Download as PDF, PPTX
![Dev[Sec]Ops is…
empowered engineering teams
taking ownership
of how their product
performs in production
[including security]](https://image.slidesharecdn.com/polyglotwebinar-181108153712/75/How-to-Manage-the-Risk-of-your-Polyglot-Environments-34-2048.jpg)
Uploaded byDevOps.com
How to Manage the Risk of your Polyglot Environments
The document discusses managing risks in polyglot environments, which involve the use of multiple programming languages in software development. Key challenges include dependency management, variability in tooling, and expertise gaps, while benefits encompass faster innovation and improved flexibility in recruitment. Strategies proposed for risk management include automated processes, environment standardization, and integrating security within development practices.
More Related Content
Similar to How to Manage the Risk of your Polyglot Environments
![Coded Agents – with UiPath SDK + LangGraph [Virtual Hands-on Workshop]](https://cdn.slidesharecdn.com/ss_thumbnails/codedagentsdeck-251215155422-5497c599-thumbnail.jpg?width=640&height=640&fit=bounds)
How to Manage the Risk of your Polyglot Environments
- 1. How to ManageRisk of Your Polyglot Environments
- 2. Presenters ● Jeff Rouse,VP Product, ActiveState ● Pete Garcin, Senior Product Manager, ActiveState ● Larry Maccherone, Head of DevSecOps Transformation, Comcast Manage Risk: Polyglot Environments
- 3. VP Product Jeff Rouse,ActiveState
- 4. Platform Presentation Manage Risk: PolyglotEnvironments Jeff Rouse VP Product ActiveState
- 5. Track-record: 97% ofFortune 1000, 20+ years open source Polyglot: 5 languages - Python, Perl, Tcl, Go, Ruby Runtime Focus: concept to development to production Manage Risk: Polyglot Environments
- 6. What’s Polyglot? Manage Risk: PolyglotEnvironments
- 7. How Do PolyglotEnvironments Evolve? ● Technology. Best tool for the job, modern software projects. ● People. technology stacks added through acquisition, changes in tech leadership ● Time. technologies come in & out of favour; old languages never die. Manage Risk: Polyglot Environments
- 8. Every Organization isPolyglot ● Any desktop application with an online component. ● YAML configuration used with any project. ● An application with embedding scripting. Manage Risk: Polyglot Environments
- 9. Manage Risk: Polyglot Environments Source:ActiveState Developer Survey 2018, Open Source Runtime Pains Adding a Language
- 10. Manage Risk: Polyglot Environments Source:ActiveState Developer Survey 2018, Open Source Runtime Pains Rank the Challenges
- 11. Manage Risk: Polyglot Environments Source:ActiveState Developer Survey 2018, Open Source Runtime Pains Stability & Security → Painful
- 12. Hidden Costs 75% Managing dependencies Manage Risk: PolyglotEnvironments Source: ActiveState Developer Survey 2018, Open Source Runtime Pains
- 13. Benefits Manage Risk: Polyglot Environments ●Speed. Ship faster: better products, better innovation. ● Recruitment. Be attractive workplace: enable coders to choose the tools they need.
- 14. Drawbacks ● Variability. Toolingsupport & programming language quality. ● Expertise Gap. Deep core competency at odds with breadth of programming languages. ● Dependencies. Larger pool of dependencies. ● Support Costs. Unable to centralize, maintenance. Manage Risk: Polyglot Environments
- 15. Title color bytheme Most important tex. tipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. Presentation Title Magnified Issues How will you monitor, identify and resolve? Production bugs, Common Vulnerabilities & Exposures (CVE), threats; additional risk exposure with 3rd party dependencies. Equifax Breach: out of date 3rd party dependency Manage Risk: Polyglot Environments
- 16. Reduce Services Reduce Tools Reduce Libs Reduce Attack Surface Robust Processes, Automatedand Centralized for Visibility Resolutions Presentation Title
- 17. Senior Product Manager PeteGarcin, ActiveState
- 18. Pete Garcin Senior ProductManager ActiveState Platform Presentation Manage Risk: Polyglot Environments
- 19. Automated Processes Manage Risk: PolyglotEnvironments
- 20.
- 21. Resolving Manage Risk: Polyglot Environments ●Automate. ● Bundle. ● Simplify Shares. Encourage adoption of common environments.
- 22.
- 23.
- 24.
- 25. Best Practices -Build Eng & Development Manage Risk: Polyglot Environments Build Standard Reproduce & ManageShrink Build
- 26. Manage Risk: Polyglot Environments MonitorRuntime Get Updates Best Practices - Development to Production
- 27. Benefits to You TimeDevZen Manage Risk: Polyglot Environments Same Same
- 28. Privileged and Confidential DELETE |28E7: SDL Self Assessment A lean/agile transformation approach to achieving a DevSecOps culture
- 29. Privileged and Confidential DELETE |29E7: SDL Self Assessment Larry_Maccherone@Comcast.com
- 30. Security practices onDevOps continuum ➔ DevSecOps • Static/IAST analysis • Abuse case tests • Code review • Break the build code analysis • Threat modeling → backlog items • Analyze/Predict → backlog items • Design complies with policy? • Test security features • Common abuse cases • Pen testing (Vuls found → Test scripts) • Compliance validation (PCI, etc.) • Fuzzing • If we do X will it mitigate Y? • Capacity forecasting • Learning → Update playbooks and Training • Configuration validation • Feature toggles/Traffic shaping configuration • Secrets management • Log information for after-incident analysis • Intrusion detection • App attack detection • Restore/maintain service for non-attack usage • RASP auto respond • Roll-back or toggle off • Block attacker • Shut down services • Analysis → Learning • Defect/Incident 3-step • New attack surface? Plan to update threat model
- 31. That’s a lotof stuff! How do we get development teams to adopt?
- 32.
- 33.
- 34. Dev[Sec]Ops is… empowered engineeringteams taking ownership of how their product performs in production [including security]
- 35. Build security in morethan bolt it on Rely on empowered engineering teams more than security specialists Implement features securely more than security features Rely on continuous learning more than end-of-phase gates Build on culture change more than policy enforcement DevSecOps Manifesto
- 36. We, the SecurityTeam… Recognize that Engineering Teams… • Want to do the right thing • Are closer to the business context and will make trade-off decisions between security and other risks • Want information and advice so those trade-off decisions are more informed Pledge to… • Lower the cost/effort side of any investment in developer security tools or practices • Assist 2x as much with preventative initiatives as we beg for your assistance reacting to security incidents Understand that… • We are no longer gate keepers but rather tool-smiths and advisors
- 37. DevSecOps Tool Landscape StaticAnalysis (aka SAST) • Looks at source code • Data/control flow analysis • Prone to false positives • Rapid feedback for developers • Code fix suggestions Dynamic • Exercises app via UI/API • Senses vulnerability by response to input • Zero? false positives. Report is an exploit • High false negatives • Difficult to implement especially w/ auth • Sometimes hard to find code to remediate Runtime Application Security Protection (RASP) • Often uses same engine as IAST • Reports on “bad” behavior • Can abort transaction or kill process to protect Fuzzing (black box) • Instruments system (to varying degrees) • Sends unexpected input at API • Looks at response and instrumentation output • Great for testing protocols like SIP • Good for REST APIs • Potentially long run times • Hard to find code to remediate Primary Code Analysis (PCA) for code you write (1st party) Software Composition Analysis (SCA) for code you import (3rd party) • Identifies dependency and version • Checks CVE/NVD + … for reported vulnerabilities • Proposes version/patch to remediate • Checks license vs policy • Runs fast • Easy to implement • Best bang for buck! IAST • Runtime code analysis • Combine dynamic/static • Low false positives • Depends on test coverage • Immature but getting there
- 39. What’s next? • Questions? • Pilotthis DevSecOps transformation framework with a few of your teams • Connect with me on:
- 40.
- 41. What’s Next ● Watcha demo: https://www.youtube.com/watch?v=c5AIxN9ehrI ● Get a demo marketing@activestate.com ● Contact us for the language build you need: platform@activestate.com
- 42. Tel: 1.866.631.4581 Website: www.activestate.com Twitter:@activestate Facebook: /activestatesoftware Where to find us Manage Risk: Polyglot Environments