This document discusses how to automate DevSecOps successfully. It outlines what DevSecOps is and how modern applications are built using many software components and libraries. This complexity increases risks from vulnerabilities in dependencies. The document recommends automating security practices like monitoring for vulnerabilities, updating dependencies continuously, and deploying updates immediately to "race the hacker." It advocates learning from hackers by automating everything to eliminate human errors. Specific automation approaches discussed include using containers and infrastructure as code, continuous integration/delivery pipelines, and monitoring tools to track open source updates and vulnerabilities. The goal is to fully automate the update and deployment process so that any new vulnerabilities can be addressed instantly regardless of available resources.

1. How to automate
your DevSecOps
successfully

2. Manuel Pistner
Hi everybody,
nice to see you here!
Founder & CEO of Bright Solutions
Computer Sience at TU Darmstadt
Grew up with Open Source
Automation Enthusiast

3. What are DevSecOps?
Static state
Continuous process,
including code
& infrastructure security
Culture + Practice + Tools + Automation

4. Agility & Security
Speed & Stability + Continuous Security
build test release
monitorplan
security
customer
developer

5. How modern apps are built
library
2
library
1 library
3

6. The challange
1. software components increase complexity
librar
1

7. The challange
2. Hackers are fast
(they hack while you sleep)

8. The common goal
Build & deliver security
accross all components
as a service.
With speed & at scale.

9. Principle Nr. 1
Learn from hackers

10. Principle Nr. 1
Learn from hackers
Automate everything
Race the hacker!
Get rid of human failure
Make security independend of
available resources

11. Basis for automation
Build a continuous delivery pipeline
For your application
Use a code repository (GIT)
CI (Travis CI, Circle CI, Jenkins...)
Automate code tests for stability
Automate penetration tests

12. Basis for automation
For infrastructure
Use containers
Use scalable & secure Cloud systems
Infrastructure as code

13. Update continuously
Open Source Libraries need
continuous updates
Know your libraries (use package managers)
Monitor security vulnerabilities
Update continuously

14. Worst Case Scenario
0-day exploits
Update all your projects, test & deploy in 0 time
Only possible with automation

15. Is Open Source a risk?
It's more secure than closed source:
More people watch over the code
The problem: vulnerabilities are announced in public
The solution: Do your homework & update!

16. 2. Manage new depen-
dencies of updates
The update process
3. Monitor vulnerabilities
of your app stack
1. Monitor dependency
updates
4. Manage the patches
6. Manage quality
7. Inform "stakeholders"
& manual testers
8. Update package
manager files
5. Commit code
to GIT!
9. Deploy

17. Let's visualize it

18. Then...

19. Study of 80 Software-Development companies
Status Quo
97,2 %
73,6 %
66,6 %

20. Study of 80 Software-Development companies
Status Quo
58,3 %
16,7 %
18,1 %

21. Study of 80 Software-Development companies
Status Quo
61,1 %
73,6 %

22. Scaring result
43% deploy & test updates manually
- AND they think this process is slow
43 %

23. Keep track of open source updates
Package managers only inform about updates
You need to know your vulnerabilities !
There are different vulnDBs
Versioneye as service or open source tool
(https://github.com/versioneye/versioneye-security)

24. Other monitoring tools

25. Main Subject
Enable ANYBODY (even your bots) to update your
dependencies
Integrate with your tools & workflows
Make the update process independend from
available resources
Increase velocity
Decrease fragility

26. The vision of the study
QA Workflow integration (manual & automated tests)
Tool integration
(task/ ticket management, test automation)
GIT integration & automated committing of new
versions
Auto deployment of new updates for vulnerable
libraries
Respect open source policies & licences
Find a toolset / method to build a fully automated
update delivery pipeline which makes the use of
open source more secure

27. The vision of the study
QA
process
hosting
platform

28. Share your use case
contact me at
pistner@brightsolutions.de