This document discusses DevSecOps at Cimpress, an online printing company. It outlines some of the challenges of their worldwide and decentralized operations with varying technology stacks. Their approach involves threat modeling to identify threats, assets, and controls. They create security assertions based on the threat model and assure test case coverage. The focus is on integrating security into development in a way that is not burdensome to developers. The expected deliverables include automated unit test coverage and tool scans to address the threat model.

1. DevSecOps at Cimpress
Ian Amit
Chief Security Officer

2. Cimpress Security
Engineering Operations
Program
Management

3. Challenges
• Worldwide operations
• Decentralized (14 business units, and counting ;-) )
• Varying technology stacks (from latest and greatest, to factory IT/OT
running legacy software)
• Rapid deployment cycles
• Major cloudification (AWS, Azure and GCP)

4. Our approach - the road to DevSecOps
Threat Modeling
Threats
Assets
Prioritization/
Execution
Controls
Assertions
Response
Tests

5. Threat Modeling
• STRIDE? DREAD?
• MITRE ATT&CK Framework [1]
• CAPEC [2]
https://attack.mitre.org/wiki/Main_Page
https://capec.mitre.org/
What are you
protecting?
What’s the value
of it?
Who/what are you
protecting it from?
Threats
Assets
Controls
Assertions
Tests

6. DevSecOps
Controls
Assertions
Tests
• Create assertions based on threat model
• What is supposed to happen? What’s not supposed to happen?…
• Assure test case coverage in dev.
• Add external validation through scanners. SAST/DAST.
• Integrate controls over assertions/tests.

7. But forget all of that

8. Think about the developer first

9. This is how developers
want/need to see us security people
Minus the suit of course.
Everyone knows we wear hoodies ;-)

10. The Sec in DevSecOps
• Every additional interaction needed from dev is a speed bump
• Every additional interface is a traffic light
• Every new language/term is a “calculating new route”…

11. Expected Deliverables
Unit Test Coverage Automated tool scans
Implies existence of unit testing that
address the threat model scenarios
Implies fixes to the code where applicable
and coverage for the “hygiene” elements
of the threat model

12. Rinse, Repeat…
Threat Modeling
Prioritization/
Execution
Response