This document outlines the agenda and demos for a presentation on securing the software delivery pipeline using open source security tools. The presentation covers setting up a continuous delivery pipeline using tools like Ansible, Jenkins and Docker to automate security testing with OWASP tools like ZAP and Dependency Check. It includes demos of manual testing with these tools, integrating them into a delivery pipeline using automation, and approaches like containerization to improve the speed and feedback loop of security testing. The overall goal is to discuss how to shorten software development cycles while maintaining security by automating testing within the delivery pipeline.

1. SecOps live cooking with OWASP
appsec tools
Maciej Lasyk
OWASP EEE – Kraków
2015-10-06

2. Join Fedora Infrastructure!
→ learn Ansible
→ join the security team!
→ use Fedora Security Lab (spin)
http://fedoraproject.org/en/join-fedora

3. Agenda?
→about delivery pipeline
→demos
→manual testing
→automation
→delivery pipeline

4. Agenda?
→about delivery pipeline
→demos
→manual testing
→automation
→delivery pipeline

5. Agenda?
→about delivery pipeline
→demos
→manual testing
→automation
→delivery pipeline

6. Agenda?
→about delivery pipeline
→demos
→manual testing
→automation
→delivery pipeline

7. Agenda?
→about delivery pipeline
→demos
→manual testing
→automation
→delivery pipeline

8. DEV INTEGRATION TEST PROD
Delivery Pipeline & security testing

9. DEV INTEGRATION TEST PROD
Feedback loop!
Delivery Pipeline!

10. DEV INTEGRATION TEST PROD
Feedback loop!
Delivery Pipeline!
→ UAT
→ Performance
→ Security

11. DEV INTEGRATION
TEST
containers
PROD
Feedback loop!
Delivery Pipeline!
→ UAT
→ Performance
→ Security
Experimentation gives you improvements!
Continuous security scanning

12. → shortening the cycle time
→ viability of scanning windows
→ burndown charts - security testing slice is usually tiny
→ security testing has to be faster
→ providing instant feedback
→ CD is a goal
Delivery Pipeline!

13. → shortening the cycle time
→ viability of scanning windows
→ burndown charts - security testing slice is usually tiny
→ security testing has to be faster
→ providing instant feedback
→ CD is a goal
Delivery Pipeline!

14. → shortening the cycle time
→ viability of scanning windows
→ burndown charts - security testing slice is usually tiny
→ security testing has to be faster
→ providing instant feedback
→ CD is a goal
Delivery Pipeline!

15. → shortening the cycle time
→ viability of scanning windows
→ burndown charts - security testing slice is usually tiny
→ security testing has to be faster
→ providing instant feedback
→ CD is a goal
Delivery Pipeline!

16. → shortening the cycle time
→ viability of scanning windows
→ burndown charts - security testing slice is usually tiny
→ security testing has to be faster
→ providing instant feedback
→ CD is a goal
Delivery Pipeline!

17. → shortening the cycle time
→ viability of scanning windows
→ burndown charts - security testing slice is usually tiny
→ security testing has to be faster
→ providing instant feedback
→ CD is a goal
Delivery Pipeline!

19. Manual testing demo #1
OWASP webgoat, OWASP hackademic story
test-app
vs
OWASP ZAP

20. Manual testing demo #1
OWASP webgoat, OWASP hackademic story
test-app
vs
OWASP ZAP

21. Manual testing demo #2
Fedora Pagure
vs
OWASP Dependency Check

22. Automation tools
→ Ansible (www.ansible.com)
→ Jenkins (jenkins-ci.org)
→ GoCD (www.go.cd)

23. Automation tools
→ Ansible (www.ansible.com)
→ Jenkins (jenkins-ci.org)
→ GoCD (www.go.cd)

24. Automation tools
→ Ansible (www.ansible.com)
→ Jenkins (jenkins-ci.org)
→ GoCD (www.go.cd)

25. Automation demo #1
Installing Jenkins w/Ansible

26. Linux Containers - Docker
→ Docker?
→ Docker Registry

27. Linux Containers - Docker
→ Docker?
→ Docker Registry

28. Automation demo #2
OWASP ZAP && Dependency Check + Docker

29. Automation demo #3
OWASP ZAP && Dependency Check + Docker
+
Jenkins

30. Automation demo #4
Containerization of security tools

31. Docker inside Docker?
Pros and cons

32. Automation demo #5
What about false positives / negatives?

33. Automation demo #6
Full delivery pipeline

34. Summary
Should we replace classical pentests with automation?

35. SecOps live cooking with OWASP
appsec tools
Maciej Lasyk
OWASP EEE – Kraków
2015-10-06