The document discusses the evolution and principles of DevSecOps, emphasizing the need to incorporate open practices back into the model. It highlights various tools and strategies for security in software development, including the use of AWS resources, continuous integration, and emerging trends like bug bounties and pentesting. The content also addresses the goal of creating self-governing, self-healing, and self-defending systems.

1. LONDON 18-19 OCT 2018
Open DevSecOps
PETKO D. PETKOV

2. 3

3. 2

4. 1

6. You have to know the past to understand the present.
Carl Sagan

8. 1995

9. Hacking The Gibson

10. Knowledge Prestige Community

11. Knowledge Prestige Community

12. Knowledge Prestige Community

13. Milestones

14. Pentesting Vuln Programs Bug Bounties DevSecOps

15. Pentesting Vuln Programs Bug Bounties DevSecOps
2002 2007 2012 2018
5

16. REDTEAMPENTESTER

18. $10,000
(2005)
$500,000
(2018)

20. $10,000 $100,000

21. DevSecOps
Continuous Integration / Delivery

22. Code Build Test Deploy Monitor

23. Code Build Test Deploy Monitor

24. What’s the point?

26. US THEM
THEM US
VS

27. We are here

28. Open DevSecOps
Putting “Open” back into the DevSecOps Model

29. Code Build Test Deploy Monitor

30. Code Build Test Deploy Monitor
?
?
?
?

31. DEV Tools
Static Source Code Scanner Dynamic Application Scanner

32. Infrastructure
It is also expressed in code these days

34. DevSecOps SecOps

35. Open DevSecOps
Putting “Open” back into the DevSecOps Model

36. Knowledge Tools Community

37. Knowledge

39. Community

41. Tools / Solutions

42. Honey Tokens

43. resource "aws_s3_bucket" "app" {
count = "${var.create_app ? 1 : 0}"
bucket = "${var.name}.${var.domain}"
acl = "private"
website {
index_document = "index.html"
error_document = "index.html"
}
policy = <<EOF
{
"Version": "2008-10-17",
"Statement": [
{
"Sid": "PublicReadForGetBucketObjects",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::${var.name}.${var.domain}/*"
}
]
}
EOF
lifecycle {
prevent_destroy = true
}
tags {
solution = "apps"
}
}
resource "aws_s3_bucket" "next_app" {
count = "${var.create_next_app ? 1 : 0}"
bucket = "next-${var.name}.${var.domain}"
acl = "private"
website {
index_document = "index.html"
error_document = "index.html"
}
Honey Tokens

44. Dark Nets

45. resource "aws_s3_bucket" "app" {
count = "${var.create_app ? 1 : 0}"
bucket = "${var.name}.${var.domain}"
acl = "private"
website {
index_document = "index.html"
error_document = "index.html"
}
policy = <<EOF
{
"Version": "2008-10-17",
"Statement": [
{
"Sid": "PublicReadForGetBucketObjects",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::${var.name}.${var.domain}/*"
}
]
}
EOF
lifecycle {
prevent_destroy = true
}
tags {
solution = "apps"
}
}
resource "aws_s3_bucket" "next_app" {
count = "${var.create_next_app ? 1 : 0}"
bucket = "next-${var.name}.${var.domain}"
acl = "private"
website {
index_document = "index.html"
error_document = "index.html"
}
Dark Nets

46. Recon

47. resource "aws_s3_bucket" "app" {
count = "${var.create_app ? 1 : 0}"
bucket = "${var.name}.${var.domain}"
acl = "private"
website {
index_document = "index.html"
error_document = "index.html"
}
policy = <<EOF
{
"Version": "2008-10-17",
"Statement": [
{
"Sid": "PublicReadForGetBucketObjects",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::${var.name}.${var.domain}/*"
}
]
}
EOF
lifecycle {
prevent_destroy = true
}
tags {
solution = "apps"
}
}
resource "aws_s3_bucket" "next_app" {
count = "${var.create_next_app ? 1 : 0}"
bucket = "next-${var.name}.${var.domain}"
acl = "private"
website {
index_document = "index.html"
error_document = "index.html"
}
Recon

48. Top10
Dynamic Security
Scanner
Static Code
Analysers
Auxiliary Tools
Terraform
Modules
CloudFormation
Stacks
Research
Papers
Scripts
Log Aggregation
SIEM
FW

49. The goal is the goal

50. Shift to the left
Pentesting / Red Team
Vuln Research
Bug Hunting

51. 1. Self-governing
2. Self-healing
3. Self-defending

52. 1. Self-governing
2. Self-healing
3. Self-defending

53. 1. Self-governing
2. Self-healing
3. Self-defending

54. 1. Self-governing
2. Self-healing
3. Self-defending

55. @pdp
GNUCITIZEN / WEBSECURIFY / SECAPPS

56. LONDON 18-19 OCT 2018
¯_(ツ)_/¯