Download as PDF, PPTX
![87/90
程式提交程式提交 ………… 授權分析授權分析 授權白名單授權白名單 授權黑名單授權黑名單 授權灰名單授權灰名單 程式通過程式通過
靜態分析靜態分析
動態分析動態分析
註解分析註解分析
相容分析相容分析
X
問題清單問題清單
MIT
Apache-2.0
BSD-2-Clause
BSD-3-Clause
……
AGPL-3.0
CPAL
OSL
SSPL
……
LGPL-2.1 / 動態連結 → OK
LGPL-2.1 / 靜態連結 → NO
LGPL-3.0 / 動態連結 → OK
LGPL-3.0 / 靜態連結 → NO
……
X Xhttps://github.com/fossology/fossology
https://github.com/google/licenseclassifier
https://github.com/github/licensed
https://github.com/dmgerman/ninka
https://github.com/jslicense/licensee.js [npm]
https://github.com/davglass/license-checker [npm]
https://github.com/pmezard/licenses [Go]
https://github.com/Comcast/php-legal-licenses [PHP]
https://github.com/composer/spdx-licenses [SPDX]](https://image.slidesharecdn.com/2019-07-11devsecops-architectureforsecurityandcompliance-190711165146/85/Dev-Sec-Ops-Architecture-for-Security-and-Compliance-87-320.jpg)
Uploaded byYi-Feng Tzeng
Dev(Sec)Ops - Architecture for Security and Compliance
The document discusses the integration of security within DevOps and Agile methodologies, emphasizing the need for a DevSecOps culture that embeds security throughout the software development lifecycle (SDLC). It outlines various practices such as secure coding, compliance with regulations like GDPR, and the importance of involving security stakeholders in the development process. The author highlights challenges in maintaining security during Agile practices and the necessity of automated security testing within continuous integration and delivery pipelines.
More Related Content
Similar to Dev(Sec)Ops - Architecture for Security and Compliance
![恰如其分的 MySQL 設計技巧 [Modern Web 2016]](https://cdn.slidesharecdn.com/ss_thumbnails/2016-08-24modernweb-mysql-161019062706-thumbnail.jpg?width=640&height=640&fit=bounds)
![5G Explained! A High Level Overview [Introduction]](https://cdn.slidesharecdn.com/ss_thumbnails/5gexplainedahighleveloverview-260119165306-cc137a3e-thumbnail.jpg?width=640&height=640&fit=bounds)
Dev(Sec)Ops - Architecture for Security and Compliance
- 1. Dev(Sec)Ops Architecture for Securityand Compliance 曾義峰 (Ant) yftzeng@gmail.com 2019-07-12
- 2. 2/90 Introduction & Researchinterest 13 年互聯網研發經驗， 4 年顧問資歷。 時而編程，時而沉浸於法律領域、倘洋於資訊安全世界中。 Web Security ( 網頁安全 ) Data(base) Security ( 資料安全 ) Agile Way ( 敏捷方法 ) Compliance ( 法遵 / 合規 )
- 3. 3/90 SDLC & Agile1 ProductOwner & Stakeholders2 DevOps & Security3 Agenda 引言 角色 安全 DevOps & Compliance4 法遵 CI/CD & Pipeline5 實踐
- 4. 4/90 SDLC & Agile1 ProductOwner & Stakeholders2 DevOps & Security3 DevOps & Compliance4 Agenda 引言 CI/CD & Pipeline5
- 5.
- 6. 6/90 Requirements Design Code Test Deploy Secure Software DevelopmentLife Cycle (SSDLC) Risk Assessment Design Review & Threat Modeling Static Analysis Code Review & Penetration Testing Secure Configuration & Security Assessment
- 7. 7/90 Requirements Design Code Test Deploy Secure Software DevelopmentLife Cycle (SSDLC) Risk Assessment Design Review & Threat Modeling Static Analysis Code Review & Penetration Testing Secure Configuration & Security Assessment Waterfall EVERYTHING WORK WELL
- 8.
- 9.
- 10.
- 11.
- 12. 12/90 Agile Prejudices 推動 Agile 後造成一團混亂(Chaos) 。 Agile 過於複雜。 Agile 只是把待辦清單 (Todo) 用便利貼或數位的方式貼在牆上。 Agile 會產出不安全的軟體。 Agile 太浪費時間，例如每日站立會議、回顧 (retrospective) 。
- 13. 13/90 Agile Prejudices 推動 Agile 後造成一團混亂(Chaos) 。 Agile 過於複雜。 Agile 只是把待辦清單 (Todo) 用便利貼或數位的方式貼在牆上。 Agile 會產出不安全的軟體。 Agile 太浪費時間，例如每日站立會議、回顧 (retrospective) 。
- 14.
- 15.
- 16.
- 17. 17/90 Agile 很多公司都有推動各種敏捷專案管理流程。 例如 Scrum 或Kanban 。 但其中有具備資安 (Security) 思維的只有一小部分。
- 18. 18/90 誰說 Agile Coach不需要懂資安 !? Agile Injection 頻繁安插的無理需求、急件
- 19. 19/90 誰說 Agile Coach不需要懂資安 !? Agile XSSInjection 頻繁安插的無理需求、急件 從其他團隊來的跨組扔包
- 20. 20/90 誰說 Agile Coach不需要懂資安 !? Agile XSS StackOverflow Injection 頻繁安插的無理需求、急件 從其他團隊來的跨組扔包 我是 Full-Stack Developer 指的是如果再給我一個工作 我的工作 (Stack) 就會溢出
- 21. 21/90 誰說 Agile Coach不需要懂資安 !? Agile God Injection XSS StackOverflow Injection 頻繁安插的無理需求、急件 從其他團隊來的跨組扔包 我是 Full-Stack Developer 指的是如果再給我一個工作 我的工作 (Stack) 就會溢出 老闆一聲令下 搖身變為隕石開發法
- 22.
- 23.
- 24.
- 25. 25/90 DevOps & Security3 DevOps& Compliance4 Agenda Product Owner & Stakeholders2 SDLC & Agile1 角色 CI/CD & Pipeline5
- 26. 26/90 Scrum & ProductOwner “The Product Owner is the sole person responsible for managing the Product Backlog.” (Scrum guide) “ 產品負責人是負責管理產品待辦清單的唯一人員。” “The PO role is responsible for working with the customers and stakeholders to understand their needs.” “ 產品負責人負責與客戶和利益相關者合作以了解他們的需求。” Credit: https://www.scrum.org/forum/scrum-forum/7820/product-owner-role-delegated-team
- 27. 27/90 Scrum & ProductOwner “The Product Owner is the sole person responsible for managing the Product Backlog.” (Scrum guide) “ 產品負責人是負責管理產品待辦清單的唯一人員。” “The PO role is responsible for working with the customers and stakeholders to understand their needs.” “ 產品負責人負責與客戶和利益相關者合作以了解他們的需求。” Credit: https://www.scrum.org/forum/scrum-forum/7820/product-owner-role-delegated-team Who are your stakeholders ？ 誰是你們的利益相關者
- 28. 28/90 Scrum & ProductOwner “The Product Owner is the sole person responsible for managing the Product Backlog.” (Scrum guide) “ 產品負責人是負責管理產品待辦清單的唯一人員。” “The PO role is responsible for working with the customers and stakeholders to understand their needs.” “ 產品負責人負責與客戶和利益相關者合作以了解他們的需求。” Credit: https://www.scrum.org/forum/scrum-forum/7820/product-owner-role-delegated-team Security officer should start taking up the role of security stakeholders 資安官應該開始擔任利益相關者的角色
- 29. 29/90 Product Backlog Product BacklogItem (PBI) ： ● Features ● Bugs ● Refactoring ● Spike ● … ● Security Features ● Security Stories ● Attacker Stories ● Ab-Use User Stories
- 30. 30/90 Product Backlog Scenario: Userare able to register Given the user is on “/users/register” When the user types the email “yftzeng@gmail.com” When the user types the password “xxx” When the user clicks the register button Then the response should contains “Password must be at least 8 characters long” ... BDD
- 31. 31/90 Product Backlog Scenario: Theapplication should not contain SQL injection vulnerabilities And the SQL-Injection policy is enabled And the attack strength is set to High And the alert threshold is set to Low When the scanner is run And the following false positives are removed | url | parameter | cweId | wascId | And the XML report is written to the file output/security/sql_injection.xml Then no Medium or Higher risk vulnerabilities should be present Credit: https://continuumsecurity.net/bdd-security/ BDD
- 32. 32/90 Product Backlog Scenario: Presentthe login form itself over an HTTPS connection Given a new browser instance And the client/browser is configured to use an intercepting proxy And the proxy logs are cleared And the login page is displayed And the HTTP request-response containing the login form Then the protocol should be HTTPS And ... Credit: https://continuumsecurity.net/bdd-security/ BDD
- 33. 33/90 Tools ● SpecFlow (.NET) ●Cucumber (Ruby) ● JBehave (Java) ● Behat (PHP) ● Jest (JavaScript) ● Godog (Go) ● … BDD
- 34. 34/90 DevOps & Compliance4 Agenda SDLC& Agile1 DevOps & Security3 Product Owner & Stakeholders2 安全 CI/CD & Pipeline5
- 35. 35/90 DevOps & Security 《Dev Ops⋅ 》 同 Agile / Lean ，具備自身核心，更快的執行速度和更快的學習速度。 這就是為什麼它經常被描述為一種文化。 從 DevOps 視角，探討 Security
- 36. 36/90 DevOps & Security 《Dev Ops⋅ 》 同 Agile / Lean ，具備自身核心，更快的執行速度和更快的學習速度。 這就是為什麼它經常被描述為一種文化。
- 37.
- 38. 38/90 DevOps & Security SecDevOps—sometimescalled “Rugged DevOps” or “security at speed”—as a set of best practices designed to help organizations implant secure coding deep in the heart of their DevOps development and deployment processes. The goal is to automate secure coding and security tests and fixes within the workflow, making secure software an inherent outcome of DevOps approaches. Credit: https://blog.newrelic.com/2015/08/27/secdevops-rugged-devops/
- 39. 39/90 DevOps & Security SecDevOps—sometimescalled “Rugged DevOps” or “security at speed”—as a set of best practices designed to help organizations implant secure coding deep in the heart of their DevOps development and deployment processes. The goal is to automate secure coding and security tests and fixes within the workflow, making secure software an inherent outcome of DevOps approaches. Credit: https://blog.newrelic.com/2015/08/27/secdevops-rugged-devops/ “SecDevOps seeks to embed security inside the development process as deeply as DevOps has done with operations” (SecDevOps 旨在將開發過程中的資訊安全深入到 DevOps 的操作中 )
- 40. 40/90 DevOps & Security Thehinge to success for DevOps security lies in changing the underlying DevOps culture to embrace security—with no exceptions. As with any other methodology, security must be built into DevOps. Credit: https://techbeacon.com/devsecops-foundations
- 41. 41/90 DevOps & Security Thehinge to success for DevOps security lies in changing the underlying DevOps culture to embrace security—with no exceptions. As with any other methodology, security must be built into DevOps. Credit: https://techbeacon.com/devsecops-foundations DevOps 資訊安全成功的關鍵仰賴改變潛在的 DevOps 文化以擁抱安全性 - 沒有例外 -
- 42.
- 43.
- 44.
- 45.
- 46.
- 47. 47/90 Agenda SDLC & Agile1 ProductOwner & Stakeholders2 DevOps & Compliance4 DevOps & Security3 法遵 CI/CD & Pipeline5
- 48.
- 49. 49/90 DevOps & Compliance 很多公司都有推動各種敏捷專案管理流程。 例如Scrum 或 Kanban 。 但其中有具備資安 (Security) 思維的只有一小部分。 更不用論更大範圍的法遵 / 合規 (Compliance) ，例如 GDPR 等。
- 50. 50/90 DevOps & Compliance 歐盟《通用資料保護規則》(General Data Protection Regulation, GDPR) 2018-05-25 正式生效 Credit: https://www.clearvertical.co.uk/is-your-website-gdpr-compliant/
- 51. 51/90 DevOps & Compliance 歐盟《通用資料保護規則》(General Data Protection Regulation, GDPR) 2018-05-25 正式生效 史上最嚴的個人資料保護法 Credit: https://www.clearvertical.co.uk/is-your-website-gdpr-compliant/
- 52. 52/90 DevOps & Compliance 美國加州通過最嚴格的資料隱私法 Credit:https://www.theverge.com/2018/6/28/17509720/california-consumer-privacy-act-legislation-law-vote
- 53. 53/90 DevOps & Compliance CLOUDAct (Clarifying Lawful Overseas Use of Data Act) 2018-03-24 正式生效 Credit: https://restoreprivacy.com/cloud-act/
- 54. 54/90 DevOps & Compliance Compliance Security License Standards Regulations LawPolicies Open source
- 55. 55/90 DevOps & Compliance 《法律訴訟》美國(1/2) 2002 MySQL vs. Progress Software 2002 MySQL vs. Progress Software 2006-03 Jacobson vs. Katzer 2006-03 Jacobson vs. Katzer 2007-10 BusyBox vs. Monsoon 2007-10 BusyBox vs. Monsoon 2007-11 BusyBox vs. Xterasys 2007-11 BusyBox vs. Xterasys 2007-11 BusyBox vs. High-Gain Antennas 2007-11 BusyBox vs. High-Gain Antennas 2007-12 BusyBox vs. Verizon 2007-12 BusyBox vs. Verizon 2008-01 Trend vs. Barracuda 2008-01 Trend vs. Barracuda 2008-06 BusyBox vs. Bell Microproduct 2008-06 BusyBox vs. Bell Microproduct
- 56. 56/90 DevOps & Compliance 《法律訴訟》美國(2/2) 2008-06 BusyBox vs. Super Micro Computer 2008-06 BusyBox vs. Super Micro Computer 2008-07 BusyBox vs. Extreme Networks 2008-07 BusyBox vs. Extreme Networks 2008-12 FSF vs. Cisco 2008-12 FSF vs. Cisco 2009-02 Microsoft vs. TomTom 2009-02 Microsoft vs. TomTom 2009-12 BusyBox vs. Best Buy 等 14 間 企業 2009-12 BusyBox vs. Best Buy 等 14 間 企業 2014-12 Ximpleware vs. Versata 2014-12 Ximpleware vs. Versata
- 57. 57/90 Agenda SDLC & Agile1 ProductOwner & Stakeholders2 DevOps & Security3 CI/CD & Pipeline5 DevOps & Compliance4 實踐
- 58. 58/90 CI/CD & Pipeline 《Dev Ops⋅ & CI ⋅ CD 》 DevOps 非商業口號，是以工具為中心的哲學，支持持續交付價值鏈。 持續交付採用自動部署流水線，以便可靠、快速地將軟體發佈的方法。 持續交付和 DevOps 擁有敏捷和精益的共同背景：小而快速的變化。 DevOps 關乎文化、開發和運營之間、明確的流程。關乎敏捷。 你可以在不實施持續交付的情況下接受並實踐 DevOps 理念。 從 CI/CD & Pipeline 視角，探討 Security
- 59. 59/90 CI/CD & Pipeline 《Dev Ops⋅ & CI ⋅ CD 》 DevOps 非商業口號，是以工具為中心的哲學，支持持續交付價值鏈。 持續交付採用自動部署流水線，以便可靠、快速地將軟體發佈的方法。 持續交付和 DevOps 擁有敏捷和精益的共同背景：小而快速的變化。 DevOps 關乎文化、開發和運營之間、明確的流程。關乎敏捷。 你可以在不實施持續交付的情況下接受並實踐 DevOps 理念。
- 60.
- 61.
- 62. 62/90 CI/CD & Pipeline 《Pen testing 》 滲透測試 (Penetration testing) 有時長達兩個月。 每一次的提交與改變，是否會影響之前滲透測試的結果？ 《 Compliance validation 》 如果發布需要通過外部審核機構 ( 法務 / 會計 / 稽核 ) ， 如何能實現快速循環實驗？
- 63.
- 64.
- 65. 65/90 CI/CD & Pipeline Credit:https://www.linkedin.com/pulse/transformation-pmo-jack-caine/ 以 SAFe 的 Continuous Delivery( 持續交付 ) 模型為例 The Scaled Agile Framework (abbreviated as SAFe)
- 66. 66/90 CI/CD & Pipeline Credit:https://www.scaledagileframework.com/release-on-demand/ Develop on Cadence. Release on Demand. - A SAFe mantra
- 67. 67/90 CI/CD & Pipeline Credit:https://www.scaledagileframework.com/release-on-demand/ Develop on Cadence. Release on Demand. - A SAFe mantra按節奏開發，按所需發布 -SAFe 的口號 -
- 68. 68/90 CI/CD & Pipeline Credit:https://twitter.com/deanleffingwell/status/612425925515317248
- 69. 69/90 CI/CD & Pipeline Credit:https://www.scaledagileframework.com/release-on-demand/ Develop on Cadence. Release on Demand. - A SAFe mantra Develop on Cadence ( 技術流程 ) Release on Demand ( 商業決策 )
- 70. 70/90 CI/CD & Pipeline Credit:https://www.scaledagileframework.com/release-on-demand/ Develop on Cadence. Release on Demand. - A SAFe mantra Develop on Cadence ( 技術流程 ) Release on Demand ( 商業決策 ) 解耦 (decoupling)
- 71. 71/90 CI/CD & Pipeline Credit:https://martinfowler.com/books/continuousDelivery.html Continuous delivery is about putting the release schedule in the hands of the business, not in the hands of IT.
- 72. 72/90 CI/CD & Pipeline Credit:https://martinfowler.com/books/continuousDelivery.html Continuous delivery is about putting the release schedule in the hands of the business, not in the hands of IT.持續交付是指將發布時程放在業務手中，而不是掌握在 IT 手中
- 73. 73/90 CI/CD & Pipeline Credit:https://martinfowler.com/bliki/ContinuousDelivery.html Continuous Delivery is sometimes confused with Continuous Deployment. Continuous Deployment means that every change goes through the pipeline and automatically gets put into production, resulting in many production deployments every day. Continuous Delivery just means that you are able to do frequent deployments but may choose not to do it, usually due to businesses preferring a slower rate of deployment. In order to do Continuous Deployment you must be doing Continuous Delivery. Martin Fowler
- 74. 74/90 CI/CD & Pipeline Credit:https://martinfowler.com/bliki/ContinuousDelivery.html Continuous Delivery is sometimes confused with Continuous Deployment. Continuous Deployment means that every change goes through the pipeline and automatically gets put into production, resulting in many production deployments every day. Continuous Delivery just means that you are able to do frequent deployments but may choose not to do it, usually due to businesses preferring a slower rate of deployment. In order to do Continuous Deployment you must be doing Continuous Delivery. Martin Fowler 持續交付只是意味著你可以進行頻繁部署 , 但可以選擇不這樣做， 通常是因為企業更喜歡較慢的部署速度
- 75. 75/90 CI/CD & Pipeline Credit:https://www.scaledagileframework.com/release-on-demand/ Develop on Cadence. Release on Demand. - A SAFe mantra Develop on Cadence ( 技術流程 ) Release on Demand ( 商業決策 ) 解耦 (decoupling)
- 76. 76/90 CI/CD & Pipeline Credit:https://www.linkedin.com/pulse/transformation-pmo-jack-caine/ 以 SAFe 的 Continuous Delivery( 持續交付 ) 模型為例 The Scaled Agile Framework (abbreviated as SAFe)
- 77. 77/90 CI/CD & Pipeline Credit:https://www.linkedin.com/pulse/transformation-pmo-jack-caine/ 以 SAFe 的 Continuous Delivery( 持續交付 ) 模型為例 The Scaled Agile Framework (abbreviated as SAFe) 解耦 (decoupling)
- 78. 78/90 CI/CD & Pipeline Credit:https://www.linkedin.com/pulse/transformation-pmo-jack-caine/ 以 SAFe 的 Continuous Delivery( 持續交付 ) 模型為例 The Scaled Agile Framework (abbreviated as SAFe) 商業決策 技術流程 商業決策
- 79. 79/90 CI/CD & Pipeline Credit:https://www.linkedin.com/pulse/transformation-pmo-jack-caine/ 商業決策 技術流程 商業決策 ComplianceSecurity 滲透測試 (Penetration testing) / 紅隊演練 (Red Team Assessment) 。 外部審核機構 ( 法務 / 會計 / 稽核 ) 。
- 80. 80/90 Security Marketing Compliance needs pen testing redteam regulations controlsstandards unit / integration / performance test unit / integration / performance test scheduling unit / integration / performance test scheduling schedule pipeline Develop
- 81. 81/90 Security Marketing Compliance Develop needs pen testing redteam regulations controlsstandards unit / integration / performance test unit / integration / performance test scheduling unit / integration / performance test scheduling schedule pipeline
- 82.
- 83.
- 84.
- 85.
- 86. 86/90 Security Marketing Compliance Develop needs pen testing redteam regulations controlsstandards unit / integration / performance test unit / integration / performance test scheduling unit / integration / performance test scheduling schedule pipeline
- 87. 87/90 程式提交程式提交 ………… 授權分析授權分析授權白名單授權白名單 授權黑名單授權黑名單 授權灰名單授權灰名單 程式通過程式通過 靜態分析靜態分析 動態分析動態分析 註解分析註解分析 相容分析相容分析 X 問題清單問題清單 MIT Apache-2.0 BSD-2-Clause BSD-3-Clause …… AGPL-3.0 CPAL OSL SSPL …… LGPL-2.1 / 動態連結 → OK LGPL-2.1 / 靜態連結 → NO LGPL-3.0 / 動態連結 → OK LGPL-3.0 / 靜態連結 → NO …… X Xhttps://github.com/fossology/fossology https://github.com/google/licenseclassifier https://github.com/github/licensed https://github.com/dmgerman/ninka https://github.com/jslicense/licensee.js [npm] https://github.com/davglass/license-checker [npm] https://github.com/pmezard/licenses [Go] https://github.com/Comcast/php-legal-licenses [PHP] https://github.com/composer/spdx-licenses [SPDX]
- 88. 88/90 Password Policy XSS Insider Threat InformationDisclosure SQL Injection GDPR Policy
- 89. 89/90 Agile ≠ Fast 產品負責人必須將資安官納入主要利益相關人 借鏡DevOps/SAFe ，引入 DevSecOps 文化 利用軟體工程的手法 , 將複雜的流程解耦、分段 階段性實施 DevSecOps ( 小跑步法 ) 確認團隊所有成員認同資安對於客戶的價值 持續投入資安訓練及演練
- 90.