams
• Act as if they were trying to get access to
our system
• Hire third party actors from time to time
as well.

67. From Oil & Water…

68. To PB & J…

69. It can be integrated
Continuous
Compliance

70. Want Useful Slides?
Write your name and e-mail address on the back of your
feedback form or e-mail devops-west-2017@leantechniques.co
Presentations these days are full of pictures and not
any words. That’s great for when you’re at the
conference taking in the information in person, but
they just don’t translate when you come back and
explain it to your team.
That’s why we’ve created a shareable version of this
presentation, it contains all of the content from the
live presentation, but in a more digestible format for
taking offline and reviewing and sharing with your
colleagues. All you’ve got to do is follow the
instructions above to get a copy. Once you’ve done
that, you’ll receive the sharable version and any
updates made to the presentation moving forward.
Thanks for attending and let us know how we can
help you implement a DevOps strategy that really
works to mitigate your organization’s compliance risk
while remaining Agile.
Thanks!
Brandon
Questions?