SlideShare a Scribd company logo
DEVSECOPS AND
THE CI/CD PIPELINE
@WICKETT
Head of Research @ Signal Sciences
Organizer of DevOps Days Austin
lynda.com author on DevOps and Security
Courses
Blog at theagileadmin.com and
labs.signalsciences.com
 DevSecOps and the CI/CD Pipeline
Get the slides now!
james@signalsciences.com
Questions on my Mind
Can Security as an Industry Rise to the
Demands of DevOps?
Is the DevOps culture able to handle security
and all of our baggage?
Will security destroy the DevOps Culture?
SECURITY IS IN CRISIS
This may be hard to see at RSA,
all looks well and good
Companies are spending a great deal on
security, but we read of massive computer-
related attacks. Clearly something is wrong.
The root of the problem is twofold:
we’re protecting the wrong things,
and we’re hurting productivity in the process.
THINKING SECURITY, STEVEN M. BELLOVIN 2015
 DevSecOps and the CI/CD Pipeline
[Security by risk assessment]
introduces a dangerous fallacy: that
structured inadequacy is almost as
good as adequacy and that
underfunded security efforts plus risk
management are about as good as
properly funded security work
many security teams work
with a worldview where their
goal is to inhibit change as
much as possible
“SECURITY PREFERS A SYSTEM POWERED
OFF AND UNPLUGGED”
- DEVELOPER
“…THOSE STUPID DEVELOPERS”
- SECURITY PERSON
Security must Change or Die
 DevSecOps and the CI/CD Pipeline
THE WORLD HAS CHANGED
 DevSecOps and the CI/CD Pipeline
Serverless encourages functions as
deploy units and run as one-time*,
read-only containers*, coupled with
third party services that allow running
end-to-end applications without
worrying about system operation.
* - yes, we know there is container reuse and writability
VMsHardware Serverless
Inspiration from @adrianco
Waste
Value
Read-only containers and
serverless shift the security story
to almost 100% application
security
DEVSECOPS TO THE RESCUE!
What is DevSecOps
DevSecOps Deep Thoughts
Maybe in order to understand devsecops, we have to
look at the word itself. Basically, it’s made up of three
separate words: de, vseco, and ps. What do these
words mean? It’s a mystery, and that’s why so is
devsecops.
- DevSecOps Deep Thoughts
Whenever someone asks
me to define devsecops, I
usually think for a minute,
then I spin around and pin
the guy's arm behind his
back. NOW who's asking the
questions?
- DevSecOps Deep Thoughts
Shoutout to the @TheJewberwocky the original DevOps Deep Thoughts
The original DevOps Deep Thoughts were
created by the hilarious and awesome Josh
Zimmerman (@TheJewberwocky) as Not Jack
Handey which is parody of Deep Thoughts by
Jack Handey.
These DevSecOps Deep Thoughts are not nearly
as funny nor deep, but hey what do you expect of
a parody of a parody?
Many people don't realize that
playing dead can help not only
with bears, but also at
important business meetings.
- Jack Handey
High performing orgs achieve
quality by incorporating security
(and security teams) into the
delivery process
2016 State of DevOps Report
DevSecOps is a cultural
movement that furthers the
movements of Agile and DevOps
into Security
CULTURE IS THE MOST IMPORTANT
ASPECT TO DEVOPS SUCCEEDING
IN THE ENTERPRISE
- PATRICK DEBOIS
10:1
Dev:Ops
100:10:1
Dev:Ops:Sec
 DevSecOps and the CI/CD Pipeline
4 Keys to Culture
Mutual Understanding
Shared Language
Shared Views
Collaborative Tooling
A security team who embraces
openness about what it does and
why, spreads understanding.
- Rich Smith
EMERGING PATTERNS FOR
SECURITY IN A CI/CD WORLD
 DevSecOps and the CI/CD Pipeline
 SECURITY TOOLCHAIN FOR CI/CD
Software Delivery Pipeline
Develop Inherit Build Deploy Operate
 DevSecOps and the CI/CD Pipeline
The design and development of an application and its
features. Including all the development practices like version
control, sprint planning, unit-testing.
Develop Inherit Build Deploy Operate
- Threat Modeling
- Security Stories
- Authentication to Push
- Development Standards
Develop Inherit Build Deploy Operate
Security Activities and Considerations
- Peer Review
- Static Code Analysis
- Unit Tests for Security
- The Threat Modeling Book by Adam
Shostack
- OWASP App Threat Modeling Cheat Sheet
- Evil User Stories (link)
- OWASP Application Security Verification
Standard
- Mozilla Rapid Risk Assessment (link)
Develop Inherit Build Deploy Operate
Threat Modeling and Security Stories
- Pre-commit Hooks for
Security
- Coding Standards (Security
and otherwise)
Develop Inherit Build Deploy Operate
Development Standards
- Peer Review
- Single Mainline Branch
- Linting and Code Hygiene
- git-secrets Prevents you from committing
passwords and other sensitive information to
a git repository. From awslabs. (link)
- git-hound Hound is a Git plugin that helps
prevent sensitive data from being committed
into a repository by sniffing potential commits
against PCRE regular expressions. (link)
Develop Inherit Build Deploy Operate
Code Standards and Team Tooling
- gometalinter or whatever your language
of choice (this is a golang example, you
will need one for your language)
- gofmt formats the code automatically
and makes everything look the same,
easier for everyone to grok (again, this is
specific to lang)
Develop Inherit Build Deploy Operate
Code Standards and Team Tooling is run on
developer laptops and systems, but verified
by CI system.
- Not unfamiliar territory for
security!
- Static Application Security
Testing (SAST)
- IDE Plugin if Possible
Develop Inherit Build Deploy Operate
Static Code Analysis!
- Open Source: Brakeman
(Ruby), FindSecurityBugs (Java),
Phan (PHP), Go AST (golang)
- Paid: Brakeman Pro, Veracode,
Fortify, …
Language / framework Scanning tool
C/C++ Flawfinder
Go Gosec
Java find-sec-bugs
Javascript ESLint
.NET Security Code Scan
Node.js NodeJsScan
PHP • Phan
• Phpcs-security-audit
Python bandit
Ruby / Ruby on Rails brakeman
Scala find-sec-bugs
Open Source SAST Options
Compiled from: GitLab, SANS, OWASP
So many hot takes!
twitter.com/wickett/status/1030535526103900160
- Unit Testing is the currency of Developers
- JUnit, Rspec, Testing (golang), ….
- Goal is to have security tests being written with other unit tests
or whatever testing patterns you use: TDD, BDD, ATDD, …
Develop Inherit Build Deploy Operate
Unit Testing for Security
Are the developers testing for security locally before it gets to CI
system?
Do we practice good hygiene and coding practices?
Are we developing as a team in trunk with few branches?
Develop Inherit Build Deploy Operate
Questions to Ask
This is an overlooked phase because it is the most invisible as
software dependencies get bundled in and inherited in our
own code and upstream.
Develop Inherit Build Deploy Operate
Develop Inherit Build Deploy Operate
- This is your real LOC count!
- The Software Delivery Supply
Chain
- Publish a Bill of Materials and
trace back
Security Considerations
- This is not just application
dependencies and libraries,
but also OS-level (remember
shellshock, heartbleed, ..)
Develop Inherit Build Deploy Operate
- bundler-audit - checks for vulnerable
versions of gems in your ruby code (link)
- OWSAP Dep Check - mostly Java
- nsp - node security platform (link)
- Paid options: Sonatype, BlackDuck,
JFrog
Language Tooling
- Retire.js - known vuln JS libs (link)
Develop Inherit Build Deploy Operate
- Over 30% of containers in
Docker Hub have high sev
vulns (source)
- Open Source: Docker Bench,
Clair
- Paid Options: aqua, twistlock
Containers!
Develop Inherit Build Deploy Operate
What have I bundled into my app that is making vulnerable?
Am I publishing a Bill of Materials with my application?
Questions to Ask
This phase is where the CI build system runs all the build
steps and does acceptance testing. Previous testing and
tooling gets verified here.
Develop Inherit Build Deploy Operate
Develop Inherit Build Deploy Operate
- Outside-In Security Testing
- Infra as Code (Testing)
- Dynamic Application Security
Testing (DAST)
Security Considerations
- Compliance on every build!
- Cloud provider config as
code
- Using containers
Develop Inherit Build Deploy Operate
- These all require tuning and can be
difficult to integrate into build
pipelines.
- Application Security scanners:
Nikto, Arachni, ZAP, sqlmap, xsser,
…
Dynamic Application Security Scanners
- Other - SSLyze, nmap,
ssh_scan
- See Kali Linux
- Paid: Qualys, AppScan,
BurpSuite, …
The goal should be to come up with
a set of automated tests that probe
and check security configurations
and runtime system behavior for
security features that will execute
every time the system is built and
every time it is deployed.
Framework with Security testing written in a natural
language that developers, security and operations can
understand.
Gauntlt wraps security testing tools but does not install tools
Gauntlt was built to be part of the CI/CD pipeline
Open source, MIT License,
gauntlt.org
Gauntlt Example
“We have saved millions of dollars
using Gauntlt for the largest
healthcare industry project.”
- Aaron Rinehart, UnitedHealthCare
https://www.lynda.com/Software-Development-tutorials/Security-Testing/667367-2.html
A Whole Course on Security Testing with Gauntlt
Develop Inherit Build Deploy Operate
- Test Kitchen - https://kitchen.ci/
- Serverspec - http://serverspec.org/
- Chef InSpec - Continuous
Compliance Testing (https://
www.chef.io/inspec/)
Infrastructure and Compliance
- Cloud Provider is
Infrastructure too
- Version and test Cloud
Config (e.g. CloudFormation
for AWS)
Develop Inherit Build Deploy Operate
Am I testing for security low hanging fruit?
Am I arming my pipeline with attack tools to exercise my
application?
Have I validated the previous two phases of testing in secure
build environment?
Questions to Ask
The phase where software moves from our testing to where
customers are able to operate it for the first time.
Develop Inherit Build Deploy Operate
Develop Inherit Build Deploy Operate
- Watch out for Compliance
- Secrets Management
- Deploy Accountability
- Authorization and Logging
Security Considerations
- Monitoring Deploys
- Infra as Code (Execution)
- Repeatable Execution
 DevSecOps and the CI/CD Pipeline
 DevSecOps and the CI/CD Pipeline
Currently, at Signal Sciences we do
about 15 deploys per day
Roughly 10,000 deploys in the last 2.5
yrs
CD is how little you can deploy at a time
We optimized for cycle time—the time
from code commit to production
[Deploys] can be treated as
standard or routine changes
that have been pre-approved
by management, and that
don’t require a heavyweight
change review meeting.
Separation of Duties Considered Harmful
https://cdn2.hubspot.net/hubfs/228391/Corporate/
DevOps_Audit_Defense_Toolkit_v1.0.pdf
Check out DevOps Audit
Defense Toolkit
 DevSecOps and the CI/CD Pipeline
Develop Inherit Build Deploy Operate
- Paid Cloud Config security:
Evident.io, ThreatStack,
AlienVault
- Cloud Provider: AWS
CloudTrail, Inspector, GuardDuty
Monitoring Cloud Config
Develop Inherit Build Deploy Operate
What secrets are needed to move my application from
development into production?
Am I testing for Compliance on each and every deploy?
Is there a repeatable mechanism to push changes to
production?
Questions to Ask
The runtime state of the application, where users interact with
or consume the application. Our application in production.
Develop Inherit Build Deploy Operate
 DevSecOps and the CI/CD Pipeline
Develop Inherit Build Deploy Operate
- Chaos Engineering and creating
stability through instability
- Circuit Break Pattern in use
- Instrumentation and
Visualization
Security Considerations
- Application security and
service abuse and misuse
- Bug Bounties
- Red Teaming as a Service
 DevSecOps and the CI/CD Pipeline
“every aspect of managing WAFs is an ongoing
process. This is the antithesis of set it and forget it
technology. That is the real point of this research.
To maximize value from your WAF you need to go
in with everyone’s eyes open to the effort required
to get and keep the WAF running productively.”
- WHITEPAPER FROM AN UNDISCLOSED WAF VENDOR
Account takeover attempts
Areas of the site under attack
Most likely vectors of attack
Business logic flows
Abuse and Misuse signals
Detect what matters
https://info.signalsciences.com/appsec-defense-needs-top-five
Free
Guidebook
on AppSec in
Modern Era
Which is better application attack feedback?
Develop Inherit Build Deploy Operate
- Open Source: modSecurity +
ELK To gain application insight
monitoring.
- Paid NGWAF / RASP Options:
Signal Sciences, Contrast, Prevoty
Runtime Defense Tooling
- Pro-tip: Avoid adding appsec
defense at the CDN
Red Team Mondays at Intuit
Shannon Lietz
Develop Inherit Build Deploy Operate
- Roll your own!
- Paid Options: HackerOne,
BugCrowd, Synack
Bug Bounties
Develop Inherit Build Deploy Operate
- Log All The Things
- ELK Stack for Open Source
- Paid Options: Splunk,
SumoLogic
Logging Security Telemetry
 DevSecOps and the CI/CD Pipeline
Develop Inherit Build Deploy Operate
Do you know if you are under attack at this current moment?
Do you know what the attackers are going after?
Can I turn on and off services independently if being attacked?
Are we doing Chaos experiments?
Questions to Ask
SECURITY’S NEW CORE IDEOLOGY
The New Ways
Empathy and Enablement
Be Fast and Non-Blocking
Don’t slow delivery
Join with continuous testing efforts
Security testing automated in every phase
Penetration Testing alongside the Pipeline
Security provides value through making security normal
Apply What You Have Learned Today
Next week you should:
Identify the who/where/what of your CI/CD Pipeline
In the first three months following this presentation you should:
Create a plan around the five phases and security tooling and practices
Implement 1-2 tools in the pipeline
Within six months you should:
Have security in all five phases of the pipeline
Answer the maturity questions for each phase
Want the slides and
referenced links?
james@signalsciences.com

More Related Content

What's hot

DevSecOps Implementation Journey
DevSecOps Implementation JourneyDevSecOps Implementation Journey
DevSecOps Implementation Journey
DevOps Indonesia
 
Introduction to DevSecOps
Introduction to DevSecOpsIntroduction to DevSecOps
Introduction to DevSecOps
Setu Parimi
 
[DevSecOps Live] DevSecOps: Challenges and Opportunities
[DevSecOps Live] DevSecOps: Challenges and Opportunities[DevSecOps Live] DevSecOps: Challenges and Opportunities
[DevSecOps Live] DevSecOps: Challenges and Opportunities
Mohammed A. Imran
 
Introduction to DevSecOps
Introduction to DevSecOpsIntroduction to DevSecOps
Introduction to DevSecOps
Amazon Web Services
 
Implementing DevSecOps
Implementing DevSecOpsImplementing DevSecOps
Implementing DevSecOps
Amazon Web Services
 
The State of DevSecOps
The State of DevSecOpsThe State of DevSecOps
The State of DevSecOps
DevOps Indonesia
 
DevSecOps
DevSecOpsDevSecOps
DevSecOps
Cheah Eng Soon
 
DEVSECOPS.pptx
DEVSECOPS.pptxDEVSECOPS.pptx
DEVSECOPS.pptx
MohammadSaif904342
 
DevSecOps reference architectures 2018
DevSecOps reference architectures 2018DevSecOps reference architectures 2018
DevSecOps reference architectures 2018
Sonatype
 
DevSecOps Fundamentals and the Scars to Prove it.
DevSecOps Fundamentals and the Scars to Prove it.DevSecOps Fundamentals and the Scars to Prove it.
DevSecOps Fundamentals and the Scars to Prove it.
Matt Tesauro
 
Security Process in DevSecOps
Security Process in DevSecOpsSecurity Process in DevSecOps
Security Process in DevSecOps
Opsta
 
DevSecOps Basics with Azure Pipelines
DevSecOps Basics with Azure Pipelines DevSecOps Basics with Azure Pipelines
DevSecOps Basics with Azure Pipelines
Abdul_Mujeeb
 
2019 DevSecOps Reference Architectures
2019 DevSecOps Reference Architectures2019 DevSecOps Reference Architectures
2019 DevSecOps Reference Architectures
Sonatype
 
DevSecOps: Key Controls to Modern Security Success
DevSecOps: Key Controls to Modern Security SuccessDevSecOps: Key Controls to Modern Security Success
DevSecOps: Key Controls to Modern Security Success
Puma Security, LLC
 
DevSecOps: Taking a DevOps Approach to Security
DevSecOps: Taking a DevOps Approach to SecurityDevSecOps: Taking a DevOps Approach to Security
DevSecOps: Taking a DevOps Approach to Security
Alert Logic
 
Introduction to DevSecOps
Introduction to DevSecOpsIntroduction to DevSecOps
Introduction to DevSecOps
abhimanyubhogwan
 
Practical DevSecOps - Arief Karfianto
Practical DevSecOps - Arief KarfiantoPractical DevSecOps - Arief Karfianto
Practical DevSecOps - Arief Karfianto
idsecconf
 
DevSecOps Jenkins Pipeline -Security
DevSecOps Jenkins Pipeline -SecurityDevSecOps Jenkins Pipeline -Security
DevSecOps Jenkins Pipeline -Security
n|u - The Open Security Community
 
Slide DevSecOps Microservices
Slide DevSecOps Microservices Slide DevSecOps Microservices
Slide DevSecOps Microservices
Hendri Karisma
 
Introduction to CICD
Introduction to CICDIntroduction to CICD
Introduction to CICD
Knoldus Inc.
 

What's hot (20)

DevSecOps Implementation Journey
DevSecOps Implementation JourneyDevSecOps Implementation Journey
DevSecOps Implementation Journey
 
Introduction to DevSecOps
Introduction to DevSecOpsIntroduction to DevSecOps
Introduction to DevSecOps
 
[DevSecOps Live] DevSecOps: Challenges and Opportunities
[DevSecOps Live] DevSecOps: Challenges and Opportunities[DevSecOps Live] DevSecOps: Challenges and Opportunities
[DevSecOps Live] DevSecOps: Challenges and Opportunities
 
Introduction to DevSecOps
Introduction to DevSecOpsIntroduction to DevSecOps
Introduction to DevSecOps
 
Implementing DevSecOps
Implementing DevSecOpsImplementing DevSecOps
Implementing DevSecOps
 
The State of DevSecOps
The State of DevSecOpsThe State of DevSecOps
The State of DevSecOps
 
DevSecOps
DevSecOpsDevSecOps
DevSecOps
 
DEVSECOPS.pptx
DEVSECOPS.pptxDEVSECOPS.pptx
DEVSECOPS.pptx
 
DevSecOps reference architectures 2018
DevSecOps reference architectures 2018DevSecOps reference architectures 2018
DevSecOps reference architectures 2018
 
DevSecOps Fundamentals and the Scars to Prove it.
DevSecOps Fundamentals and the Scars to Prove it.DevSecOps Fundamentals and the Scars to Prove it.
DevSecOps Fundamentals and the Scars to Prove it.
 
Security Process in DevSecOps
Security Process in DevSecOpsSecurity Process in DevSecOps
Security Process in DevSecOps
 
DevSecOps Basics with Azure Pipelines
DevSecOps Basics with Azure Pipelines DevSecOps Basics with Azure Pipelines
DevSecOps Basics with Azure Pipelines
 
2019 DevSecOps Reference Architectures
2019 DevSecOps Reference Architectures2019 DevSecOps Reference Architectures
2019 DevSecOps Reference Architectures
 
DevSecOps: Key Controls to Modern Security Success
DevSecOps: Key Controls to Modern Security SuccessDevSecOps: Key Controls to Modern Security Success
DevSecOps: Key Controls to Modern Security Success
 
DevSecOps: Taking a DevOps Approach to Security
DevSecOps: Taking a DevOps Approach to SecurityDevSecOps: Taking a DevOps Approach to Security
DevSecOps: Taking a DevOps Approach to Security
 
Introduction to DevSecOps
Introduction to DevSecOpsIntroduction to DevSecOps
Introduction to DevSecOps
 
Practical DevSecOps - Arief Karfianto
Practical DevSecOps - Arief KarfiantoPractical DevSecOps - Arief Karfianto
Practical DevSecOps - Arief Karfianto
 
DevSecOps Jenkins Pipeline -Security
DevSecOps Jenkins Pipeline -SecurityDevSecOps Jenkins Pipeline -Security
DevSecOps Jenkins Pipeline -Security
 
Slide DevSecOps Microservices
Slide DevSecOps Microservices Slide DevSecOps Microservices
Slide DevSecOps Microservices
 
Introduction to CICD
Introduction to CICDIntroduction to CICD
Introduction to CICD
 

Similar to DevSecOps and the CI/CD Pipeline

The Emergent Cloud Security Toolchain for CI/CD
The Emergent Cloud Security Toolchain for CI/CDThe Emergent Cloud Security Toolchain for CI/CD
The Emergent Cloud Security Toolchain for CI/CD
James Wickett
 
Pragmatic Pipeline Security
Pragmatic Pipeline SecurityPragmatic Pipeline Security
Pragmatic Pipeline Security
James Wickett
 
The Emergent Cloud Security Toolchain for CI/CD
The Emergent Cloud Security Toolchain for CI/CDThe Emergent Cloud Security Toolchain for CI/CD
The Emergent Cloud Security Toolchain for CI/CD
James Wickett
 
DevOps for Defenders in the Enterprise
DevOps for Defenders in the EnterpriseDevOps for Defenders in the Enterprise
DevOps for Defenders in the Enterprise
James Wickett
 
Dev{sec}ops
Dev{sec}opsDev{sec}ops
Dev{sec}ops
Steven Carlson
 
Secure Your DevOps Pipeline Best Practices Meetup 08022024.pptx
Secure Your DevOps Pipeline Best Practices Meetup 08022024.pptxSecure Your DevOps Pipeline Best Practices Meetup 08022024.pptx
Secure Your DevOps Pipeline Best Practices Meetup 08022024.pptx
lior mazor
 
DevSecOps | DevOps Sec
DevSecOps | DevOps SecDevSecOps | DevOps Sec
DevSecOps | DevOps Sec
Rubal Jain
 
SCS DevSecOps Seminar - State of DevSecOps
SCS DevSecOps Seminar - State of DevSecOpsSCS DevSecOps Seminar - State of DevSecOps
SCS DevSecOps Seminar - State of DevSecOps
Stefan Streichsbier
 
Successfully Implementing DEV-SEC-OPS in the Cloud
Successfully Implementing DEV-SEC-OPS in the CloudSuccessfully Implementing DEV-SEC-OPS in the Cloud
Successfully Implementing DEV-SEC-OPS in the Cloud
Amazon Web Services
 
Kube Security Shifting left | Scanners & OPA
Kube Security Shifting left | Scanners & OPAKube Security Shifting left | Scanners & OPA
Kube Security Shifting left | Scanners & OPA
Haggai Philip Zagury
 
Maturing DevSecOps: From Easy to High Impact
Maturing DevSecOps: From Easy to High ImpactMaturing DevSecOps: From Easy to High Impact
Maturing DevSecOps: From Easy to High Impact
SBWebinars
 
Product Security
Product SecurityProduct Security
Product Security
Steven Carlson
 
10 Reasons Your Software Sucks 2014 - Tax Day Edition!
10 Reasons Your Software Sucks 2014 - Tax Day Edition!10 Reasons Your Software Sucks 2014 - Tax Day Edition!
10 Reasons Your Software Sucks 2014 - Tax Day Edition!
Caleb Jenkins
 
What DevOps Isn't
What DevOps Isn'tWhat DevOps Isn't
What DevOps Isn't
Frank Lamantia
 
Scale security for a dollar or less
Scale security for a dollar or lessScale security for a dollar or less
Scale security for a dollar or less
Mohammed A. Imran
 
Strengthen and Scale Security for a dollar or less
Strengthen and Scale Security for a dollar or lessStrengthen and Scale Security for a dollar or less
Strengthen and Scale Security for a dollar or less
Mohammed A. Imran
 
Strengthen and Scale Security Using DevSecOps - OWASP Indonesia
Strengthen and Scale Security Using DevSecOps - OWASP IndonesiaStrengthen and Scale Security Using DevSecOps - OWASP Indonesia
Strengthen and Scale Security Using DevSecOps - OWASP Indonesia
Mohammed A. Imran
 
Top 10 Software to Detect & Prevent Security Vulnerabilities from BlackHat US...
Top 10 Software to Detect & Prevent Security Vulnerabilities from BlackHat US...Top 10 Software to Detect & Prevent Security Vulnerabilities from BlackHat US...
Top 10 Software to Detect & Prevent Security Vulnerabilities from BlackHat US...
Mobodexter
 
VMWare Tech Talk: "The Road from Rugged DevOps to Security Chaos Engineering"
VMWare Tech Talk: "The Road from Rugged DevOps to Security Chaos Engineering"VMWare Tech Talk: "The Road from Rugged DevOps to Security Chaos Engineering"
VMWare Tech Talk: "The Road from Rugged DevOps to Security Chaos Engineering"
Aaron Rinehart
 
DevOps to DevSecOps Journey..
DevOps to DevSecOps Journey..DevOps to DevSecOps Journey..
DevOps to DevSecOps Journey..
Siddharth Joshi
 

Similar to DevSecOps and the CI/CD Pipeline (20)

The Emergent Cloud Security Toolchain for CI/CD
The Emergent Cloud Security Toolchain for CI/CDThe Emergent Cloud Security Toolchain for CI/CD
The Emergent Cloud Security Toolchain for CI/CD
 
Pragmatic Pipeline Security
Pragmatic Pipeline SecurityPragmatic Pipeline Security
Pragmatic Pipeline Security
 
The Emergent Cloud Security Toolchain for CI/CD
The Emergent Cloud Security Toolchain for CI/CDThe Emergent Cloud Security Toolchain for CI/CD
The Emergent Cloud Security Toolchain for CI/CD
 
DevOps for Defenders in the Enterprise
DevOps for Defenders in the EnterpriseDevOps for Defenders in the Enterprise
DevOps for Defenders in the Enterprise
 
Dev{sec}ops
Dev{sec}opsDev{sec}ops
Dev{sec}ops
 
Secure Your DevOps Pipeline Best Practices Meetup 08022024.pptx
Secure Your DevOps Pipeline Best Practices Meetup 08022024.pptxSecure Your DevOps Pipeline Best Practices Meetup 08022024.pptx
Secure Your DevOps Pipeline Best Practices Meetup 08022024.pptx
 
DevSecOps | DevOps Sec
DevSecOps | DevOps SecDevSecOps | DevOps Sec
DevSecOps | DevOps Sec
 
SCS DevSecOps Seminar - State of DevSecOps
SCS DevSecOps Seminar - State of DevSecOpsSCS DevSecOps Seminar - State of DevSecOps
SCS DevSecOps Seminar - State of DevSecOps
 
Successfully Implementing DEV-SEC-OPS in the Cloud
Successfully Implementing DEV-SEC-OPS in the CloudSuccessfully Implementing DEV-SEC-OPS in the Cloud
Successfully Implementing DEV-SEC-OPS in the Cloud
 
Kube Security Shifting left | Scanners & OPA
Kube Security Shifting left | Scanners & OPAKube Security Shifting left | Scanners & OPA
Kube Security Shifting left | Scanners & OPA
 
Maturing DevSecOps: From Easy to High Impact
Maturing DevSecOps: From Easy to High ImpactMaturing DevSecOps: From Easy to High Impact
Maturing DevSecOps: From Easy to High Impact
 
Product Security
Product SecurityProduct Security
Product Security
 
10 Reasons Your Software Sucks 2014 - Tax Day Edition!
10 Reasons Your Software Sucks 2014 - Tax Day Edition!10 Reasons Your Software Sucks 2014 - Tax Day Edition!
10 Reasons Your Software Sucks 2014 - Tax Day Edition!
 
What DevOps Isn't
What DevOps Isn'tWhat DevOps Isn't
What DevOps Isn't
 
Scale security for a dollar or less
Scale security for a dollar or lessScale security for a dollar or less
Scale security for a dollar or less
 
Strengthen and Scale Security for a dollar or less
Strengthen and Scale Security for a dollar or lessStrengthen and Scale Security for a dollar or less
Strengthen and Scale Security for a dollar or less
 
Strengthen and Scale Security Using DevSecOps - OWASP Indonesia
Strengthen and Scale Security Using DevSecOps - OWASP IndonesiaStrengthen and Scale Security Using DevSecOps - OWASP Indonesia
Strengthen and Scale Security Using DevSecOps - OWASP Indonesia
 
Top 10 Software to Detect & Prevent Security Vulnerabilities from BlackHat US...
Top 10 Software to Detect & Prevent Security Vulnerabilities from BlackHat US...Top 10 Software to Detect & Prevent Security Vulnerabilities from BlackHat US...
Top 10 Software to Detect & Prevent Security Vulnerabilities from BlackHat US...
 
VMWare Tech Talk: "The Road from Rugged DevOps to Security Chaos Engineering"
VMWare Tech Talk: "The Road from Rugged DevOps to Security Chaos Engineering"VMWare Tech Talk: "The Road from Rugged DevOps to Security Chaos Engineering"
VMWare Tech Talk: "The Road from Rugged DevOps to Security Chaos Engineering"
 
DevOps to DevSecOps Journey..
DevOps to DevSecOps Journey..DevOps to DevSecOps Journey..
DevOps to DevSecOps Journey..
 

More from James Wickett

A Pragmatic Union: Security and SRE
A Pragmatic Union: Security and SREA Pragmatic Union: Security and SRE
A Pragmatic Union: Security and SRE
James Wickett
 
A Way to Think about DevSecOps: MEASURE
A Way to Think about DevSecOps: MEASUREA Way to Think about DevSecOps: MEASURE
A Way to Think about DevSecOps: MEASURE
James Wickett
 
The Security, DevOps, and Chaos Playbook to Change the World
The Security, DevOps, and Chaos Playbook to Change the WorldThe Security, DevOps, and Chaos Playbook to Change the World
The Security, DevOps, and Chaos Playbook to Change the World
James Wickett
 
A Tale of Woe, Chaos, and Business
A Tale of Woe, Chaos, and BusinessA Tale of Woe, Chaos, and Business
A Tale of Woe, Chaos, and Business
James Wickett
 
A DevSecOps Tale of Business, Engineering, and People
A DevSecOps Tale of Business, Engineering, and PeopleA DevSecOps Tale of Business, Engineering, and People
A DevSecOps Tale of Business, Engineering, and People
James Wickett
 
The New Ways of DevSecOps - The Secure Dev 2019
The New Ways of DevSecOps - The Secure Dev 2019The New Ways of DevSecOps - The Secure Dev 2019
The New Ways of DevSecOps - The Secure Dev 2019
James Wickett
 
NewOps Days 2019: The New Ways of Chaos, Security, and DevOps
NewOps Days 2019: The New Ways of Chaos, Security, and DevOpsNewOps Days 2019: The New Ways of Chaos, Security, and DevOps
NewOps Days 2019: The New Ways of Chaos, Security, and DevOps
James Wickett
 
The New Ways of Chaos, Security, and DevOps
The New Ways of Chaos, Security, and DevOpsThe New Ways of Chaos, Security, and DevOps
The New Ways of Chaos, Security, and DevOps
James Wickett
 
DevOpsDays Austin: Security in the FaaS Lane
DevOpsDays Austin: Security in the FaaS LaneDevOpsDays Austin: Security in the FaaS Lane
DevOpsDays Austin: Security in the FaaS Lane
James Wickett
 
The Seven Habits of the Highly Effective DevSecOp
The Seven Habits of the Highly Effective DevSecOpThe Seven Habits of the Highly Effective DevSecOp
The Seven Habits of the Highly Effective DevSecOp
James Wickett
 
Serverless Security: A How-to Guide @ SnowFROC 2019
Serverless Security: A How-to Guide @ SnowFROC 2019Serverless Security: A How-to Guide @ SnowFROC 2019
Serverless Security: A How-to Guide @ SnowFROC 2019
James Wickett
 
Release Your Inner DevSecOp
Release Your Inner DevSecOpRelease Your Inner DevSecOp
Release Your Inner DevSecOp
James Wickett
 
Security in the FaaS Lane
Security in the FaaS LaneSecurity in the FaaS Lane
Security in the FaaS Lane
James Wickett
 
The New Security Playbook: DevSecOps
The New Security Playbook: DevSecOpsThe New Security Playbook: DevSecOps
The New Security Playbook: DevSecOps
James Wickett
 
Adversary Driven Defense in the Real World
Adversary Driven Defense in the Real WorldAdversary Driven Defense in the Real World
Adversary Driven Defense in the Real World
James Wickett
 
The DevSecOps Builder’s Guide to the CI/CD Pipeline
The DevSecOps Builder’s Guide to the CI/CD PipelineThe DevSecOps Builder’s Guide to the CI/CD Pipeline
The DevSecOps Builder’s Guide to the CI/CD Pipeline
James Wickett
 
The State of DevSecOps in 2018
The State of DevSecOps in 2018The State of DevSecOps in 2018
The State of DevSecOps in 2018
James Wickett
 
DevSecOps in the Year 2018
DevSecOps in the Year 2018DevSecOps in the Year 2018
DevSecOps in the Year 2018
James Wickett
 
DevSecOps and the New Path Forward
DevSecOps and the New Path ForwardDevSecOps and the New Path Forward
DevSecOps and the New Path Forward
James Wickett
 
AppSec California 2018: The Path of DevOps Enlightenment for InfoSec
AppSec California 2018: The Path of DevOps Enlightenment for InfoSecAppSec California 2018: The Path of DevOps Enlightenment for InfoSec
AppSec California 2018: The Path of DevOps Enlightenment for InfoSec
James Wickett
 

More from James Wickett (20)

A Pragmatic Union: Security and SRE
A Pragmatic Union: Security and SREA Pragmatic Union: Security and SRE
A Pragmatic Union: Security and SRE
 
A Way to Think about DevSecOps: MEASURE
A Way to Think about DevSecOps: MEASUREA Way to Think about DevSecOps: MEASURE
A Way to Think about DevSecOps: MEASURE
 
The Security, DevOps, and Chaos Playbook to Change the World
The Security, DevOps, and Chaos Playbook to Change the WorldThe Security, DevOps, and Chaos Playbook to Change the World
The Security, DevOps, and Chaos Playbook to Change the World
 
A Tale of Woe, Chaos, and Business
A Tale of Woe, Chaos, and BusinessA Tale of Woe, Chaos, and Business
A Tale of Woe, Chaos, and Business
 
A DevSecOps Tale of Business, Engineering, and People
A DevSecOps Tale of Business, Engineering, and PeopleA DevSecOps Tale of Business, Engineering, and People
A DevSecOps Tale of Business, Engineering, and People
 
The New Ways of DevSecOps - The Secure Dev 2019
The New Ways of DevSecOps - The Secure Dev 2019The New Ways of DevSecOps - The Secure Dev 2019
The New Ways of DevSecOps - The Secure Dev 2019
 
NewOps Days 2019: The New Ways of Chaos, Security, and DevOps
NewOps Days 2019: The New Ways of Chaos, Security, and DevOpsNewOps Days 2019: The New Ways of Chaos, Security, and DevOps
NewOps Days 2019: The New Ways of Chaos, Security, and DevOps
 
The New Ways of Chaos, Security, and DevOps
The New Ways of Chaos, Security, and DevOpsThe New Ways of Chaos, Security, and DevOps
The New Ways of Chaos, Security, and DevOps
 
DevOpsDays Austin: Security in the FaaS Lane
DevOpsDays Austin: Security in the FaaS LaneDevOpsDays Austin: Security in the FaaS Lane
DevOpsDays Austin: Security in the FaaS Lane
 
The Seven Habits of the Highly Effective DevSecOp
The Seven Habits of the Highly Effective DevSecOpThe Seven Habits of the Highly Effective DevSecOp
The Seven Habits of the Highly Effective DevSecOp
 
Serverless Security: A How-to Guide @ SnowFROC 2019
Serverless Security: A How-to Guide @ SnowFROC 2019Serverless Security: A How-to Guide @ SnowFROC 2019
Serverless Security: A How-to Guide @ SnowFROC 2019
 
Release Your Inner DevSecOp
Release Your Inner DevSecOpRelease Your Inner DevSecOp
Release Your Inner DevSecOp
 
Security in the FaaS Lane
Security in the FaaS LaneSecurity in the FaaS Lane
Security in the FaaS Lane
 
The New Security Playbook: DevSecOps
The New Security Playbook: DevSecOpsThe New Security Playbook: DevSecOps
The New Security Playbook: DevSecOps
 
Adversary Driven Defense in the Real World
Adversary Driven Defense in the Real WorldAdversary Driven Defense in the Real World
Adversary Driven Defense in the Real World
 
The DevSecOps Builder’s Guide to the CI/CD Pipeline
The DevSecOps Builder’s Guide to the CI/CD PipelineThe DevSecOps Builder’s Guide to the CI/CD Pipeline
The DevSecOps Builder’s Guide to the CI/CD Pipeline
 
The State of DevSecOps in 2018
The State of DevSecOps in 2018The State of DevSecOps in 2018
The State of DevSecOps in 2018
 
DevSecOps in the Year 2018
DevSecOps in the Year 2018DevSecOps in the Year 2018
DevSecOps in the Year 2018
 
DevSecOps and the New Path Forward
DevSecOps and the New Path ForwardDevSecOps and the New Path Forward
DevSecOps and the New Path Forward
 
AppSec California 2018: The Path of DevOps Enlightenment for InfoSec
AppSec California 2018: The Path of DevOps Enlightenment for InfoSecAppSec California 2018: The Path of DevOps Enlightenment for InfoSec
AppSec California 2018: The Path of DevOps Enlightenment for InfoSec
 

Recently uploaded

Odoo E-commerce website development guides
Odoo E-commerce website development guidesOdoo E-commerce website development guides
Odoo E-commerce website development guides
jhkdigitalmarketing
 
React Native vs Flutter - SSTech System
React Native vs Flutter  - SSTech SystemReact Native vs Flutter  - SSTech System
React Native vs Flutter - SSTech System
SSTech System
 
The Ultimate Guide to Phone Spy Apps: Everything You Need to Know
The Ultimate Guide to Phone Spy Apps: Everything You Need to KnowThe Ultimate Guide to Phone Spy Apps: Everything You Need to Know
The Ultimate Guide to Phone Spy Apps: Everything You Need to Know
onemonitarsoftware
 
Folding Cheat Sheet #7 - seventh in a series
Folding Cheat Sheet #7 - seventh in a seriesFolding Cheat Sheet #7 - seventh in a series
Folding Cheat Sheet #7 - seventh in a series
Philip Schwarz
 
To Avoid Mistakes When Using Online Attendance Sheets
To Avoid Mistakes When Using Online Attendance SheetsTo Avoid Mistakes When Using Online Attendance Sheets
To Avoid Mistakes When Using Online Attendance Sheets
Task Tracker
 
HIRE A HACKER FOR CHEATING HUSBAND/WIFE)
HIRE A HACKER FOR CHEATING HUSBAND/WIFE)HIRE A HACKER FOR CHEATING HUSBAND/WIFE)
HIRE A HACKER FOR CHEATING HUSBAND/WIFE)
josephinedrea942
 
Girls Call Mysore 000XX00000 Provide Best And Top Girl Service And No1 in City
Girls Call Mysore 000XX00000 Provide Best And Top Girl Service And No1 in CityGirls Call Mysore 000XX00000 Provide Best And Top Girl Service And No1 in City
Girls Call Mysore 000XX00000 Provide Best And Top Girl Service And No1 in City
neshakor5152
 
bangalore Girls call 👀 XXXXXXXXXXX 👀 Rs.9.5 K Cash Payment With Room Delivery
bangalore Girls call  👀 XXXXXXXXXXX 👀 Rs.9.5 K Cash Payment With Room Deliverybangalore Girls call  👀 XXXXXXXXXXX 👀 Rs.9.5 K Cash Payment With Room Delivery
bangalore Girls call 👀 XXXXXXXXXXX 👀 Rs.9.5 K Cash Payment With Room Delivery
sunilverma7884
 
11 Top Cross Browser Testing Tools to Know About.pdf
11 Top Cross Browser Testing Tools to Know About.pdf11 Top Cross Browser Testing Tools to Know About.pdf
11 Top Cross Browser Testing Tools to Know About.pdf
kalichargn70th171
 
Comprehensive Vulnerability Assessments Process _ Aardwolf Security.docx
Comprehensive Vulnerability Assessments Process _ Aardwolf Security.docxComprehensive Vulnerability Assessments Process _ Aardwolf Security.docx
Comprehensive Vulnerability Assessments Process _ Aardwolf Security.docx
Aardwolf Security
 
Software development... for all? (keynote at ICSOFT'2024)
Software development... for all? (keynote at ICSOFT'2024)Software development... for all? (keynote at ICSOFT'2024)
Software development... for all? (keynote at ICSOFT'2024)
miso_uam
 
Introduction to Cloud computing for Internet of Things
Introduction to Cloud computing for Internet of ThingsIntroduction to Cloud computing for Internet of Things
Introduction to Cloud computing for Internet of Things
NachuSubramanian1
 
Cisco Live Announcements: New ThousandEyes Release Highlights - July 2024
Cisco Live Announcements: New ThousandEyes Release Highlights - July 2024Cisco Live Announcements: New ThousandEyes Release Highlights - July 2024
Cisco Live Announcements: New ThousandEyes Release Highlights - July 2024
ThousandEyes
 
Il Data Streaming per un’AI real-time di nuova generazione
Il Data Streaming per un’AI real-time di nuova generazioneIl Data Streaming per un’AI real-time di nuova generazione
Il Data Streaming per un’AI real-time di nuova generazione
confluent
 
Maximizing Efficiency and Profitability: Optimizing Data Systems, Enhancing C...
Maximizing Efficiency and Profitability: Optimizing Data Systems, Enhancing C...Maximizing Efficiency and Profitability: Optimizing Data Systems, Enhancing C...
Maximizing Efficiency and Profitability: Optimizing Data Systems, Enhancing C...
OnePlan Solutions
 
Mumbai Girls Call Mumbai 🎈🔥9930687706 🔥💋🎈 Provide Best And Top Girl Service A...
Mumbai Girls Call Mumbai 🎈🔥9930687706 🔥💋🎈 Provide Best And Top Girl Service A...Mumbai Girls Call Mumbai 🎈🔥9930687706 🔥💋🎈 Provide Best And Top Girl Service A...
Mumbai Girls Call Mumbai 🎈🔥9930687706 🔥💋🎈 Provide Best And Top Girl Service A...
3610stuck
 
Busty Girls Call Mumbai 9930245274 Unlimited Short Providing Girls Service Av...
Busty Girls Call Mumbai 9930245274 Unlimited Short Providing Girls Service Av...Busty Girls Call Mumbai 9930245274 Unlimited Short Providing Girls Service Av...
Busty Girls Call Mumbai 9930245274 Unlimited Short Providing Girls Service Av...
revolutionary575
 
VVIP Girls Call Mumbai 9910780858 Provide Best And Top Girl Service And No1 i...
VVIP Girls Call Mumbai 9910780858 Provide Best And Top Girl Service And No1 i...VVIP Girls Call Mumbai 9910780858 Provide Best And Top Girl Service And No1 i...
VVIP Girls Call Mumbai 9910780858 Provide Best And Top Girl Service And No1 i...
jealousviolet
 
Vip Girls Call ServiCe Hyderabad 0000000000 Pooja Best High Class Hyderabad A...
Vip Girls Call ServiCe Hyderabad 0000000000 Pooja Best High Class Hyderabad A...Vip Girls Call ServiCe Hyderabad 0000000000 Pooja Best High Class Hyderabad A...
Vip Girls Call ServiCe Hyderabad 0000000000 Pooja Best High Class Hyderabad A...
ashiklo9823
 
Google ML-Kit - Understanding on-device machine learning
Google ML-Kit - Understanding on-device machine learningGoogle ML-Kit - Understanding on-device machine learning
Google ML-Kit - Understanding on-device machine learning
VishrutGoyani1
 

Recently uploaded (20)

Odoo E-commerce website development guides
Odoo E-commerce website development guidesOdoo E-commerce website development guides
Odoo E-commerce website development guides
 
React Native vs Flutter - SSTech System
React Native vs Flutter  - SSTech SystemReact Native vs Flutter  - SSTech System
React Native vs Flutter - SSTech System
 
The Ultimate Guide to Phone Spy Apps: Everything You Need to Know
The Ultimate Guide to Phone Spy Apps: Everything You Need to KnowThe Ultimate Guide to Phone Spy Apps: Everything You Need to Know
The Ultimate Guide to Phone Spy Apps: Everything You Need to Know
 
Folding Cheat Sheet #7 - seventh in a series
Folding Cheat Sheet #7 - seventh in a seriesFolding Cheat Sheet #7 - seventh in a series
Folding Cheat Sheet #7 - seventh in a series
 
To Avoid Mistakes When Using Online Attendance Sheets
To Avoid Mistakes When Using Online Attendance SheetsTo Avoid Mistakes When Using Online Attendance Sheets
To Avoid Mistakes When Using Online Attendance Sheets
 
HIRE A HACKER FOR CHEATING HUSBAND/WIFE)
HIRE A HACKER FOR CHEATING HUSBAND/WIFE)HIRE A HACKER FOR CHEATING HUSBAND/WIFE)
HIRE A HACKER FOR CHEATING HUSBAND/WIFE)
 
Girls Call Mysore 000XX00000 Provide Best And Top Girl Service And No1 in City
Girls Call Mysore 000XX00000 Provide Best And Top Girl Service And No1 in CityGirls Call Mysore 000XX00000 Provide Best And Top Girl Service And No1 in City
Girls Call Mysore 000XX00000 Provide Best And Top Girl Service And No1 in City
 
bangalore Girls call 👀 XXXXXXXXXXX 👀 Rs.9.5 K Cash Payment With Room Delivery
bangalore Girls call  👀 XXXXXXXXXXX 👀 Rs.9.5 K Cash Payment With Room Deliverybangalore Girls call  👀 XXXXXXXXXXX 👀 Rs.9.5 K Cash Payment With Room Delivery
bangalore Girls call 👀 XXXXXXXXXXX 👀 Rs.9.5 K Cash Payment With Room Delivery
 
11 Top Cross Browser Testing Tools to Know About.pdf
11 Top Cross Browser Testing Tools to Know About.pdf11 Top Cross Browser Testing Tools to Know About.pdf
11 Top Cross Browser Testing Tools to Know About.pdf
 
Comprehensive Vulnerability Assessments Process _ Aardwolf Security.docx
Comprehensive Vulnerability Assessments Process _ Aardwolf Security.docxComprehensive Vulnerability Assessments Process _ Aardwolf Security.docx
Comprehensive Vulnerability Assessments Process _ Aardwolf Security.docx
 
Software development... for all? (keynote at ICSOFT'2024)
Software development... for all? (keynote at ICSOFT'2024)Software development... for all? (keynote at ICSOFT'2024)
Software development... for all? (keynote at ICSOFT'2024)
 
Introduction to Cloud computing for Internet of Things
Introduction to Cloud computing for Internet of ThingsIntroduction to Cloud computing for Internet of Things
Introduction to Cloud computing for Internet of Things
 
Cisco Live Announcements: New ThousandEyes Release Highlights - July 2024
Cisco Live Announcements: New ThousandEyes Release Highlights - July 2024Cisco Live Announcements: New ThousandEyes Release Highlights - July 2024
Cisco Live Announcements: New ThousandEyes Release Highlights - July 2024
 
Il Data Streaming per un’AI real-time di nuova generazione
Il Data Streaming per un’AI real-time di nuova generazioneIl Data Streaming per un’AI real-time di nuova generazione
Il Data Streaming per un’AI real-time di nuova generazione
 
Maximizing Efficiency and Profitability: Optimizing Data Systems, Enhancing C...
Maximizing Efficiency and Profitability: Optimizing Data Systems, Enhancing C...Maximizing Efficiency and Profitability: Optimizing Data Systems, Enhancing C...
Maximizing Efficiency and Profitability: Optimizing Data Systems, Enhancing C...
 
Mumbai Girls Call Mumbai 🎈🔥9930687706 🔥💋🎈 Provide Best And Top Girl Service A...
Mumbai Girls Call Mumbai 🎈🔥9930687706 🔥💋🎈 Provide Best And Top Girl Service A...Mumbai Girls Call Mumbai 🎈🔥9930687706 🔥💋🎈 Provide Best And Top Girl Service A...
Mumbai Girls Call Mumbai 🎈🔥9930687706 🔥💋🎈 Provide Best And Top Girl Service A...
 
Busty Girls Call Mumbai 9930245274 Unlimited Short Providing Girls Service Av...
Busty Girls Call Mumbai 9930245274 Unlimited Short Providing Girls Service Av...Busty Girls Call Mumbai 9930245274 Unlimited Short Providing Girls Service Av...
Busty Girls Call Mumbai 9930245274 Unlimited Short Providing Girls Service Av...
 
VVIP Girls Call Mumbai 9910780858 Provide Best And Top Girl Service And No1 i...
VVIP Girls Call Mumbai 9910780858 Provide Best And Top Girl Service And No1 i...VVIP Girls Call Mumbai 9910780858 Provide Best And Top Girl Service And No1 i...
VVIP Girls Call Mumbai 9910780858 Provide Best And Top Girl Service And No1 i...
 
Vip Girls Call ServiCe Hyderabad 0000000000 Pooja Best High Class Hyderabad A...
Vip Girls Call ServiCe Hyderabad 0000000000 Pooja Best High Class Hyderabad A...Vip Girls Call ServiCe Hyderabad 0000000000 Pooja Best High Class Hyderabad A...
Vip Girls Call ServiCe Hyderabad 0000000000 Pooja Best High Class Hyderabad A...
 
Google ML-Kit - Understanding on-device machine learning
Google ML-Kit - Understanding on-device machine learningGoogle ML-Kit - Understanding on-device machine learning
Google ML-Kit - Understanding on-device machine learning
 

DevSecOps and the CI/CD Pipeline

  • 2. @WICKETT Head of Research @ Signal Sciences Organizer of DevOps Days Austin lynda.com author on DevOps and Security Courses Blog at theagileadmin.com and labs.signalsciences.com
  • 4. Get the slides now! james@signalsciences.com
  • 5. Questions on my Mind Can Security as an Industry Rise to the Demands of DevOps? Is the DevOps culture able to handle security and all of our baggage? Will security destroy the DevOps Culture?
  • 6. SECURITY IS IN CRISIS
  • 7. This may be hard to see at RSA, all looks well and good
  • 8. Companies are spending a great deal on security, but we read of massive computer- related attacks. Clearly something is wrong. The root of the problem is twofold: we’re protecting the wrong things, and we’re hurting productivity in the process. THINKING SECURITY, STEVEN M. BELLOVIN 2015
  • 10. [Security by risk assessment] introduces a dangerous fallacy: that structured inadequacy is almost as good as adequacy and that underfunded security efforts plus risk management are about as good as properly funded security work
  • 11. many security teams work with a worldview where their goal is to inhibit change as much as possible
  • 12. “SECURITY PREFERS A SYSTEM POWERED OFF AND UNPLUGGED” - DEVELOPER
  • 16. THE WORLD HAS CHANGED
  • 18. Serverless encourages functions as deploy units and run as one-time*, read-only containers*, coupled with third party services that allow running end-to-end applications without worrying about system operation. * - yes, we know there is container reuse and writability
  • 20. Read-only containers and serverless shift the security story to almost 100% application security
  • 21. DEVSECOPS TO THE RESCUE!
  • 24. Maybe in order to understand devsecops, we have to look at the word itself. Basically, it’s made up of three separate words: de, vseco, and ps. What do these words mean? It’s a mystery, and that’s why so is devsecops. - DevSecOps Deep Thoughts
  • 25. Whenever someone asks me to define devsecops, I usually think for a minute, then I spin around and pin the guy's arm behind his back. NOW who's asking the questions? - DevSecOps Deep Thoughts Shoutout to the @TheJewberwocky the original DevOps Deep Thoughts
  • 26. The original DevOps Deep Thoughts were created by the hilarious and awesome Josh Zimmerman (@TheJewberwocky) as Not Jack Handey which is parody of Deep Thoughts by Jack Handey. These DevSecOps Deep Thoughts are not nearly as funny nor deep, but hey what do you expect of a parody of a parody?
  • 27. Many people don't realize that playing dead can help not only with bears, but also at important business meetings. - Jack Handey
  • 28. High performing orgs achieve quality by incorporating security (and security teams) into the delivery process 2016 State of DevOps Report
  • 29. DevSecOps is a cultural movement that furthers the movements of Agile and DevOps into Security
  • 30. CULTURE IS THE MOST IMPORTANT ASPECT TO DEVOPS SUCCEEDING IN THE ENTERPRISE - PATRICK DEBOIS
  • 34. 4 Keys to Culture Mutual Understanding Shared Language Shared Views Collaborative Tooling
  • 35. A security team who embraces openness about what it does and why, spreads understanding. - Rich Smith
  • 36. EMERGING PATTERNS FOR SECURITY IN A CI/CD WORLD
  • 39. Software Delivery Pipeline Develop Inherit Build Deploy Operate
  • 41. The design and development of an application and its features. Including all the development practices like version control, sprint planning, unit-testing. Develop Inherit Build Deploy Operate
  • 42. - Threat Modeling - Security Stories - Authentication to Push - Development Standards Develop Inherit Build Deploy Operate Security Activities and Considerations - Peer Review - Static Code Analysis - Unit Tests for Security
  • 43. - The Threat Modeling Book by Adam Shostack - OWASP App Threat Modeling Cheat Sheet - Evil User Stories (link) - OWASP Application Security Verification Standard - Mozilla Rapid Risk Assessment (link) Develop Inherit Build Deploy Operate Threat Modeling and Security Stories
  • 44. - Pre-commit Hooks for Security - Coding Standards (Security and otherwise) Develop Inherit Build Deploy Operate Development Standards - Peer Review - Single Mainline Branch - Linting and Code Hygiene
  • 45. - git-secrets Prevents you from committing passwords and other sensitive information to a git repository. From awslabs. (link) - git-hound Hound is a Git plugin that helps prevent sensitive data from being committed into a repository by sniffing potential commits against PCRE regular expressions. (link) Develop Inherit Build Deploy Operate Code Standards and Team Tooling - gometalinter or whatever your language of choice (this is a golang example, you will need one for your language) - gofmt formats the code automatically and makes everything look the same, easier for everyone to grok (again, this is specific to lang)
  • 46. Develop Inherit Build Deploy Operate Code Standards and Team Tooling is run on developer laptops and systems, but verified by CI system.
  • 47. - Not unfamiliar territory for security! - Static Application Security Testing (SAST) - IDE Plugin if Possible Develop Inherit Build Deploy Operate Static Code Analysis! - Open Source: Brakeman (Ruby), FindSecurityBugs (Java), Phan (PHP), Go AST (golang) - Paid: Brakeman Pro, Veracode, Fortify, …
  • 48. Language / framework Scanning tool C/C++ Flawfinder Go Gosec Java find-sec-bugs Javascript ESLint .NET Security Code Scan Node.js NodeJsScan PHP • Phan • Phpcs-security-audit Python bandit Ruby / Ruby on Rails brakeman Scala find-sec-bugs Open Source SAST Options Compiled from: GitLab, SANS, OWASP
  • 49. So many hot takes! twitter.com/wickett/status/1030535526103900160
  • 50. - Unit Testing is the currency of Developers - JUnit, Rspec, Testing (golang), …. - Goal is to have security tests being written with other unit tests or whatever testing patterns you use: TDD, BDD, ATDD, … Develop Inherit Build Deploy Operate Unit Testing for Security
  • 51. Are the developers testing for security locally before it gets to CI system? Do we practice good hygiene and coding practices? Are we developing as a team in trunk with few branches? Develop Inherit Build Deploy Operate Questions to Ask
  • 52. This is an overlooked phase because it is the most invisible as software dependencies get bundled in and inherited in our own code and upstream. Develop Inherit Build Deploy Operate
  • 53. Develop Inherit Build Deploy Operate - This is your real LOC count! - The Software Delivery Supply Chain - Publish a Bill of Materials and trace back Security Considerations - This is not just application dependencies and libraries, but also OS-level (remember shellshock, heartbleed, ..)
  • 54. Develop Inherit Build Deploy Operate - bundler-audit - checks for vulnerable versions of gems in your ruby code (link) - OWSAP Dep Check - mostly Java - nsp - node security platform (link) - Paid options: Sonatype, BlackDuck, JFrog Language Tooling - Retire.js - known vuln JS libs (link)
  • 55. Develop Inherit Build Deploy Operate - Over 30% of containers in Docker Hub have high sev vulns (source) - Open Source: Docker Bench, Clair - Paid Options: aqua, twistlock Containers!
  • 56. Develop Inherit Build Deploy Operate What have I bundled into my app that is making vulnerable? Am I publishing a Bill of Materials with my application? Questions to Ask
  • 57. This phase is where the CI build system runs all the build steps and does acceptance testing. Previous testing and tooling gets verified here. Develop Inherit Build Deploy Operate
  • 58. Develop Inherit Build Deploy Operate - Outside-In Security Testing - Infra as Code (Testing) - Dynamic Application Security Testing (DAST) Security Considerations - Compliance on every build! - Cloud provider config as code - Using containers
  • 59. Develop Inherit Build Deploy Operate - These all require tuning and can be difficult to integrate into build pipelines. - Application Security scanners: Nikto, Arachni, ZAP, sqlmap, xsser, … Dynamic Application Security Scanners - Other - SSLyze, nmap, ssh_scan - See Kali Linux - Paid: Qualys, AppScan, BurpSuite, …
  • 60. The goal should be to come up with a set of automated tests that probe and check security configurations and runtime system behavior for security features that will execute every time the system is built and every time it is deployed.
  • 61. Framework with Security testing written in a natural language that developers, security and operations can understand. Gauntlt wraps security testing tools but does not install tools Gauntlt was built to be part of the CI/CD pipeline Open source, MIT License, gauntlt.org
  • 63. “We have saved millions of dollars using Gauntlt for the largest healthcare industry project.” - Aaron Rinehart, UnitedHealthCare
  • 65. Develop Inherit Build Deploy Operate - Test Kitchen - https://kitchen.ci/ - Serverspec - http://serverspec.org/ - Chef InSpec - Continuous Compliance Testing (https:// www.chef.io/inspec/) Infrastructure and Compliance - Cloud Provider is Infrastructure too - Version and test Cloud Config (e.g. CloudFormation for AWS)
  • 66. Develop Inherit Build Deploy Operate Am I testing for security low hanging fruit? Am I arming my pipeline with attack tools to exercise my application? Have I validated the previous two phases of testing in secure build environment? Questions to Ask
  • 67. The phase where software moves from our testing to where customers are able to operate it for the first time. Develop Inherit Build Deploy Operate
  • 68. Develop Inherit Build Deploy Operate - Watch out for Compliance - Secrets Management - Deploy Accountability - Authorization and Logging Security Considerations - Monitoring Deploys - Infra as Code (Execution) - Repeatable Execution
  • 71. Currently, at Signal Sciences we do about 15 deploys per day
  • 72. Roughly 10,000 deploys in the last 2.5 yrs
  • 73. CD is how little you can deploy at a time
  • 74. We optimized for cycle time—the time from code commit to production
  • 75. [Deploys] can be treated as standard or routine changes that have been pre-approved by management, and that don’t require a heavyweight change review meeting.
  • 76. Separation of Duties Considered Harmful
  • 79. Develop Inherit Build Deploy Operate - Paid Cloud Config security: Evident.io, ThreatStack, AlienVault - Cloud Provider: AWS CloudTrail, Inspector, GuardDuty Monitoring Cloud Config
  • 80. Develop Inherit Build Deploy Operate What secrets are needed to move my application from development into production? Am I testing for Compliance on each and every deploy? Is there a repeatable mechanism to push changes to production? Questions to Ask
  • 81. The runtime state of the application, where users interact with or consume the application. Our application in production. Develop Inherit Build Deploy Operate
  • 83. Develop Inherit Build Deploy Operate - Chaos Engineering and creating stability through instability - Circuit Break Pattern in use - Instrumentation and Visualization Security Considerations - Application security and service abuse and misuse - Bug Bounties - Red Teaming as a Service
  • 85. “every aspect of managing WAFs is an ongoing process. This is the antithesis of set it and forget it technology. That is the real point of this research. To maximize value from your WAF you need to go in with everyone’s eyes open to the effort required to get and keep the WAF running productively.” - WHITEPAPER FROM AN UNDISCLOSED WAF VENDOR
  • 86. Account takeover attempts Areas of the site under attack Most likely vectors of attack Business logic flows Abuse and Misuse signals Detect what matters
  • 88. Which is better application attack feedback?
  • 89. Develop Inherit Build Deploy Operate - Open Source: modSecurity + ELK To gain application insight monitoring. - Paid NGWAF / RASP Options: Signal Sciences, Contrast, Prevoty Runtime Defense Tooling - Pro-tip: Avoid adding appsec defense at the CDN
  • 90. Red Team Mondays at Intuit Shannon Lietz
  • 91. Develop Inherit Build Deploy Operate - Roll your own! - Paid Options: HackerOne, BugCrowd, Synack Bug Bounties
  • 92. Develop Inherit Build Deploy Operate - Log All The Things - ELK Stack for Open Source - Paid Options: Splunk, SumoLogic Logging Security Telemetry
  • 94. Develop Inherit Build Deploy Operate Do you know if you are under attack at this current moment? Do you know what the attackers are going after? Can I turn on and off services independently if being attacked? Are we doing Chaos experiments? Questions to Ask
  • 96. The New Ways Empathy and Enablement Be Fast and Non-Blocking Don’t slow delivery Join with continuous testing efforts Security testing automated in every phase Penetration Testing alongside the Pipeline Security provides value through making security normal
  • 97. Apply What You Have Learned Today Next week you should: Identify the who/where/what of your CI/CD Pipeline In the first three months following this presentation you should: Create a plan around the five phases and security tooling and practices Implement 1-2 tools in the pipeline Within six months you should: Have security in all five phases of the pipeline Answer the maturity questions for each phase
  • 98. Want the slides and referenced links? james@signalsciences.com