Linux Foundation Live Webinar: Applying Governance to CI/CD

Confidential / © Harness Inc. 2020
Applying Governance to CI/CD
Tiffany Jachja | Technical Evangelist | Harness

The SolarWinds Hack of 2020.
Discovered in December 2020, by cybersecurity firm FireEye
Confidential / © Harness Inc. 2020 P/2
Resource: https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-
that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/

The SolarWinds Hack of 2020.
Discovered in December 2020, by cybersecurity firm FireEye
Caused by a supply chain hack
Compromised over 18,000 SolarWinds customers

—
The Cost of Software Failures
Resource: https://dzone.com/articles/open-source-vulnerabilities-will-they-ever-end
https://raygun.com/blog/cost-of-software-errors/
$4million
per data breach
correction
3.6billion
people affected
$1.7trillion
In financial
losses

—
Why use a CI/CD pipeline?
D E S I G N D E V E L O P M E N T T E S T I N G D E P L O Y M E N T
ESTIMATED COST OF RECOVERING FROM
VULNERABILITIES
5x
15x
95x

CI/CD Governance is how organizations attest to
the integrity of assets in a delivery pipeline

—
In this session:
Definitions
Principles of governance
Practices and tooling

Continuous Integration
& Continuous Delivery

A Basic CI/CD Pipeline

Continuous Integration != Continuous Delivery
Code
Build & Test Artifacts
Artifact

Continuous Integration != Continuous Delivery
Code
Build & Test Release
Strategy
Rollback
Verification
Infrastructure
Provisioning
Cloud Stacks Change
Management
Artifacts
Artifact
Continuous Delivery
Basic
Rolling
Canary
Blue / Green

Succeeding CI/CD
Code
Build & Test
Overall Visibility, Dashboards, & Reporting
Release
Strategy
Secrets, Auditing & Compliance
Rollback
Verification
Infrastructure
Provisioning
Cloud Stacks Change
Management
Artifacts
Artifact
Environment Variables & Pipeline Management
Continuous Delivery
Custom Scripts
Basic
Rolling
Canary
Blue / Green

What is Governance?

—
What is GRC?
Governance–
Expecting the unexpected
Setting communication channels
Overseeing maintenance and achievement

—
What is GRC?
Risk–
Identifying Risks
Rating and prioritizing them
Mitigate them

—
What is GRC?
Compliance–
Meeting expectations
Documenting and logging
Improving on the gaps

IT Governance is how organizations
monitor and control IT capabilities and decisions
for the delivery of value to key stakeholders.

Monitor Control

—
In the Build phase:
Coded, and ready to go?
Dependency Check
Static Code Analysis
Container or App Runtime Scanners
Secret Scanning

Open-source software is currently used by
96 percent of the most popular applications in the enterprise market.
More than 4000 security vulnerabilities are discovered in
open-source projects a year.
Resource: https://www.zdnet.com/article/enterprise-codebases-plagued-by-open-source-vulnerabilities/

 Infected function
Original function 

—
Where do security vulnerabilities live?

—
Who has access?

—
In the test phase:
We’re packed, and ready to go!
Automated Testing Suites
White and Black Box unit testing
In pre-prod environments: integration test

Control: Unit Test
Attestation: “All tests executed and passed”

Control: Unit Tests
Attestation: “All tests executed and passed.”
Control: Clean Dependencies
Attestation: “All dependencies in this build are free of known security
defects.”

—
In the deployment phase:
We’re provisioning, configuring, and delivering!
Testing your configurations
System tests, Vulnerability Scanning
Pen Testing

—
Introducing Manual Approvals

—
Where can I find this in the wild?
Capital One implements what’s called
16 gates.

—
16 gates.
John Willis co-authored a whitepaper in 2019 on
automated pipeline governance.

—
16 gates.
John Willis co-authored a whitepaper in 2019 on
automated pipeline governance.
Harness customers in the financial sector doing
this.

THE
KEY
TAKE
AWAYS
Automated Pipeline Governance
Controlling, Understanding, and
Mitigating Risk
Continuous Improvements

@tiffanyjachja
THANK
YOU
—
Any Questions?
/
Contact:
tiffany@harness.io
@harnessio

Linux Foundation Live Webinar: Applying Governance to CI/CD

Recommended

Recommended

More Related Content

What's hot

What's hot (18)

Similar to Linux Foundation Live Webinar: Applying Governance to CI/CD

Similar to Linux Foundation Live Webinar: Applying Governance to CI/CD (20)

More from Tiffany Jachja

More from Tiffany Jachja (14)

Recently uploaded

Recently uploaded (20)

Linux Foundation Live Webinar: Applying Governance to CI/CD