The document discusses the integration of security into the DevSecOps process for APIs, emphasizing the need for security measures to be implemented throughout the software development lifecycle. Key strategies include translating security requirements into code, utilizing threat modeling, and applying automated security profiles based on risk levels. It stresses the importance of collaboration among development, operations, and security teams to ensure comprehensive risk management and response.

1. DevSecOps for APIs
Isabelle Mauny, 42Crunch

2. TITLE TEXTFAST APP DELIVERY
2
APPLICATION
DEVELOPMENT
APPLICATION
SECURITY

3. “Security experts are going to have to figure out how to deliver
‘security as code’.
Essentially, they have to translate every security requirement,
every coding guideline, every ‘best practice,’ every threat model,
and every security architecture into code that can run during the
development, build, test, and deployment process.
Even in operations, it’s critical that attack detection and response
is fully automated.”
Jeff Williams
OWASP Top 10 project creator, about the (ex) A10 entry in OWASP Top 10.
https://sdtimes.com/owasp-adds-unprotected-apis-insufficient-attack-protection-top-ten-2017-release/
3

4. 4
RELIES ON STRONG COLLABORATION
ACROSS OPERATIONS, DEVELOPMENT,
SECURITY AND BUSINESS TEAMS
PROPER SECURITY

5. 5
THE SOLUTION ?
DEVOPS, BUT WITH
SECURITY ON!

6. LET’S SHIFT SECURITY LEFT!
6
DeploymentTestingDevelopmentDesign

7. THREAT
MODELLING
7
1
See: https://www.owasp.org/index.php/Application_Threat_Modeling

8. VULNERABILITY
SCANS
8
Infrastructure
TLS + Security Setup
✓ APIs Server, CDN, HTTP Server
✓ Security headers
Code analysis (Static, Dynamic, Interactive)
Third-party libs / frameworks
Apps / APIs (e.g. OWASP ZAP)
Authentication
Authorization
DevOps Scripts!
Choose platforms/tools where
functionality is exposed as APIs/CLI.
2

9. IT’S ILLEGAL TO
ATTACK SYSTEMS!
UNLESS
ALLOWED TO…
9

10. 1. Use Threat Modelling to eval the APIs risk
2. Define security profiles by risk level
3. Apply security profiles automatically based on risk.
10
IMPLEMENT
‘POLICY AS CODE’
3

11. 1. Easy to deploy even on developer’s laptops
2. Can be deployed hundreds of times
3. Immutable
Verify image integrity !
11
USE A
CONTAINERIZED PEP
4

12. 1. Constant monitoring at all stages
2. Automated Response when possible.
3. Apply security profiles automatically based on risk.
12
MONITOR AND
ANALYZE
5

13. 1. Secure Code reviews
2.Pen Testing
3.Bug Bounty
13
BONUS
POINTS
6

14. FULL DEV-SEC-OPS CYCLE FOR APIS
14
Develop
Assess
Secure
Test
Document
Deploy
API is developed on
platform of choice
Continuous API testing
including security
testing
Deploy to containerized
PEP
Configure and apply
security policy from
assessed risk
Assess API description
and evaluate risk level
Document and annotate
API with OpenAPI/Swagger

15. 15
EDUCATE
YOURSELF
AND OTHERS

16. IT’S NOT ABOUT IF,
IT’S ABOUT WHEN.
BE PREPARED.
16