The document discusses product security and how it relates to application security, infrastructure security, and security operations for a specific product or system. It argues that applying DevOps methodologies to traditional application security practices can help make security part of everyday work for developers and operations teams. This will help change an organization's security culture to focus on designing security into products from the start.

1. Middle
Distance
Security
Product Security

2. Steven Carlson
Software Engineer who is passionate
about clean secure code.
https://rockrunner007.github.io/
Employment: 15 years in tech
• 3+ years local government
• 10+ years in Finical Technology
• 1 year in Ecommerce
• Helpdesk -> Software Engineer ->
Security -> DevOps =
Product Security

3. The Talk
 Middle Distance Security
 "This talk will argue that DevOps methodologies can be applied to
traditional application security practices. Only when developers and
operations team members are enabled to make security a part of
their everyday work will an organizations security culture change.
We must meet security at the sweet spot between running a
marathon and sprinting towards a software deployment. So put on
your running shoes; it’s time for Dev{Sec}Ops!"

4. Middle Distance Security
 Product Security is a superset of application security,
infrastructure security, and security operations around a
particular product or system.
 Focuses on designing security into the products
 Frequently reports into engineering, CTO

5. “
”
Code never lies, just runs as
well as the person who wrote
it.
Steven Carlson

6. Peter Snell
“Snell was one of the
greatest middle-
distance runners of
all time.”
- Runner World

7. Background
 Born in the tiny New Zealand beach township of Opunake, Snell
dominated the track world in the 800 meters, 1500 meters, and mile in the
years from the 1960 Olympics through the next Games in 1964.
 In addition to the three Olympic golds, his portfolio includes two Olympic
records, two Commonwealth Games golds, and seven world records.
 Even that list does not adequately define the supremacy that made one
journalist cry, as Snell powered to his second victory at the Tokyo
Olympics in 1964, “This is a god, not a man!”

8. “
”
In his time, he was able to
maintain a calm quick pace that
could outperform his
competitors.

9. Goals - Skills
• Protect the customer
• Product security engineers
involved in writing security
requirements, code reviews,
vulnerability testing
• Product meaning, we are including
the application and infrastructure
layers

10. What About Corporate Security?
 Tasked to defend and protect the enterprise
 Reports to a CISO or CSO, frequently within IT department
 Goals can be misaligned to engineering teams
 Traditionally involved in network design, deployment of off-the-shelf
products, etc.

11. Marathon
 A marathon is a long-distance
race with an official distance
of 26.2 miles

13. Build pipeline

14. Lessons Learned – 5 years in the making
 The Bad
 Frustrated engineers
 Lots of data
 A lot of custom Dev work
 The Good
 Very skilled individuals
 Alerts based on exploits
 Business has complete
visibility

15. “
”
That happy place between being
on your tippy toes and being
bored out of your mind
Steven Carlson

16. Build pipeline

17. Culture of Product Security
 Get everyone on board from the start
 Present a maturity program
 Provide the ROI to leadership
 Kick off open discussions with Engineers
 Enable (not force) engineers to become Security Champions

18. Kick off programs
 Security Champions
 Threat Modeling
 Software Component Analysis
 Secrets Management
 Application Security Testing
 Web Security
 Cloud Governance
 Risk Register

19. Build a team
 Work with Leadership on head count
 Cross-train with existing DevOps and Security Engineers
 Pick a leader that you trust
 Put on your running shoes

20. Know Your Product
 Know the product you are supporting
inside out
 Reach out to engineers who have
previously and are currently work on
existing software
 Reach out to IT who have previously and
are currently worked on existing
infrastructure

21. Measure Your Success
 Produce weekly reports for executive management
 Align metrics with the audience
 Request feedback early and often
 Less is often more
 Having a Software Development Life Cycle (SDLC) in place, trying to show
security improvement vs vulnerabilities can help.

22. Tools / Demo
 Samples templates:
https://github.com/RockRunner007
/gitlab-templates
 Gitlab supported templates:
https://gitlab.com/gitlab-
org/gitlab-foss
 Python Management:
https://python-
gitlab.readthedocs.io/en/stable/ind
ex.html

23. Secrets Detection
include:
- project: 'infra/gitlab-templates'
file: 'jobs/Secret-Detection.gitlab-ci.yml'
stages:
- secrets
secret_detection:
stage: secrets
artifacts:
expire_in: 1 day
#variables: #Optional if you want to exclude a test
project
#SECRET_DETECTION_EXCLUDED_PATHS: ""
More Details:
https://docs.gitlab.com/ee/user/applicatio
n_security/secret_detection/

24. Static Application Security
Testing (SAST)
include:
- project: 'infra/gitlab-templates'
file: 'jobs/SAST.gitlab-ci.yml'
stages:
- sast
sast:
stage: sast
artifacts:
expire_in: 1 day
variables:
SEARCH_MAX_DEPTH: 4
SAST_EXCLUDED_ANALYZERS: ""
SAST_EXCLUDED_PATHS: "spec, test, tests, tmp"
SCAN_KUBERNETES_MANIFESTS: "false"
More Details:
https://docs.gitlab.com/ee/user/applicatio
n_security/sast/

25. Container Scanning
include:
- project: 'infra/gitlab-templates'
file: 'security/Container-Scanning.gitlab-ci.yml'
stages:
- build
- containersecurity
- check_results
container_scanning:
stage: containersecurity
artifacts:
expire_in: 1 day
paths:
- gl-container-scanning-report.json
variables:
GIT_STRATEGY: fetch
CI_APPLICATION_REPOSITORY: $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG
CI_APPLICATION_TAG: $CI_COMMIT_SHA
rules:
- if: '$CI =~ /.*/'
when: always
More Details:
https://docs.gitlab.com/ee/user/applicatio
n_security/container_scanning/

26. Dynamic Application Security
Testing (DAST)
include:
- project: 'infra/gitlab-templates'
file: 'jobs/DAST.latest.gitlab-ci.yml'
stages:
- dast
dast:
stage: dast
artifacts:
expire_in: 1 day
variables:
DAST_WEBSITE: https://test.toolkit.co/
DAST_FULL_SCAN_ENABLED: "true"
More Details:
https://docs.gitlab.com/ee/user/applicatio
n_security/dast/

27. Add Security

28. Secure Phase Guidance
 Find it early. Fix it early.
 Avoid replicating vulnerabilities
 Learn from constant feedback

29. Do I Need Product Security
 Does your company develop and/or sell software?
 How are product security related vulnerabilities managed?
 Is your product tested for security flaws?

30. Steven Carlson
Software Engineer who is passionate
about clean secure code.
https://rockrunner007.github.io/
Employment: 15 years in tech
• 3+ years local government
• 10+ years in Finical Technology
• 1 year in Ecommerce
• Helpdesk -> Software Engineer ->
Security -> DevOps =
Product Security

31. Feedback
Please remember to fill out the evaluation forms

32. Good Resources
 https://naksecurity.medium.com/product-security-measurement-complexity-and-
the-near-future-a42ec7fd3cf7
 https://santikris2003.medium.com/product-security-dev-sec-tips-2fdb1698a3b3
 https://hockeyinjune.medium.com/product-security-14127b5838ba
 http://uploads.pnsqc.org/2015/papers/t-051_Rebelo_paper.pdf
 https://attack.mitre.org/
 https://www.gsa.gov/technology/technology-products-services/it-security/nist-
cybersecurity-framework-csf
 https://www.nist.gov/itl/csd/secure-systems-and-applications
 https://owasp.org/www-pdf-archive/SAMM_Core_V1-5_FINAL.pdf

33. Glossary
 Application Security - the process of developing, adding, and testing security features
within applications to prevent security vulnerabilities against threats.
 Infrastructure Security - the security provided to protect infrastructure, especially critical
infrastructure such as cloud or datacenter resources.
 Security Operations - a centralized unit that deals with security issues on an
organizational and technical level.
 Software Development Life Cycle (SDLC) - a conceptual framework describing all
activities in a software development project from planning to maintenance. This process
is associated with several models, each including a variety of tasks and activities.
 Security Vendors: https://blackpointcyber.com/blog/the-confusing-cyber-security-
landscape/
 Peter Snell
 https://youtu.be/RK0woLEtQQA
 https://www.runnersworld.com/news/a30225240/peter-snell-dies-at-80/
 Gitlab: https://about.gitlab.com/