Meetup - DevSecOps: Colocando segurança na esteira Material apresentado no 12º Meetup do Scrum-Aplicado - 18/09/2019 às 19hrs. O futuro das empresas passa pelas constantes transformações digitais e, para isso, é fundamental manter aplicações que atendam às exigências dos clientes e, sobretudo, seguras. Nesse cenário, nasceu o conceito de DevSecOps, descrevendo um conjunto de práticas para integração entre as equipes de desenvolvimento de software. Nesta palestra, entenderemos mais sobre conceitos e como aplicar DevSecOps na prática. Provocaremos discussões “saudáveis” sobre o modelo tradicional de desenvolvimento e este modelo ágil que está trazendo uma grande mudança de paradigma na construção de aplicações.

1. 120/09/19
Setembro - 2019
DevSecOps
Colocando segurança na esteira
___________________________________________
Diego Cardoso – Head of DevSecOps Practices Brazil
diego.cardoso@gft.com
#TeamGFT #ScrumAplicado

2. • Orgulhoso Filho, Marido e Pai
• Graduado em Sistemas da Informação na FSA
• Pós-Graduado em Arquitetura de Software na FIAP
• Certificado Microsoft: MCTS
• Trabalho na GFT (Sorocaba)
• +15 anos Analisando, Codificando e Migrando
• Entusiasta com foco em Arquitetura e Metodologias Ágeis
• Guitarrista enferrujado e gamer nas horas vagas

3. 3
Agenda 1. Software Development
2. DevOps
3. CyberSecurity
4. DevSecOps
5. OWASP
6. LGPD
7. Trends for 2019 / 2020

4. 4
Waterfall
• Over Planning
• Risk Mitigation
• High Costs
• Delivery everything in the end
Agile :
• Experiments and Prototype
• Fail Fast and Low Costs
• Continuous and Evolutive Delivery
Software Development – Methodologies

5. 5
• API
Manag
ement
Aspect
s
Software Development – Before DevOps

6. 6
Software Development – DevOps Enablement
• Squads: Dev + Ops + QA
• Engineering (automating) Agile process
• Quick time to market (ROI)

7. 7
20/09/2019
DevOps – Landscape 2019

8. 8
Software Development - But where is security team ?

9. 9
Software Development - But where is security team ?

10. 10
CyberSecurity – Landscape 2019

11. 11
CyberSecurity – Let’s check the News

12. 12
CyberSecurity – Statistics you should know for 2019

13. 13
CyberSecurity – Statistics you should know for 2019

14. 14
20.09.2019
Type here if add info
needed for every
slide
Source: Gartner 2018
Source: RightScale 2018

15. 15
20.09.2019
Type here if add info
needed for every
slide
Source: Gartner

16. 16
Understanding Concepts
#DevSecOps #SRE #BeTransformationAgent

17. 17
Mindset: everyone is responsible for security
Goal: privacy and secure by design
Mission: delivery at speed and scale
without sacrificing the safety required by the context.
DEVELOPERS : OPERATIONS : SECURITY
100 : 10 : 1
DevSecOps = DevOps + Security

18. 18
DevSecOps – The Evolution of Security Teams

19. 19
• API
Manag
ement
Aspect
s
DevSecOps – Enabling evolutive security

20. 20
DevSecOps – Security shifting to the left
Requirements
Design/ Architecture
Testing
15X
Coding
7X
Deployments/
Maintenance
30X
CosttoRemediate
We convince & pay the developer
to fix it thereby delaying the
release
QA finds
vulnerabilities
in software
Somebody builds
insecure software
We convince
and pay the
developer to
fix it
We are breached or
pay to have someone
tell us our code is bad
IT deploys
the insecure
software
Somebody
builds
insecure
software
Application scan:
SAST
DAST
Create Evil Stories
High Level of Test
Coverage

21. 21
Creating the Mindset :
• Security Awareness and training
• Evil Stories ( ethical hacking)
• Shared knowledge base
• Focused Hackathons
Questions you should be able to answer:
• Top risks/vulnerabilities (OWASP)
• Code repository contains hard-coded secrets
• 3rd party libraries have known security issues
Test
• SAST + DAST + IAST
• Sensitive info scan (SIS)
• Composition Analysis (SCA)
• Fuzzing (random inputs)
• Pen-Test
DevSecOps – Leading the transformation

22. 22
SAST
DevSecOps – TOOLS (part I)
DAST

23. 23
IAST
DevSecOps – TOOLS (part. II)
OSS

24. 24
OWASP – Open Web Application Security Project
Top 5 Vulnerabilities

25. 25
Trends for 2019 / 2020
#DevSecOps #SRE #BeTransformationAgent

26. 26
• API
Manag
ement
Aspect
s
LGPD – Lei Geral de Proteção de Dados (GDPR)

27. 2720/09/2019

28. 28
Conclusion – State of DevSecOps 2019

29. 29
Setembro - 2019
DevSecOps
Colocando segurança na esteira
___________________________________________
Diego Cardoso – Head of DevSecOps Brazil
diego.cardoso@gft.com
#TeamGFT #MeetupScrumAplicado
Muito Obrigado! Perguntas?