Developers and DevOps teams often find collaboration with security teams difficult or even a waste of time. But sometimes this interaction cannot be avoided, for example, when applications move to production. Why is collaboration with security teams so difficult? Let’s see how to make it fun.

1. WHO AM I
REUVEN HARRISON
CTO & CO-FOUNDER
TUFIN - THE SECURITY POLICY COMPANY
1

2. DEVOPS
2

3. SECURITY
3

4. 4
?

5. WHAT IS DEVOPS?
▸ Collaboration between dev and ops
▸ To speed up things
▸ Through automation
▸ And shared responsibility
5

6. DEVOPS IN PRACTICE
▸ What is DevOps?
1. Managing the CI/CD pipeline
2. Automating infrastructure (cloud, kubernetes...)
3. Operating the run-time (SRE)
4. Security
6

7. SECURITY
▸ You are always under attack and already compromised
▸ It’s just a question of how much is at risk
▸ User data and reputation
▸ Revenue, uptime
▸ The entire business
▸ And to what extent you are aware of it...
7

8. WHAT HAS DEVOPS GOT TO DO WITH SECURITY?!
▸ Developers hate security
▸ Security is boring
▸ Security slows down developers
▸ You have to be a security expert to do security
▸ DevSecOps is a real thing
8
▸ Developers hate security
▸ Security is boring
▸ Security slows down developers
▸ You have to be a security expert to do security
▸ DevSecOps is a real thing

9. BENEFITS OF INTEGRATING SECURITY INTO DEVOPS
▸ Reduced risk to cyber attacks
▸ Increased agility
9

10. BEFRIEND YOUR CISO
10
Before After

11. 11
There is always a winner when there is a ranking
Roberto Simanowski - Data Love

12. GAMIFICATION
▸ Security is part of your quality, like codecov
▸ Show it to the developer!
12

13. SECURITY BADGE IN GITHUB
13

14. SECURITY BADGE IN GITHUB -> DASHBOARD
14

15. TRENDS AND COMPARISONS
15

16. SECURITY FUNDAMENTALS
▸ RBAC, for everything, and an audit trail
▸ Network security - who can (and can’t) talk to who
▸ Secrets and certificates only where they are needed
▸ E2E encryption, everywhere (don’t let developers do it)
▸ Appsec - vulnerability scans (overrated!)
▸ Monitoring and alerts on abnormal behavior
16

17. 17
THE DANGER OF TMI

18. THE DANGER OF TMI
▸ When you have too many alerts, vulnerabilities,
violations… no one cares anymore
▸ Reduce the noise
▸ Prioritize, filter, summarize
▸ For example:
▸ A vulnerability that has an exploit is worse than others
▸ RBAC for system before app (PAM)
18

19. EVERYTHING AS CODE
▸ App - static code analysis
▸ Infrastructure - ensure secure configuration
▸ Security policies - should also be tracked in GitHub
▸ Now you have an automated audit trail!
19

20. IMMUTABLE INFRASTRUCTURE
▸ You can flush any part of your infra and re-generate it from
code
▸ If something misbehaves - replace it with a fresh instance
▸ Containers are great for this!
▸ But what about the data?
20

21. BACKUPS AND PROCEDURES
▸ Backups are not fun - rely on a service to do it for you
▸ Perform a periodical drill
▸ And define a procedure
21

22. TEST AUTOMATION
▸ Test automation is a central aspect of CI
▸ Unit tests
▸ Integration tests
▸ System tests
▸ Performance tests
▸ What about security tests?
22

23. SECURITY AUTOMATION
▸ Writing procedures is boring... no one reads them anyway
▸ Automate!
▸ Test frequently (every build)
▸ Get continuous security - CI/CD/CS
▸ Procedures become code
▸ You get true evidence for auditors
▸ And you can measure and gamify
23

24. DEMO - AUTOMATIC APP BASELINING
1. Learn the application behavior during tests
2. Define a policy
3. Enforce
24

25. A LAST WORD ABOUT CULTURE
▸ DevOps is about shared responsibility
▸ This includes security
▸ Security teams must understand the DevOps culture of
trust, collaboration and automation
▸ Assign a security owner in the dev teams
25

26. SUMMARY - BUILD SECURITY INTO YOUR DEVOPS PIPELINE!
▸ Gamification
▸ Start with the basics
▸ Reduce noise
▸ Everything as code
▸ Immutable infrastructure
▸ Automate security in the pipeline
26

27. THANK YOU!
27
REUVEN HARRISON
CTO & CO-FOUNDER
TUFIN - THE SECURITY POLICY COMPANY