DevSecOps | How hard it is?

dev
sec
ops
HOW HARD IT IS
Thiago Ribeiro
github.com/ribeiroit . twitter.com/ribeiroit

dev
sec
ops
HOW HARD IT IS Thiago Ribeiro . github.com/ribeiroit . twitter.com/ribeiroit
agenda
● about me
● why devsecops?
● quick concepts
● myths
● cultural change
● tips
● responsabilities
● q&a

dev
sec
ops
about me
● 97 / helpdesk internet provider
● 00 / sysadm / web developer
● 06 / it manager
● 09 / sysadm / infra developer
● 12 / backend developer
● 14 / security architect
● 18 / head of appsec
1
● tech data processing
● grad industrial design
● mba it management
● ms production engineering [aborted]
● itil / cobit / project management
/ lean / cybersecurity / cloud
computing / opensource experience
professional experience education

dev
sec
ops
why devsecops?
2
cybersecurity:
technologies
+ processes
+ practices
= protect enterprise goods
application security
+ information security
+ network security
+ disaster recovery
+ business continuity
+ operational security
+ end user education
source: http://whatis.techtarget.com/definition/cybersecurity

dev
sec
ops
why devsecops?
3
fix a web application ranges
from $400 to $4000 depending on
vulnerability
source: http://www.darkreading.com/risk/the-cost-of-fixing-an-
application-vulnerability/d/d-id/1131049?
$$ �
it is not about computers. it
is about branding and
reputation.

dev
sec
ops
why devsecops?
4
sox
handle requirements from
regulators and introduce
maturity models concepts on
sdlc.
pci
hipaacsa
iso
27001
opensamm
bsimm
bacen

dev
sec
ops
why devsecops?
5
understand security metrics
during the sdlc.
great opportunity to get the
“time to fix” from the teams
and handle risks accurately.
it is a lead time question.

dev
sec
ops
why devsecops?
6
dev
repo
build
deploy
blackhat
simple
attack scenario
vulnerability
fix development vulnerabilities
before being deployed in prod.

dev
sec
ops
why devsecops?
7
dev
repo
build
deploy
blackhat
advanced
attack scenario
confidential
files
ops
vulnerability
malware
help to protect information
leakage.

dev
sec
ops
quick concepts
8
•
sast – static analysis security
testing
•
dast – dynamic analysis security
testing
•
waf – web application firewall
•
pentesting – security penetration
tests
•
rasp – runtime application self-
protection
•
owasp – open web application
security project
•
asvs – application security
verification standard
•
soc – security operations center
•
iast – interactive appsec testing

dev
sec
ops
myths
9
people often sell devops like
they are selling bananas.
devops is a complex ecosystem
and demands many hours of
implementation.
there is no silver bullet.
it's hard to scale devops in
big companies.
“
”

dev
sec
ops
myths
10
problems? just install docker
to get the things done.
support containers on high
availability is not a piece of
cake.
problems like networking
policies and data volumes are
not too easy to be implemented.
all the people “layers” must be
solved to implement containers.
take care about using
containers, it could host a
malware on that.
“
”

dev
sec
ops
myths
11
static analysis of security
testing are enough to keep you
protected.
it's hard to make devs
understand all the threats that
they could be vulnerable.
fix vulnerabilities can take a
long time.
fix vulnerabilities might
generate new vulnerabilities.
consider have a waf or rasp to
be covered.
“
”

dev
sec
ops
myths
12
12factors. Whaaattt?
that's not easy to find
developers that can absorb the
12factors and deliver them.
it is a big challenge to
maintain a devsecops process
running. it demands massive
comunication and iteration with
the crew.
“ ”

dev
sec
ops
cultural change
13
developers think that they will
deliver software in production
easely.
devsecops is much more
responsability than
facilitation.
apply different gates to
different teams based on
maturity of them. create KPIs
to measure the maturity.
great power comes with great
responsabilities.
“
”

dev
sec
ops
cultural change
14
the team members don't
understand about the data
classification and what they
need to protect.
your company should have a good
aproach about data
classification and awareness
the team about what they
handle.
a good education program about
risks can help the team to
understand the value of the
information.
“
”

dev
sec
ops
cultural change
15
product owners must consider
security tests as 'valuable
deliverable' onto their
products.
security is still considered a
pain in the ass to many people.
some applications need manual
tests to go deeper in some
attacks scenarios.
automated dynamic analysis can
speedy the releases, but that's
not enough.
“
”

dev
sec
ops
tips
16
know your enemies and threats.
* must know about OWASP Top 10
* must know about SANS 25
if you don't know how to
attack, how could you defend?
sql injection appeared in 98
and it still continues on the
top vulnerabilities.

dev
sec
ops
tips
16
start everything classifying
risks and validating
requirements
owasp asvs can help you to
validate your technical
security controls
keep your application inventory
updated.
ref: https://github.com/aparsons/bag-of-holding
ref: https://www.owasp.org/images/5/58/OWASP_ASVS_Version_2.pdf
OWASP
ASVS

dev
sec
ops
tips
17
add sast to your pipeline
* save money and time to grab
and fix vulnerabilities
* sast helps to scale your team
knowledge and understanding
* it keeps your code safer,
even the best makes mistakes.
* establish a code reviewing
process to critical code.
double checking really matters.
ref: https://www.owasp.org/index.php/Source_Code_Analysis_Tools
GAS

dev
sec
ops
tips
18
invest time coding automated
tests whatever the layer you
should guarantee.
* automate functional tests
* automate vulnerability tests
* automate infra-structure
scans
* prioritize your efforts by
the risks.
NAPALM

dev
sec
ops
tips
19
threat modeling can help you to
understand threats and risks on
your solution and to apply the
correct countermeasures.
* keep your solutions'
documentation and diagrams
updated
* perform express threat
modeling sessions with your
team
* create a security check list
and try to automate that

dev
sec
ops
tips
20
always automate infra-structure
to keep hardening itens in
place.
good aproach to make inventory
management and apply patches in
a risk situation.
* pay attention to
microsegmentation and guarantee
free access to your
vulnerability scanners.
* always consider automation as
a defensive factor.

dev
sec
ops
tips
21
continuous logging can help you
to handle loglevels in
different rbac scenarios.
interface to help developers to
figure out application
debugging without login to
production.
integrate OPS logs to behavior
analysis can help you to
mitigate attacks or trigger
automatic fixes. availability
is part of security.
amplifying SOC visibility.

dev
sec
ops
tips
22
building enterprise secure
components can help you to
scale security inside your
company.
put the smart people to
generate smart solutions and
distribute them over the
organization.
libraries and software
dependencies are 80% of the
whole application.

dev
sec
ops
education and support
23
establish a security champions
program.
invest time and money to
guarantee the continuous
learning about security and new
threats to your crew.
start internal initiatives to
share knowledge with team: tech
talks, lightining talks, etc.
work together with human
resources to create
gamification programs.

dev
sec
ops
q&a
?? ??
??
??
thanks!
get in touch on my twitter or
github.

DevSecOps | How hard it is?

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to DevSecOps | How hard it is?

Similar to DevSecOps | How hard it is? (20)

More from PhishX

More from PhishX (6)

Recently uploaded

Recently uploaded (20)

DevSecOps | How hard it is?