Latest version of the basic rolling slides used at DevSecOps - London Gathering evenings. Ideas for 2020 - please provide input/feedback back to Michael Man.

2. WAYS TO STAY IN
TOUCH
https://www.meetup.com/DevSecOps-London-Gathering
https://www.linkedin.com/company/devsecops-london-
gathering
https://twitter.com/DevSecOps_LG
https://www.youtube.com/channel/UCR4oVMkRjNN2OQa
WMiBcfJA

3. SLIDES &
REFERENCES
https://www.vr-
security.com/references
https://www.vr-
security.com/presentations

4. DSO-LG
2020
Topic defined below for each month; now looking for speakers
• Focus sessions each month running from January – August
• Microservices (backend) application architecture
• Frontend browser client
• Frontend mobile client
• Core security application component (handling secret and/or “important data”)
• Infrastructure evolution: Compute, Containers (incl K8), Serverless
• “In line” and “out of band” security testing
• Challenges with integrating security testing tools
• Each session will give examples:
• Types of pipeline, threat models, security testing and governance/guardrails
”Application Security Transformation Journey
Moving From A Monolithic To Microservices
Architecture”

5. SHOUT OUT
*** Meetups ***
OWASP London Chapter
www.meetup.com/OWASP-London/
OWASP WIA
www.meetup.com/womeninappsec/
DevSecOps Manchester
www.meetup.com/DevSecOps-Manchester/
DevSecOps – Netherlands
www.meetup.com/DevSecOps-Netherlands/
LLHS
www.meetup.com/LLHS-Ladies-of-London-Hacking-
Society/
London Code Quality Meetup
*** Technology Specific ***
Docker London
www.meetup.com/Docker-London/
Kubernetes London
www.meetup.com/Kubernetes-London/
Threat Modeling
www.meetup.com/The-Threat-Modeling-Meetup/
Istio London
www.meetup.com/Istio-London/

6. SHOUT OUT
*** Conferences ***
DevSecCon London*
https://www.devseccon.com/london
-2019/
Open Security Summit
https://open-security-summit.org/
BSides London
https://www.securitybsides.org.uk/
QCon London
https://qconlondon.com/
* https://www.devseccon.com/scholarship-program-application/
I’ve bought a Early Bird
ticket – anybody else?

7. Dev Workstation Build Server
Centralize Report (Vulnerability Management) Server
SCM
Static Code Analysis
(SAST)
Dynamic Testing
(DAST)
Interactive Testing
(IAST)
Open Source Component Security
Manual Penetration Testing – Out of Band
Scope: Application and Network layer – White/Black box
Defect
Management
AUTOMATION
INTEGRATION POINTS
SECURITYASSURANCEMODEL
Container Security
Infrastructure As Code Scanning
DEVSECOPS FRAMEWORK (OCT 2019)
* A framework is a pre-built general or special purpose architecture that's designed to

8. IDE Static Code
Analysis
SCM
Dynamic
Analysis
Open Source
Software Security
Security
Testing
Framework
Binary
Repository
Define
Security Test
CasesThreat
Modeling
Security
Standards
Automation
Tools: Passing
Criteria
Risk
Management
Out of Band
Security
Testing
Security
Champions
DevSecOps
Engineer
Security Audit
Artifacts
CI Build
Server
DEVSECOPS – TOOLING & ASSURANCE EXAMPLES (OCT 2019)
curl
nmap
sslyze
sqlmap
Interactive
Testing
Infrastructure
Assurance
Threat
Modeling
Container
Security

9. “DIFFERENT” DEVSECOPS ROLES
“Terminology provides clarity and confusion.”
Michael Man
Throughout this year 2019, it appears that there are 3
(rightly or wrongly) types of DevSecOps roles (October
2019) that I have come across …. Food for thought:
• People with experience with automating
infrastructure deployments (Infrastructure as Code;
Cloud Engineers).
• People experienced with designing and
implementing security testing tools and integrating
those into pipelines (Application Security Tooling).
• People who works with the development team to
review, triage and remediate the security findings
from the various testing conducted as part of the
delivery pipeline (Security Champions, Embedded
Security SME).

10. DEVSECOPS – PEOPLE & CULTURE
• Break down the silo; no change here, just like the original DevOps movement
• Not aware of what is going on – likely you are not part of the “DevSecOps” team; leave
your ivory tower and build relationships
• Conduct a Value Stream Mapping exercise to optimize your delivery (rinse and repeat)
• Drill down and sketch out the details of each workflow before solutionising
• Try new checks/controls as part of the pipeline