Downloaded 11 times
Uploaded byAaron Weaver
DevOps AppSec Pipeline Velcocity NY 2015
The document outlines the development of an application security (appsec) pipeline, emphasizing the importance of optimizing human resources within the process. It discusses key stages of the pipeline, including intake, testing, and delivery, and highlights tools like Threadfix for managing appsec activities and metrics. Additionally, it introduces orchestration strategies to integrate appsec into DevOps workflows effectively.
More Related Content
Similar to DevOps AppSec Pipeline Velcocity NY 2015
DevOps AppSec Pipeline Velcocity NY 2015
- 1. Building an AppSecPipeline: Keeping your program, and your life, sane Aaron Weaver Protiviti Matt Tesauro Pearson
- 2. Henry Ford: Thesponsor of the development of the assembly line
- 3.
- 4. The Phoenix Project 3Ways of DevOps Strategies for Improving Operations
- 5. #1 - Workflow Lookat your purpose and those processes which aid it
- 6. #2 - ImproveFeedback Open yourself to upstream and downstream information
- 7. #3 - Continual Experimentation& Learning Create a culture of innovation and experimentation
- 8.
- 9. Spending time optimizing anything otherthan the critical resource is an illusion.
- 10. For AppSec the criticalresource is the people.
- 12.
- 13. Pipeline - Intake ▪“First Impression” ▪Major categories of Intake - Existing App - New App - Previously tested App - App to re-test findings ▪Key Concepts - Ask for data about Apps only once - Have data reviewed when an App returns - Adapt data collected based on broad categories of Apps
- 14. Pipeline - Test ▪Inboundrequest triage ▪Ala Carte App Sec - Dynamic Testing - Static Testing - Re-Testing mitigated findings - Mix and match based on risk ▪Key Concepts - Activities can be run in parallel - Automation on setup, configuration, data export - People focus on customization rather than
- 15. Pipeline - Deliver ▪Sourceof truth for all AppSec Activities ▪ThreadFix is used to - Dedup / Consolidate findings - Normalize scanner data - Generate Metrics - Push issues to bug trackers ▪Report and metrics automation - REST + tfclient ▪Source of many touch points with external teams
- 18. Application Security ToolsOrchestration Automate Security Tooling
- 19. Integrating into theDevOps Pipeline DevOps Pipeline AppSec Pipeline
- 20. Dev & AppSecTool Integration OWASP ZAP Proxy BuildManageCode Store RAPTOR Deploy OWASP ZAP Proxy *Not a comprehensive list. The OWASP DevOps AppSec Pipeline will have a complete listing.
- 21. Bag of Holding akaBoH github.com/PearsonEducation/bag-of-holding
- 22.
- 23. What does BoHdo? ▪Manages our Application Security Program ▪Application Repository ▪Engagement Tracking ▪Report Repository ▪Comments on any application, engagement or activity ▪Data Classification and PII data ▪Time taken on secure software activities ▪Historical knowledge of past assessments ▪Credential repository ▪Environment details
- 24.
- 25.
- 26. Scheduling of SecureSoftware Activities
- 27.
- 28. Your command linewhere you have your conversations.
- 29.
- 30.
- 31. Threadfix Integration And more: Createan Application Get Summary Metrics for AppSec Program
- 32. BOH/Threadfix/Static Integration Setup recurringstatic analysis in about 1 minute!
- 33.
- 34.