Download as PDF, PPTX
![Dev[Sec]Ops for Developers
How To Start
Patricia Aas
NDC Security 2019
T
S
@pati_gallardo](https://image.slidesharecdn.com/devsecopsfordevelopershowtostart-190129191538/85/DevSecOps-for-Developers-How-To-Start-3-320.jpg)
![Kharnagy [CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0)], from Wikimedia Commons](https://image.slidesharecdn.com/devsecopsfordevelopershowtostart-190129191538/85/DevSecOps-for-Developers-How-To-Start-8-320.jpg)
![12
“In medical school, you are taught that if, metaphorically, there is the
sound of hoofbeats pounding towards you then it’s sensible to assume
they come from horses not zebras [...]
With House it’s the opposite. We are looking for zebras.”
‘Dr Lisa Sanders’ in ‘House M.D.’
@pati_gallardo
@pati_gallardo](https://image.slidesharecdn.com/devsecopsfordevelopershowtostart-190129191538/85/DevSecOps-for-Developers-How-To-Start-12-320.jpg)
![@pati_gallardo
Dev[Sec]Ops](https://image.slidesharecdn.com/devsecopsfordevelopershowtostart-190129191538/85/DevSecOps-for-Developers-How-To-Start-21-320.jpg)
![6
Dev[Sec]Ops
Hacks
@pati_gallardo 25
@pati_gallardo](https://image.slidesharecdn.com/devsecopsfordevelopershowtostart-190129191538/85/DevSecOps-for-Developers-How-To-Start-25-320.jpg)
![Kharnagy [CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0)], from Wikimedia Commons](https://image.slidesharecdn.com/devsecopsfordevelopershowtostart-190129191538/85/DevSecOps-for-Developers-How-To-Start-45-320.jpg)
![@pati_gallardo
Dev[Sec]Ops](https://image.slidesharecdn.com/devsecopsfordevelopershowtostart-190129191538/85/DevSecOps-for-Developers-How-To-Start-48-320.jpg)
Uploaded byPatricia Aas
DevSecOps for Developers: How To Start
The document outlines the importance and implementation of DevSecOps in software development, emphasizing that integrating security enhances both delivery performance and security quality. It discusses the Cynefin framework for classifying problems and proposes various DevSecOps strategies such as trunk-based development and leveraging existing crisis processes. Additionally, it highlights the necessity of automating processes and involving developers to enhance security measures effectively.
More Related Content
![[CONFidence 2016] Glenn ten Cate - OWASP-SKF Making the web secure by design,...](https://cdn.slidesharecdn.com/ss_thumbnails/glentencate-owasp-skfmakingthewebsecurebydesignbecomeempoweredbetheneo-160603100034-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to DevSecOps for Developers: How To Start
DevSecOps for Developers: How To Start
- 1.
- 2.
- 3. Dev[Sec]Ops for Developers HowTo Start Patricia Aas NDC Security 2019 T S @pati_gallardo
- 4. Patricia Aas - Consultant T S C++Programmer, Application Security Currently : T S Previously : Vivaldi, Cisco Systems, Knowit, Opera Software Master in Computer Science - main language Java Pronouns: she/her
- 5.
- 6. 6 “Our research showsthat building security into software development not only improves delivery performance but also improves security quality. Organizations with high delivery performance spend significantly less time remediating security issues.” Accelerate, Forsgren PhD, Humble and Kim @pati_gallardo @pati_gallardo
- 7.
- 8. Kharnagy [CC BY-SA4.0 (https://creativecommons.org/licenses/by-sa/4.0)], from Wikimedia Commons
- 9.
- 10. Dev Sec Ops Whatabout this one?
- 11.
- 12. 12 “In medical school,you are taught that if, metaphorically, there is the sound of hoofbeats pounding towards you then it’s sensible to assume they come from horses not zebras [...] With House it’s the opposite. We are looking for zebras.” ‘Dr Lisa Sanders’ in ‘House M.D.’ @pati_gallardo @pati_gallardo
- 13. We tend toclassify problems based on the problems we are used to. This stops us from understanding folks that deal with different classes of problems. @pati_gallardo 13 @pati_gallardo
- 14. 14 Cynefin Framework by DaveSnowden @pati_gallardo @pati_gallardo
- 15.
- 16. Complex Complicated ObviousChaotic Discover Engineer StabilizeAutomate Fixing things Cynefin Framework by Dave Snowden Crisis Emergent Novel Best Good
- 17. Cynefin Framework by Dave Snowden DevOps Complex Complicated ObviousChaotic Probe Prototyping Analyze Development Auto Deploy CreativitySkill Automation Not critical Critical Incident Response
- 18. Complex Complicated ObviousChaotic Act Put outfires Probe Analyze Auto Investigate Remediate Change Incident in Prod Cynefin Framework by Dave Snowden
- 19. Complex Complicated ObviousChaotic Cynefin Framework by Dave Snowden Security Act Fuzzing ProbeAnalyze Auto Debugging Exploit dev Metasploit
- 20. Complex Complicated ObviousChaotic Probe Making theRight System Analyze Making the System Right A/B Testing TDD Chaos Monkey Static Analysis Testing Cynefin Framework by Dave Snowden
- 21.
- 22. Coding Building Testing Manual Security Gate Keeping Monitoring 22 SimplifiedPre-DevOps Deployment Workflow @pati_gallardo @pati_gallardo But you have to get out of the Critical Path?
- 23. Coding IDE Plugins Static Analysis BuildingTesting Scanning Monitoring 23 Alerts Dashboards Dynamic Analysis Dependency Checks Warnings Commit hooks Simulations Fuzzing
- 24. 24 - We haveno “Security Team” 1 security person per 10 ops people per 100 developers* *Accelerate, Forsgren PhD, Humble and Kim @pati_gallardo
- 25.
- 26. 26 1. Live Offthe Land @pati_gallardo @pati_gallardo
- 27. Use their issuetracker Use their slack Use their monitoring Use their dashboards Integrate into their tools @pati_gallardo 27 @pati_gallardo
- 28. 28 2. Have DevsBuild It @pati_gallardo @pati_gallardo
- 29. Use the devsto build integrations Find ways to justify it Make sure it has dual purpose @pati_gallardo 29 @pati_gallardo
- 30.
- 31. Trunk-based development Small commits Addsecurity to peer-review Add threat modeling to peer-review Feature toggles Use feature toggles for A/B testing @pati_gallardo 31 @pati_gallardo
- 32. 32 4. Use ExistingCrisis Process for Incident Response @pati_gallardo @pati_gallardo
- 33.
- 34.
- 35. gitlab.com - “rm -rf” -Sysadmin maintenance - Cascading errors as backups fail - All logged publicly in real time Accident or Breach Does it matter? 35 @pati_gallardo
- 36. 36 External Vulnerability ReportFlow @pati_gallardo @pati_gallardo Bug Report Vulnerability Report Social Media QA Security Marketing Triage No bug Bug Vulnerability
- 37.
- 38. Security Improvements to ExistingCrisis Process ● Separate priority in bug-tracker ● Separate channel in Slack ● Explicit side-duty in every team: Security Engineer ● Simple procedure based on information sharing and empowering ● Have a procedure on how people will get paid in off-hours @pati_gallardo 38 @pati_gallardo
- 39. 39 5. Automate asMuch as Possible @pati_gallardo @pati_gallardo
- 40. Add IDE plugins Adddependency scanner in CI/CD Add scanners in CI/CD Dynamic scan in a non-blocking pipeline All results in dev visualization @pati_gallardo 40 @pati_gallardo
- 41. 41 6. Infrastructure asCode @pati_gallardo @pati_gallardo
- 42. Configuration Management Auditable Know whatyou’re running Enable safe rollback @pati_gallardo 42 @pati_gallardo
- 43. 1. Live Offthe Land 2. Have Devs Build It 3. Trunk-based Development 4. Use Existing Crisis Process 5. Automate as Much as Possible 6. Infrastructure as Code @pati_gallardo 43 @pati_gallardo
- 44. Complex Complicated ObviousChaotic Discover Engineer StabilizeAutomate Fixing things Cynefin Framework by Dave Snowden Crisis Security Development Operations
- 45. Kharnagy [CC BY-SA4.0 (https://creativecommons.org/licenses/by-sa/4.0)], from Wikimedia Commons
- 46.
- 47. Dev Sec Ops Whatabout this one?
- 48.
- 49. 49 Shifting Security Left? WhatDoes That Even Mean? @pati_gallardo @pati_gallardo
- 50.
- 51.
- 52. 52 Hacking the existing toolsand processes @pati_gallardo @pati_gallardo
- 53. 53 @pati_gallardo Teach everyone whatto look for Use their Tooling and their Dashboards Fast, stable, automated tests in the Critical Path Use the existing Crisis Process for Incidents Have slower tests off the Critical Path I , L , S
- 54. Complex Complicated ObviousChaotic Act Put outfires Probe Analyze Auto Investigate Remediate Change Incident in Prod Cynefin Framework by Dave Snowden
- 55. We tend toclassify problems based on the problems we are used to. This stops us from understanding folks that deal with different classes of problems. @pati_gallardo 55 @pati_gallardo
- 56. 56 Some people arealways looking for Zebras @pati_gallardo @pati_gallardo
- 57.
- 58. T S P f . PatriciaAas, T S @pati_gallardo