Downloaded 22 times
Uploaded byApollo Clark
My Little Webap - DevOpsSec is Magic
The document discusses the DevOpsSec approach which aims to integrate security testing into the development process through automation. It outlines how DevOpsSec can help address issues that arise from the traditional separation of development and operations teams. The document provides examples of different types of tests that can be automated, such as unit testing, performance testing, and security testing of an application's attack surface. It promotes automating as many tests as possible and sharing test automation code to continuously monitor for vulnerabilities and issues.
More Related Content
![[123] quality without qa](https://cdn.slidesharecdn.com/ss_thumbnails/132qualitywithoutqa-150914011521-lva1-app6892-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to My Little Webap - DevOpsSec is Magic
My Little Webap - DevOpsSec is Magic
- 1. My Little Webapp– DevOpsSec is Magic Apollo Clark @apolloclark apolloclark.com slideshare.net/ApolloClark/my-little-webap-devopssec-is-magic
- 3. About Me •Originally from Maine • Lived in Milwaukee, Chicago, Atlanta • Web developers since 2001 • PHP, Python, Java, Perl, Visual Basic • Kali Linux, Burpsuite, SQLMap, XSSer, etc. • Got badly hacked in 2010, been learning since • I like making good software
- 6. What if wecould fix anything in 10 minutes?
- 7.
- 8. How does itfeel?
- 10. Prepare for ameme filled ride.
- 13. How do wedo things today?
- 17. We need tobuild QA and security in.
- 18. What can wedo?
- 23.
- 25. Dev vs. Ops • Devs are paid to change code, high entropy
- 26. Dev vs. Ops • Devs are paid to change code, high entropy • Ops are paid to have stability, low entropy
- 27. Dev vs. Ops • Devs are paid to change code, high entropy • Ops are paid to have stability, low entropy • Change != Stability
- 28. Dev vs. Ops • Devs are paid to change code, high entropy • Ops are paid to have stability, low entropy • Change != Stability • IE8 only supports loading 31 CSS files
- 29. "One line ofcode can break everything."
- 30. What do wedo?
- 33.
- 36. Performance • stresstesting: "how many concurrent users?"
- 38. Performance • stresstesting: "how many concurrent users?" • server latency: "how long is the response wait?"
- 39. Performance • stresstesting: "how many concurrent users?" • server latency: "how long is the response wait?" • initial client-side load latency: "time to first tweet"
- 41. Performance • stresstesting: "how many concurrent users?" • server latency: "how long is the response wait?" • initial client-side load latency: "time to first tweet" • client latency: "how long does action take?"
- 42. Performance • stresstesting: "how many concurrent users?" • server latency: "how long is the response wait?" • initial client-side load latency: "time to first tweet" • client latency: "how long does action take?"
- 43. Don’t forget toDDoS yourself.
- 44. I like toDDoS myself on the weekends.
- 47.
- 49.
- 51. Code quality testingIS security testing.
- 52. Code Quality •linting, correct formatting
- 54. Code Quality •linting, correct formatting • copy + paste, easily refactor
- 55. Code Quality •linting, correct formatting • copy + paste, easily refactor • complexity, refactoring target
- 57. 2^6 possible codepathways
- 58. 64 possible outcomesfrom 1 function.
- 59. Code Quality •linting, correct formatting • copy + paste, easily refactor • complexity, refactoring target • unsafe calls, change implementation
- 61. Code Quality •linting, correct formatting • copy + paste, easily refactor • complexity, refactoring target • unsafe calls, change implementation • e2e tests, detect regressions
- 62. Code Quality •linting, correct formatting • copy + paste, easily refactor • complexity, refactoring target • unsafe calls, change implementation • e2e tests, detect regressions • unit tests, detect integration issues
- 63. Code Quality •linting, correct formatting • copy + paste, easily refactor • complexity, refactoring target • unsafe calls, change implementation • e2e tests, detect regressions • unit tests, detect integration issues • coverage, testing thoroughness
- 64. Code Quality •linting, correct formatting • copy + paste, easily refactor • complexity, refactoring target • unsafe calls, change implementation • e2e tests, detect regressions • unit tests, detect integration issues • coverage, testing thoroughness • mocks, speed up testing
- 66.
- 68. Ready to trysome Unit Testing?
- 70. Unit Testing GET/users/<account_name> • happy path: "aclark" • missing entry: "aclark2" • lower bounds: "a" • upper bounds: "aaaaaaaaa" • empty: "account_name" : "" • null: (null) • fuzzing: "a2$@o9(@1"
- 72. "a2$@o9(@1" eventually becomes"a or 1=1; --"
- 77.
- 78. Supported • definesupported devices, resolutions, browsers, and versions
- 79. You can’t supporteverything:
- 81. Supported • definesupported devices, resolutions, browsers, and versions • use Selenium WebDriver
- 82. Supported • definesupported devices, resolutions, browsers, and versions • use Selenium WebDriver • test locally in VM images
- 84. Supported • definesupported devices, resolutions, browsers, and versions • use Selenium WebDriver • test locally in VM images • test on the cloud
- 85. Supported • definesupported devices, resolutions, browsers, and versions • use Selenium WebDriver • test locally in VM images • test on the cloud
- 86. Try using unsupportedsystems. Hopefully fail gracefully. Might even find something…
- 87. Hint: Try settingyour browser User-Agent to iPhone 3.0 when visiting news websites :P
- 91. Deployable • atomicbase box VM
- 93. Deployable • atomicbase box VM • provisioning scripts
- 95. Deployable • atomicbase box VM • provisioning scripts • deploy to local, AWS, Rackspace, etc.
- 96. Deployable • atomicbase box VM • provisioning scripts • deploy to local, AWS, Rackspace, etc. • scan dependency list
- 98. Deployable • atomicbase box VM • provisioning scripts • deploy to local, AWS, Rackspace, etc. • scan dependency list • scan server setup
- 100. Deployable • atomicbase box VM • provisioning scripts • deploy to local, AWS, Rackspace, etc. • scan dependency list • scan server setup
- 104.
- 107. Monitoring • requestorigin
- 108. If you’re a‘Murican only company, why are you letting your server talk to Russia?
- 109. Monitoring • requestorigin • request scans
- 112. Monitoring • requestorigin • request scans • invalid requests
- 114. Monitoring • requestorigin • request scans • invalid requests • request flood
- 116. Monitoring • requestorigin • request scans • invalid requests • request flood • response flood
- 118. Monitoring • requestorigin • request scans • invalid requests • request flood • response flood • server uptime
- 119. Monitoring • requestorigin • request scans • invalid requests • request flood • response flood • server uptime • latency
- 120. Monitoring • requestorigin • request scans • invalid requests • request flood • response flood • server uptime • latency • cpu load
- 121. Monitoring • requestorigin • request scans • invalid requests • request flood • response flood • server uptime • latency • cpu load
- 122. My startup has< 100 users. It gets scanned and attacked every day.
- 123. Your live serversare getting hammered all the time.
- 127. Security • whatto test?
- 128. This is yourattack surface:
- 132. Security • whatto test? • how to test?
- 134. Security • whatto test? • how to test? • monitor issues
- 136. Security • whatto test? • how to test? • monitor issues • aggregate reports
- 137. Security • whatto test? • how to test? • monitor issues • aggregate reports • prioritize issues
- 138. Security • whatto test? • how to test? • monitor issues • aggregate reports • prioritize issues • automate tests
- 139. Security • whatto test? • how to test? • monitor issues • aggregate reports • prioritize issues • automate tests
- 140. Give and requestautomated tests, not PDF docs.
- 141. Write "Malicious UserStories"
- 143. IF YOU SEE SOMETHING, SAY SOMETHING.
- 144. ... but, atleast write a test.
- 146. DevOpsSec is free,you can do it today.
- 147. Automation does notreplace people.
- 149.
- 151.
- 152. "I am DevOpsSec..."
- 153. "... and socan you!"
- 155. Apollo Clark @apolloclark apolloclark.com slideshare.net/ApolloClark/my-little-webap-devopssec-is-magic github.com/apolloclark/py-jenkins-ci