Download as PDF, PPTX
More Related Content
Similar to DevSecOps Fundamentals and the Scars to Prove it.
DevSecOps Fundamentals and the Scars to Prove it.
- 1. DevSecOps Fundamentals And Scarsto Prove It
- 2. I am MattTesauro I think Dev(App)SecOps needs to change and I’m going to tell you how I see it changing matt.tesauro@10Security.com / @matt_tesauro 2
- 3. Who is thisguy? ✖ Reformed programmer and AppSec Engineer ✖ 11+ years in the OWASP community ○ OWASP AppSec Pipeline ○ OWASP DefectDojo ○ OWASP WTE ✖ 20+ years using Floss and Linux ✖ Currently a Go language fanboy ✖ Ee Dan in Tang Soo Do Mi Guk Kwan (2nd degree black belt) 3
- 4.
- 5. Not everything about completing agoal is sunshine and roses... The Anti-money shot 5
- 6. Traditional AppSec Where allthis started not so long ago 6
- 7. Traditional AppSec Where allthis started not so long ago 7 Security
- 8. What Traditional Toolingfeels like: 8
- 9.
- 10. Let’s be honestfor a minute... 10
- 11.
- 12. 12 The purpose ofan AppSec program is to evaluate the security status of the suite of apps for a business Basically, to provide a map to guide business decisions.
- 13. Do you havea full view of your Application landscape? 13
- 14. There’s one morething DevSecOps should do... 14
- 15. 15 Provide a clearand direct path for teams to follow
- 16. DevSecOps Concepts What youshould have in mind going forward 16
- 17. 17 #1 Drive DownComplexity VS
- 18. 18 #2 Dependency Management Balancewhat you rely on vs what you interact with - things disappear...
- 19. 19 #3 Shared ClearUnderstanding How many assumptions are hiding in your whiteboards? whiteboard != design whiteboard != shared understanding
- 20. 20 #4 Default SecurityControls to On There’s a reason you have to turn OFF airbags Caddy server + Let’s Encrypt
- 21. 21 #5 Utilize FrameworksFully Do you really KNOW the framework you’re using and the security features it has?
- 22. 22 #6 Embrace 12Factor Apps Cloud-Native before Cloud-Native was cool
- 23. 23 #7 Codify &Checklist-ify your processes Makes work: ● Easy to repeat ● Consistent ● Future Automation Friendly FAF™
- 24. 24 #8 Servers likeCattle not Pets
- 25. 25 #8a Servers likeCattle not Pets Kleenex Handkerchiefs
- 26. 26 #9 Explode YourProcesses Break existing work into pieces ● Think EAR™ ○ Event ○ Action (function) ○ Result / Inform (chatops?) ● Pick a checklist item & automate (repeat until done) ● Pre-Compute Future Security Work
- 27. DevSecOps Automation What arethe key things to be aware of 27
- 28. W Edward DemIng Spendingtime optimizing anything other than the critical resource is an illusion 28
- 29. Your people arethe critical resource 29
- 30. There’s never enoughpeople or time... ✖ AppSec team size is small vs Dev team ✖ Automate all those things that don’t take a human brain ✖ DefectDojo (and the rest API) is the heart of your automation efforts - your single source of truth
- 31. OWASP DefectDojo An open-sourceapplication vulnerability correlation and security orchestration tool. The source of truth for a security program that manages to make vulnerability management work ✖ Consolidating and dedup’ing findings ○ 68+ different tools supported ✖ Maintain product and app info/metadata ✖ Push findingst to defect trackers ✖ Automation with a REST API 31
- 32. The “Three Waysof DevOps” 1. Workflow “Look at your purpose and those processes which aid it” 2. Improve Feedback “Open yourself to upstream & downstream info” 3. Continual Experimentation and Learning “Create a culture of innovation and experimentation” 32
- 33. AppSec Personnelle They arethe critical resource so optimize their work ✖ Automate the non-human brain things ✖ Drive up consistency ✖ Increase tracking of work status ✖ Increase flow through the system ✖ Increase visibility and metrics ✖ Reduce any friction with dev teams 33 Security
- 34. 34 Talk to yourconstituency in the language that THEY speak, not the one you speak.
- 35. As as exercisefor the student 35
- 36. AppSec Pipelines Why letdev teams own all the good ideas 36
- 38. What’s this AppSecpipeline all about? ✖ Better visibility into WIP ✖ Better understand/track/optimize flow of DevSecOps work ✖ Significant increase in consistency ○ Each step has a well defined interface ✖ Understanding the cost of switching ✖ Flexible enough for a range of skills & program maturity 38
- 39. Gen 1 AppSecPipelines Look at your team’s purpose and those processes which aid it 39
- 41. Real-World AppSec Pipelineexample
- 42. 42 Get your housein order
- 43. Gen 2 AppSecPipelines Look outside team’s purpose and those processes which aid it 43
- 44. Integrate with DevOpsTeams DevOpsPipeline AppSec Pipeline Drop tool(s) into their pipeline
- 45. Gen 3 AppSecPipelines Scale your teams reach and dramatically increase speed and visibility 45
- 46. ✖ A wayto conduct automated testing ✖ Run by the AppSec team to ○ Provide visibility of software posture ○ Provide findings to the dev teams ✖ Means to scale Security team coverage ○ No in-depth testing, breadth ○ Pre-calculate testing ✖ Creates a security baseline 46 What does a Gen3 AppSec Pipeline get me?
- 47. ✖ The onething that will fix all your problems ✖ A gate that blocks deploys (especially at first) ✖ Pipeline create artifacts ○ CI/CD => deployed apps ○ AppSec Pipelines => Security Findings 47 What an AppSec Pipeline isn’t
- 48. 48 First get theCake then do the icing
- 50. 50 So why shouldyou build an AppSec Pipeline?
- 51.
- 52. 52 AppSec Pipeline Stats 15Repos 4 Months 5,100 Runs 25,000+ Container Executions
- 53.
- 54. 2014 2015 2016 Numberof Assessments 44 224 414 Headcount N/A -3.5 -2 Percentage Increase N/A 450% 107% 54
- 55.
- 56.
- 57.
- 58. 58 DevSecOps can helppush visibility north Visibility
- 59.
- 60. Thanks! Any questions? You canfind me at: @matt_tesauro matt.tesauro@10Security.com 60
- 61. 61 REferences ● Confused panda:https://openclipart.org/detail/69289/confusedpanda ● Jousting Snails - a random twitter post I lost the URL for, sorry ● Map image: https://openclipart.org/detail/823/two-harbours-map ● Gandoff “Shall pass”: https://shirt.woot.com/offers/halfling-height-requirement ● Pixie dust: http://www.disneyeveryday.com/bottle-of-tinker-bells-pixie-dust-neck lace/ ● Iceberg of Ignorance: https://corporate-rebels.com/iceberg-of-ignorance/