Download as PDF, PPTX
![Dev[Sec]Ops for Developers
How To Start
European Testing Conference 2020
Patricia Aas
Turtle
Sec
@pati_gallardo](https://image.slidesharecdn.com/devsecopsfordevelopershowtostartetc2020-200207090834/85/DevSecOps-for-Developers-How-To-Start-ETC-2020-3-320.jpg)
![@pati_gallardo
“In medical school, you are taught that if, metaphorically, there is the
sound of hoofbeats pounding towards you then it’s sensible to assume
they come from horses not zebras [...]
With House it’s the opposite. We are looking for zebras.”
‘Dr Lisa Sanders’ in ‘House M.D.’
@pati_gallardo 16](https://image.slidesharecdn.com/devsecopsfordevelopershowtostartetc2020-200207090834/85/DevSecOps-for-Developers-How-To-Start-ETC-2020-16-320.jpg)
![@pati_gallardo
Dev[Sec]Ops
@pati_gallardo 25](https://image.slidesharecdn.com/devsecopsfordevelopershowtostartetc2020-200207090834/85/DevSecOps-for-Developers-How-To-Start-ETC-2020-25-320.jpg)
![1. Live Off the Land
2. Have Devs Build It
3. Trunk-based Development
4. Use Existing Crisis Process
5. Automate as Much as Possible
6. Infrastructure as Code
6 Dev[Sec]Ops Hacks
@pati_gallardo 35](https://image.slidesharecdn.com/devsecopsfordevelopershowtostartetc2020-200207090834/85/DevSecOps-for-Developers-How-To-Start-ETC-2020-35-320.jpg)
![1. Live Off the Land
2. Have Devs Build It
3. Trunk-based Development
4. Use Existing Crisis Process
5. Automate as Much as Possible
6. Infrastructure as Code
6 Dev[Sec]Ops Hacks
@pati_gallardo 39](https://image.slidesharecdn.com/devsecopsfordevelopershowtostartetc2020-200207090834/85/DevSecOps-for-Developers-How-To-Start-ETC-2020-39-320.jpg)
![1. Live Off the Land
2. Have Devs Build It
3. Trunk-based Development
4. Use Existing Crisis Process
5. Automate as Much as Possible
6. Infrastructure as Code
6 Dev[Sec]Ops Hacks
@pati_gallardo 43](https://image.slidesharecdn.com/devsecopsfordevelopershowtostartetc2020-200207090834/85/DevSecOps-for-Developers-How-To-Start-ETC-2020-43-320.jpg)
![1. Live Off the Land
2. Have Devs Build It
3. Trunk-based Development
4. Use Existing Crisis Process
5. Automate as Much as Possible
6. Infrastructure as Code
6 Dev[Sec]Ops Hacks
@pati_gallardo 47](https://image.slidesharecdn.com/devsecopsfordevelopershowtostartetc2020-200207090834/85/DevSecOps-for-Developers-How-To-Start-ETC-2020-47-320.jpg)
![1. Live Off the Land
2. Have Devs Build It
3. Trunk-based Development
4. Use Existing Crisis Process
5. Automate as Much as Possible
6. Infrastructure as Code
6 Dev[Sec]Ops Hacks
@pati_gallardo 55](https://image.slidesharecdn.com/devsecopsfordevelopershowtostartetc2020-200207090834/85/DevSecOps-for-Developers-How-To-Start-ETC-2020-55-320.jpg)
![1. Live Off the Land
2. Have Devs Build It
3. Trunk-based Development
4. Use Existing Crisis Process
5. Automate as Much as Possible
6. Infrastructure as Code
6 Dev[Sec]Ops Hacks
@pati_gallardo 60](https://image.slidesharecdn.com/devsecopsfordevelopershowtostartetc2020-200207090834/85/DevSecOps-for-Developers-How-To-Start-ETC-2020-60-320.jpg)
![1. Live Off the Land
2. Have Devs Build It
3. Trunk-based Development
4. Use Existing Crisis Process
5. Automate as Much as Possible
6. Infrastructure as Code
6 Dev[Sec]Ops Hacks
@pati_gallardo 64](https://image.slidesharecdn.com/devsecopsfordevelopershowtostartetc2020-200207090834/85/DevSecOps-for-Developers-How-To-Start-ETC-2020-64-320.jpg)
Uploaded byPatricia Aas
DevSecOps for Developers, How To Start (ETC 2020)
The document outlines a presentation by Patricia Aas on integrating security into software development through DevSecOps, emphasizing a collaborative approach between developers and security practices. It discusses vulnerabilities, incident response, and the importance of automated tooling and processes, including the Cynefin framework for navigating complex problems. Aas offers strategies for organizations to enhance security quality while maintaining delivery performance, suggesting that security and software quality are interconnected.
More Related Content
Similar to DevSecOps for Developers, How To Start (ETC 2020)
![20260201 [FOSDEM] gomodjail - library sandboxing for Go modules.pdf](https://cdn.slidesharecdn.com/ss_thumbnails/20260201fosdemgomodjail-librarysandboxingforgomodules-260201225659-76609ec4-thumbnail.jpg?width=640&height=640&fit=bounds)
DevSecOps for Developers, How To Start (ETC 2020)
- 1.
- 2.
- 3. Dev[Sec]Ops for Developers HowTo Start European Testing Conference 2020 Patricia Aas Turtle Sec @pati_gallardo
- 4. Patricia Aas - Consultant Turtle Sec C++Programmer, Application Security Currently : TurtleSec Previously : Vivaldi, Cisco Systems, Knowit, Opera Software Master in Computer Science Pronouns: she/her @pati_gallardo
- 5.
- 6. @pati_gallardo Accelerate, Nicole ForsgrenPhD, Humble and Kim: “Our research shows that building security into software development not only improves delivery performance but also improves security quality. Organizations with high delivery performance spend significantly less time remediating security issues.” @pati_gallardo 6
- 7. @pati_gallardo “improves security quality” Securityis a Quality Metric @pati_gallardo 7
- 8.
- 9. @pati_gallardo Bug Vulnerability Exploit If a bugcan be exploited... ...then it is a vulnerability @pati_gallardo 9What is a Vulnerability?
- 10. @pati_gallardo Exploit Write Read Execute Information Leaks IntelligenceGathering Remote Code Execution Privilege Escalation Denial of Service Planting of Shellcode @pati_gallardo 10What does an Exploit do?
- 11. @pati_gallardo The Target TheExploit@halvarflake Weird State Weird State Exploitation: The Weird Machine Bug/ Vulnerability @sergeybratus @pati_gallardo 11
- 12. @pati_gallardo 12 There isan artificial line between security testing and other types of testing
- 13.
- 14.
- 15.
- 16. @pati_gallardo “In medical school,you are taught that if, metaphorically, there is the sound of hoofbeats pounding towards you then it’s sensible to assume they come from horses not zebras [...] With House it’s the opposite. We are looking for zebras.” ‘Dr Lisa Sanders’ in ‘House M.D.’ @pati_gallardo 16
- 17. We tend toclassify problems based on the problems we are used to. This stops us from understanding folks that deal with different classes of problems. @pati_gallardo 17
- 18. @pati_gallardo Cynefin Framework by DaveSnowden @pati_gallardo 18
- 19.
- 20. Complex Complicated ObviousChaotic Discover Engineer StabilizeAutomate Fixing things Cynefin Framework by Dave Snowden Crisis Emergent Novel Best Good 20
- 21. Cynefin Framework by Dave Snowden DevOps Complex Complicated ObviousChaotic Probe Prototyping Analyze Development Auto Deploy CreativitySkill Automation Not critical Critical Incident Response 21
- 22. Complex Complicated ObviousChaotic Act Put outfires Probe Analyze Auto Investigate Remediate Change Incident in Prod Cynefin Framework by Dave Snowden 22
- 23. Complex Complicated ObviousChaotic Cynefin Framework by Dave Snowden Security Act Fuzzing ProbeAnalyze Auto Debugging Exploit dev Metasploit 23
- 24. Complex Complicated ObviousChaotic Probe Making theRight System Analyze Making the System Right A/B Testing TDD Chaos Monkey Static Analysis Testing Cynefin Framework by Dave Snowden 24
- 25.
- 26. @pati_gallardo Coding Building Testing Manual Security Gate Keeping Monitoring SimplifiedPre-DevOps Deployment Workflow @pati_gallardo But you have to get out of the Critical Path? 26
- 27. @pati_gallardo - We haveno “Security Team” 1 security person per 10 ops people per 100 developers* *Accelerate, Forsgren PhD, Humble and Kim Manual security review does not scale @pati_gallardo 27
- 28. @pati_gallardo Coding IDE Plugins Static Analysis BuildingTesting Scanning Monitoring Alerts Dashboards Dynamic Analysis Dependency Checks Warnings Commit hooks Simulations Fuzzing @pati_gallardo 28
- 29.
- 30. @pati_gallardo 30 Company Killer Whatare you really afraid of? What kind of event could put you out of business?
- 31. @pati_gallardo 31 Pre-mortem Your worstheadline is in the newspaper, how did this happen?
- 32. @pati_gallardo External Entity Data Store Trust Boundary Data Flow TrustBoundary Trust Boundary Data Store Process Backend Process External Entity Browser/App Data Flow Data Flow Diagram Data Flow 32
- 33.
- 34.
- 35. 1. Live Offthe Land 2. Have Devs Build It 3. Trunk-based Development 4. Use Existing Crisis Process 5. Automate as Much as Possible 6. Infrastructure as Code 6 Dev[Sec]Ops Hacks @pati_gallardo 35
- 36.
- 37.
- 38. Use your issuetracker Use your chat Use your monitoring Use your dashboards Integrate into your tools Live Off the Land @pati_gallardo Bootstrapping Tooling 38
- 39. 1. Live Offthe Land 2. Have Devs Build It 3. Trunk-based Development 4. Use Existing Crisis Process 5. Automate as Much as Possible 6. Infrastructure as Code 6 Dev[Sec]Ops Hacks @pati_gallardo 39
- 40.
- 41.
- 42. Use the devsto build integrations Find ways to justify it Dual purpose: Stability and Security Have Devs Build It @pati_gallardo Bootstrapping Manpower 42
- 43. 1. Live Offthe Land 2. Have Devs Build It 3. Trunk-based Development 4. Use Existing Crisis Process 5. Automate as Much as Possible 6. Infrastructure as Code 6 Dev[Sec]Ops Hacks @pati_gallardo 43
- 44.
- 45.
- 46. Trunk-based development Small commits Addsecurity to peer-review Add threat modeling to peer-review Feature toggles Use feature toggles for A/B testing Bootstrapping Security Reviews Trunk-based Development 46@pati_gallardo
- 47. 1. Live Offthe Land 2. Have Devs Build It 3. Trunk-based Development 4. Use Existing Crisis Process 5. Automate as Much as Possible 6. Infrastructure as Code 6 Dev[Sec]Ops Hacks @pati_gallardo 47
- 48.
- 49.
- 50.
- 51. External Vulnerability ReportFlow Bug Report Vulnerability Report Social Media QA Security Marketing Triage No bug Bug Vulnerability 51@pati_gallardo
- 52. Use Existing CrisisProcess for Incident Response 52@pati_gallardo
- 53.
- 54. Separate priority inbug-tracker Separate channel in Slack Security Engineer side-duty Simple procedure How will people get paid in off-hours? Bootstrapping Incident Response Security Improvements to Existing Crisis Process 54@pati_gallardo
- 55. 1. Live Offthe Land 2. Have Devs Build It 3. Trunk-based Development 4. Use Existing Crisis Process 5. Automate as Much as Possible 6. Infrastructure as Code 6 Dev[Sec]Ops Hacks @pati_gallardo 55
- 56.
- 57.
- 58. Add IDE plugins Adddependency scanner in CI/CD Add scanners in CI/CD Dynamic scan in a non-blocking pipeline All results in dev visualization Automate as Much as Possible Bootstrapping Automation 58@pati_gallardo
- 59. Coding IDE Plugins Static Analysis BuildingTesting Scanning Monitoring Alerts Dashboards Dynamic Analysis Dependency Checks Warnings Commit hooks Simulations Fuzzing 59@pati_gallardo
- 60. 1. Live Offthe Land 2. Have Devs Build It 3. Trunk-based Development 4. Use Existing Crisis Process 5. Automate as Much as Possible 6. Infrastructure as Code 6 Dev[Sec]Ops Hacks @pati_gallardo 60
- 61.
- 62.
- 63. Fully Automated Pipeline ConfigurationManagement Know what you’re running Auditable Bootstrapping Auditability Infrastructure as Code 63@pati_gallardo
- 64. 1. Live Offthe Land 2. Have Devs Build It 3. Trunk-based Development 4. Use Existing Crisis Process 5. Automate as Much as Possible 6. Infrastructure as Code 6 Dev[Sec]Ops Hacks @pati_gallardo 64
- 65.
- 66. @pati_gallardo Teach everyone whatto look for Use their Tooling and their Dashboards Fast, stable, automated tests in the Critical Path Use the existing Crisis Process for Incidents Have slower tests off the Critical Path Incremental, Layered, Security 66
- 67.
- 68. Complex Complicated ObviousChaotic Act Put outfires Probe Analyze Auto Investigate Remediate Change Incident in Prod Cynefin Framework by Dave Snowden 68
- 69. 1. Preparation6. LessonsLearned 5. Recovery 4. Eradication 2. Identification 3. Containment Phases of Incident Response¹ ¹Incident Handler’s Handbook, SANS Institute https://www.sans.org/reading-room/whitepapers/incident/incident-handlers-handbook-33901 @pati_gallardo 69
- 70. 70 Practice “We don't riseto the level of our expectations, we fall to the level of our training.” Greek lyrical poet, Archilochus Accident or Breach? Does it matter? @pati_gallardo
- 71.
- 72. Turtle Sec Questions? Photos from pixabay.com PatriciaAas, TurtleSec @pati_gallardo