Downloaded 40 times
Uploaded byMohammed A. Imran
[DevSecOps Live] DevSecOps: Challenges and Opportunities
The document discusses the challenges and opportunities in DevSecOps, emphasizing the importance of tool adoption, constant feedback, and managing application security with practices like SAST, DAST, and OSS. It provides insights on onboarding processes, tool effectiveness, and practical strategies for managing security issues and zero-day vulnerabilities. The author advocates for developer engagement and effective monitoring to enhance security in production environments.
In this document
Powered by AI
Introduction to DevSecOps, highlighting the challenges and opportunities within this framework.
Focus on team dynamics, emphasizing the importance of quality, pragmatism, and skilled personnel in achieving success.
Significance of Application Security tools and expert guidance to ensure they meet requirements effectively.
Discussion on the need for early feedback and a continuous improvement process in security practices.
Overview of various security testing methods: SAST, DAST, OSS, and CSec.
Strategies for smooth onboarding of security tools through automation, triage processes, and issue management.
Detailing the BuildBreaker approach, including pre-process security and ensuring no critical issues are present.
Methods to enhance tool adoption among developers through documentation and staged rollout strategies.
Approaches for identifying and handling critical security issues and the importance of collaboration with stakeholders.
Importance of monitoring production environments and tailoring configurations for better developer experience.
Emphasis on upgrading tools, analyzing in test environments, and managing security tools effectively.
Strategies for managing zero-day vulnerabilities and the importance of vendor communication and readiness.
Highlighting the critical aspect of managing secrets within the DevSecOps practices.
Closing remarks from Mohan Yelnadu, including contact information and gratitude for the audience.
More Related Content
Similar to [DevSecOps Live] DevSecOps: Challenges and Opportunities
[DevSecOps Live] DevSecOps: Challenges and Opportunities
- 1.
- 3. P. P. T • •QUALITY • PRAGMATIC • • OPEN • ACCOMMODATING • • RIGHT SET • SUIT MY REQUIREMENTS People Tools Process
- 4. PEOPLE • SMALL BUTSMART • CAN ACHIEVE A LOT • • • • • • SAVVY • CHANGE THE LANGUAGE • BUSINESS RISKS
- 5. APPSEC TOOLS • • MAKEOR BREAK • COE, TEAM WITH CURIOSITY.. • • • • • GO FOR POC/LISTEN TO EXPERTS IN THE FIELD
- 6.
- 7. PROCESS • • • • S • S •S • • EARLY, EFFORTLESS, AND CONSTANT FEEDBACK
- 8. EXAMPLE SAST – StaticApplication Security Testing OSS – Open Source Software Security CSec – Container Security DAST – Dynamic Application Security Testing
- 9. • SMOOTH ONBOARDING •AUTOMATE WHAT YOU CAN • IMPROVING TOOL ADOPTION • ROLLOUT STRATEGY • MANAGING CRITICAL ISSUES • MAKING IT WORK FOR SOC • PRODUCTION MONITORING • TAILORED CONFIGURATION • DO THE RIGHT THING • PRAGMATIC HYGIENE • MANAGING ZERO DAYS
- 10. SMOOTH ONBOARDING • AUTOMATEDONBOARDING ON SECURITY TOOLS • • • HEARD THE TOOL NAME, & ONBOARDED
- 11. AUTOMATE WHAT YOUCAN O N B OA R D I N G S C A N N I N G T R I AG E B U I L D B R EA K E R I S S U E M A N AG E M E N T
- 12. TRIAGE Scan Raise Triage Request Analyze Findings Fix True issues False Positives Analyze Triage Issues(If required meet developers) True issues False Positives Ignore/Not Applicable Developer AppSec SME
- 13. BUILDBREAKER: Pre-process Build Security Scan CodeQuality Scan BuildBreaker PROD Example BitBucket Artifactory Source Code Build Artefact No-Go Go BuildBreaker Example: • No critical security issues in production build
- 14. IMPROVING TOOL ADOPTION Allowdevelopers to Get used to the Tools‘‘ ’’ Give enough notice while enabling BuildBreakers/Gating‘‘ ’’ Create Ecosystem: FAQs, Documentation, Demos, Videos ‘‘ ’’ Give as many Live Demos as possible, share about new Tools & Processes ‘‘ ’’
- 15. ROLLOUT STRATEGY Break Build: InStages‘‘ ’’ Handholding in False Positive Analysis: Triage & Guidance‘‘ ’’ Dispensation Management: Logging & Validity‘‘ ’’
- 16. MANAGING CRITICAL ISSUES • •LEVEL 10/CRITICAL • IDENTIFICATION • • FOLLOW-UP • Developers DO NOT realise the Gravity of Level 10 OSS Issues Self-Expérience J ‘‘ ’’
- 17. • • • • MAPPING APPWITH RIGHT STAKEHOLDERS IN DASHBOARD WORKING WITH SOC
- 18. PRODUCTION MONITORING • MONITORING • •NIGHTLY • ALERT Effective PROD Monitoring saved a huge effort! Self-Expérience J ‘‘ ’’
- 19. TAILORED CONFIGURATION • • • • DISPENSATION •LOGGING • CREATE DEVELOPER
- 20. DO THE RIGHTTHING • • UPLOAD LIBRARY AND ANALYSE • BROWSER PLUGIN TO SCAN • IDE PLUGIN TO ENABLE LOCAL SCANS
- 21. PRAGMATIC HYGIENE • UPGRADINGTHE TOOLS TO LATEST VERSIONS • NEW FEATURES INNOVATIONS • ANALYSE IN TEST ENVIRONMENT 01 03 05 04 02
- 22. MANAGING ZERO DAYS •EYES AND EARS OPEN ZERO DAYS: • YOUR LIBRARIES TOOLS • • WAF • CONSTANT TOUCH WITH VENDOR • EVER READY TO ACT THE SHOW MUST GO ON!
- 23. IMPORTANT : SECRETSMANAGEMENT • • • •
- 25.