Uploaded byAnowar Hossain
DevOps to DevSecOps: Enhancing Software Security Throughout The Development Lifecycle
The document discusses the transition from DevOps to DevSecOps, emphasizing the importance of integrating security throughout the software development lifecycle. It highlights challenges in DevOps, such as inadequate security practices and delayed delivery, while outlining a DevSecOps methodology that includes tools and practices for enhanced security. Key benefits of adopting DevSecOps include faster delivery, improved security posture, and compliance.
More Related Content
![[DevSecOps Live] DevSecOps: Challenges and Opportunities](https://cdn.slidesharecdn.com/ss_thumbnails/20200316dsochallengesopportunities-200416111818-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to DevOps to DevSecOps: Enhancing Software Security Throughout The Development Lifecycle
DevOps to DevSecOps: Enhancing Software Security Throughout The Development Lifecycle
- 1. DevOps to DevSecOps : EnhancingSoftware Security Throughout The Development Lifecycle
- 2. ANOWAR HOSSAIN Lead Engineer &Solutions Architect Brain Station 23 • AWS Certified Solutions Architect • Lead Backend Developer • DevOps/DevSecOps Enthusiast • Buidling blocks with Python, Go & Terraform for serverless and microservice architecture • Highly concerned about Scaling and Security 2
- 3. Agenda 3 DevOps in Action Challengesof DevOps DevSecOps in Action DevSecOps Methodology DevSecOps Pipeline
- 4. DevOps • A setof practices • Integrating development and IT operations • The goal of DevOps: • Release Quickly • Improving collaboration and communication • Delivering high-quality software faster and efficiently. 4
- 5.
- 6.
- 7.
- 8. When we do theSecurity Test? 8
- 9.
- 10. Impact? 10 • Back andforth • Incomplete • Rush • Disrupt business operations • Limited scope
- 11.
- 12. • Inadequate accesscontrol • Lack of security testing • Lack of infrastructure-related security practices • Insufficient security monitoring • Third-party vulnerabilities • Increased testing and remediation costs • Delayed delivery 12 Challenges of DevOps
- 13.
- 14. DevSecOps • Development, security,and operations • Integration of security into the SDLC • Continuous delivery and deployment of secure software 14
- 15. DevSecOps Strive for "Secureby Default" 15 • Integrate Security via tools • Create Security as Code culture • Implement automated process Security
- 16. DevOps to DevSecOps • Integrationof security tasks with DevOps • Shifting Security to the "Left" • Prioritizing Security from Design Phase 16
- 17. Benefits Key benefits ofDevSecOps: • Faster delivery • Improved security posture • Reduced costs • Increase traceability • Compliance 17
- 18. Methodology Tools we usemostly • Secret Scanning & Management • Static Analysis Security Testing(SAST) • Dynamic Analysis Security Testing(DAST) • Interactive Application Security Testing (IAST) • Software Composition Analysis (SCA) • Security in Infrastructure as Code • Vulnerability Management • Alert and Monitoring in Security 18
- 19. Secret Scanning & Management Integratesecurity into the development process • Access Security Hardening • Secret Management • Adopting Role-Based Access Control • Ensuring Private Cloud Security • Container Security Scanning Tools: • GitHub Secrets • AWS Secret Manager • Azure key vault • Hashicorp vault 19
- 20. SAST 20 Static analysis softwaretesting • White box testing using automated tools • Reviewing code • Need manual oversight Tools: • Sonarqube • Gitlab SAST Tools • Jit.io
- 21. DAST 21 • White boxtesting using automated tools • Can send variety of requests to web application • Do not require access to source code • Interact with application and find vulnerabilities Tools: • Detectify • Acunetix • BurpSuite • MetaSploit Dynamic analysis software testing
- 22. IAST 22 • Real-time analysisof the threats in the build and in runtime • Also Helps the developer fix these issues while it scans the source code when running. • Tools: • Bandit by Jit.io • Invicti Interactive analysis software testing
- 23. SCA 23 • Manage andsecure open source and third- party software components • Assist organizations in understanding • Dependency scanning • Vulnerability scanning • License compliance analysis • Reporting • Tools: • Black Duck • WhiteSource Software Composition Analysis
- 24. Security in Infrastructureas Code(IAC) 24 IAC allows - • To document and version of infra • To perform audit on the infra Tools: • Terraform • Ansible • Chef • Puppet
- 25. Vulnerability Management 25 • Acentral Dashboard is required to normalized data • Integrated to bug tracking system • Tools: • Grafana • Detectify • Defect Joho
- 26. Alert and monitoring 26 •Detect, Mitigation and Maintain Continuous Security • What and Where we need to improve • Tools: • Grafana • Prometheus • Kibana
- 27. Who will ensure thesecurity? 27
- 28.
- 29.
- 30.
- 31.
- 32.
- 33.
- 34. SOCIAL MEDIA LINKS 34 • Website:anowar.dev • Email: anowar.cst@gmail.com • https://www.linkedin.com/in/anowarcst • https://www.facebook.com/Anowar.cst