SlideShare a Scribd company logo
© 2016 ELLUCIAN. 1
Bringing Law and Order to CI/CD
© 2016 ELLUCIAN. 2
Agenda
1 Background
2 RoboCop
3 DevSecOps at Ellucian
4 Lessons Learned
© 2016 ELLUCIAN. 3
40years
2,400
institutions
18,000,000
students
40
countries
Ellucian Ethos Platform
Integrated
Secure
Extensible
Analytics
© 2016 ELLUCIAN. 5
RoboCop
© 2016 ELLUCIAN. 7
RoboCop’s Prime Directives
© 2016 ELLUCIAN. 8
Serve the Public Trust
“Excuse me. I have to go. Somewhere there is a crime happening.”
RoboCop “RoboCop”
• Business Driven Security
• Open Collaboration
• Leaning In
• Translate Security for the Layperson
© 2016 ELLUCIAN. 9
Protect The Innocent
“Come quietly or there will be… trouble"
RoboCop “RoboCop”
• Developers are not security experts
• Security can be an afterthought
• Developers are lazy
© 2016 ELLUCIAN. 10
Uphold The Law
• What are your policies?
• What are your standards?
• Security Gates
“You are illegally parked on private property. You have twenty seconds to move
your vehicle.”
ED-209 “RoboCop”
© 2016 ELLUCIAN. 13
How We Define DevOps
© 2016 ELLUCIAN. 14
Scaling Application Security
© 2016 ELLUCIAN. 15
DevSecOps
DevSecOps: automation of security tasks by embedding security controls
and processes into the DevOps workflow
© 2016 ELLUCIAN. 16
Application Security Testing Technologies
Dynamic InfrastructureStatic
© 2016 ELLUCIAN. 17
Static Application Security Testing (SAST)
© 2016 ELLUCIAN. 18
Dynamic Application Security Testing (DAST)
© 2016 ELLUCIAN. 20
Infrastructure
© 2016 ELLUCIAN. 21
© 2016 ELLUCIAN. 22
© 2016 ELLUCIAN. 23
© 2016 ELLUCIAN. 24
DAST Evolution
© 2016 ELLUCIAN. 25
DAST Evolution
© 2016 ELLUCIAN. 26
DAST Evolution
© 2016 ELLUCIAN. 27
DAST Evolution
© 2016 ELLUCIAN. 28
DAST Evolution
© 2016 ELLUCIAN. 29
SAST Approach
© 2016 ELLUCIAN. 30
Mindset is critical
© 2016 ELLUCIAN. 31
You have to get your hands dirty
"construction-workers" (CC BY 2.0) by dandeluca
© 2016 ELLUCIAN. 32
Don’t let perfect be the enemy of good
© 2016 ELLUCIAN. 33
When all you have is a hammer…
© 2016 ELLUCIAN. 34
Invest for the future
"Piggy Bank" (CC BY 2.0) by free pictures of money
© 2016 ELLUCIAN. 35
Be an enabler not a
barrier
Make security a
feature
Summary
People and culture
not tools and
technology
© 2016 ELLUCIAN. 36
My team:
• Arjun BM
• Mehul Gadhia
• Franklin Mosley
• Swayam Sarangi
RoboCop is a trademark of Orion Pictures Corp.
All images © their respective owner
Acknowledgements
© 2016 ELLUCIAN. 37
Thank you.
Troy Marshall
troy.marshall@ellucian.com
/in/troymarshall
@RTroyMarshall

More Related Content

Similar to RVASec 2017- Bringing Law and Order to CICD

комплексная защита от современных интернет угроз с помощью Check point sandblast
комплексная защита от современных интернет угроз с помощью Check point sandblastкомплексная защита от современных интернет угроз с помощью Check point sandblast
комплексная защита от современных интернет угроз с помощью Check point sandblast
Diana Frolova
 
Cisco Connect Toronto 2017 - Your time is now
Cisco Connect Toronto 2017 - Your time is nowCisco Connect Toronto 2017 - Your time is now
Cisco Connect Toronto 2017 - Your time is now
Cisco Canada
 
"Computer Vision 2.0: Where We Are and Where We're Going," a Presentation fro...
"Computer Vision 2.0: Where We Are and Where We're Going," a Presentation fro..."Computer Vision 2.0: Where We Are and Where We're Going," a Presentation fro...
"Computer Vision 2.0: Where We Are and Where We're Going," a Presentation fro...
Edge AI and Vision Alliance
 
Masters in Microsoft 2018 - Blockchain
Masters in Microsoft 2018 - Blockchain Masters in Microsoft 2018 - Blockchain
Masters in Microsoft 2018 - Blockchain
Avanade Nederland
 
GIDS-2023 A New Hope for 2023? What Developers Must Learn Next
GIDS-2023 A New Hope for 2023? What Developers Must Learn NextGIDS-2023 A New Hope for 2023? What Developers Must Learn Next
GIDS-2023 A New Hope for 2023? What Developers Must Learn Next
Steve Poole
 
EMC World 2016 - cnaITL.01 Adopting An Open Source Strategy
EMC World 2016 - cnaITL.01 Adopting An Open Source StrategyEMC World 2016 - cnaITL.01 Adopting An Open Source Strategy
EMC World 2016 - cnaITL.01 Adopting An Open Source Strategy
{code}
 
The Future Is Not What It Used To Be - Jan-Willem Middelburg
The Future Is Not What It Used To Be - Jan-Willem MiddelburgThe Future Is Not What It Used To Be - Jan-Willem Middelburg
The Future Is Not What It Used To Be - Jan-Willem Middelburg
Pink Elephant
 
Malware in the Wild: Evolving to Evade Detection
Malware in the Wild: Evolving to Evade DetectionMalware in the Wild: Evolving to Evade Detection
Malware in the Wild: Evolving to Evade Detection
Lastline, Inc.
 
Extreme DevOps in Fintech
Extreme DevOps in FintechExtreme DevOps in Fintech
Extreme DevOps in Fintech
Angelo Agatino Nicolosi
 
Csa summit seguridad en el sddc
Csa summit   seguridad en el sddcCsa summit   seguridad en el sddc
Csa summit seguridad en el sddc
CSA Argentina
 
The Dawn of Industry 4.0
The Dawn of Industry 4.0The Dawn of Industry 4.0
The Dawn of Industry 4.0
CPqD
 
Web European Conference 2015 - Welcome Session
Web European Conference 2015 - Welcome SessionWeb European Conference 2015 - Welcome Session
Web European Conference 2015 - Welcome Session
Ugo Lattanzi
 
So You Want a Threat Intelligence Function (But Were Afraid to Ask)
So You Want a Threat Intelligence Function (But Were Afraid to Ask)So You Want a Threat Intelligence Function (But Were Afraid to Ask)
So You Want a Threat Intelligence Function (But Were Afraid to Ask)
Lancope, Inc.
 
Future Perspective: Cloud Connectivity in an IoT World
Future Perspective: Cloud Connectivity in an IoT WorldFuture Perspective: Cloud Connectivity in an IoT World
Future Perspective: Cloud Connectivity in an IoT World
Josiah Renaudin
 
A new hope for 2023? What developers must learn next
A new hope for 2023? What developers must learn nextA new hope for 2023? What developers must learn next
A new hope for 2023? What developers must learn next
Steve Poole
 
Stay One Step Ahead of Cyber Threats - Check Point
Stay One Step Ahead of Cyber Threats - Check PointStay One Step Ahead of Cyber Threats - Check Point
Stay One Step Ahead of Cyber Threats - Check Point
MarcoTechnologies
 
Giants of the web - creadigitalday
Giants of the web - creadigitaldayGiants of the web - creadigitalday
Giants of the web - creadigitalday
Joseph Glorieux
 
Why AppSec Matters
Why AppSec MattersWhy AppSec Matters
Why AppSec Matters
InnoTech
 
Invisible Architectures - Supporting Public-Facing Technologies
Invisible Architectures - Supporting Public-Facing TechnologiesInvisible Architectures - Supporting Public-Facing Technologies
Invisible Architectures - Supporting Public-Facing Technologies
Jane Alexander
 
Cl16 wit io_t
Cl16 wit io_tCl16 wit io_t
Cl16 wit io_t
Shubha Govil
 

Similar to RVASec 2017- Bringing Law and Order to CICD (20)

комплексная защита от современных интернет угроз с помощью Check point sandblast
комплексная защита от современных интернет угроз с помощью Check point sandblastкомплексная защита от современных интернет угроз с помощью Check point sandblast
комплексная защита от современных интернет угроз с помощью Check point sandblast
 
Cisco Connect Toronto 2017 - Your time is now
Cisco Connect Toronto 2017 - Your time is nowCisco Connect Toronto 2017 - Your time is now
Cisco Connect Toronto 2017 - Your time is now
 
"Computer Vision 2.0: Where We Are and Where We're Going," a Presentation fro...
"Computer Vision 2.0: Where We Are and Where We're Going," a Presentation fro..."Computer Vision 2.0: Where We Are and Where We're Going," a Presentation fro...
"Computer Vision 2.0: Where We Are and Where We're Going," a Presentation fro...
 
Masters in Microsoft 2018 - Blockchain
Masters in Microsoft 2018 - Blockchain Masters in Microsoft 2018 - Blockchain
Masters in Microsoft 2018 - Blockchain
 
GIDS-2023 A New Hope for 2023? What Developers Must Learn Next
GIDS-2023 A New Hope for 2023? What Developers Must Learn NextGIDS-2023 A New Hope for 2023? What Developers Must Learn Next
GIDS-2023 A New Hope for 2023? What Developers Must Learn Next
 
EMC World 2016 - cnaITL.01 Adopting An Open Source Strategy
EMC World 2016 - cnaITL.01 Adopting An Open Source StrategyEMC World 2016 - cnaITL.01 Adopting An Open Source Strategy
EMC World 2016 - cnaITL.01 Adopting An Open Source Strategy
 
The Future Is Not What It Used To Be - Jan-Willem Middelburg
The Future Is Not What It Used To Be - Jan-Willem MiddelburgThe Future Is Not What It Used To Be - Jan-Willem Middelburg
The Future Is Not What It Used To Be - Jan-Willem Middelburg
 
Malware in the Wild: Evolving to Evade Detection
Malware in the Wild: Evolving to Evade DetectionMalware in the Wild: Evolving to Evade Detection
Malware in the Wild: Evolving to Evade Detection
 
Extreme DevOps in Fintech
Extreme DevOps in FintechExtreme DevOps in Fintech
Extreme DevOps in Fintech
 
Csa summit seguridad en el sddc
Csa summit   seguridad en el sddcCsa summit   seguridad en el sddc
Csa summit seguridad en el sddc
 
The Dawn of Industry 4.0
The Dawn of Industry 4.0The Dawn of Industry 4.0
The Dawn of Industry 4.0
 
Web European Conference 2015 - Welcome Session
Web European Conference 2015 - Welcome SessionWeb European Conference 2015 - Welcome Session
Web European Conference 2015 - Welcome Session
 
So You Want a Threat Intelligence Function (But Were Afraid to Ask)
So You Want a Threat Intelligence Function (But Were Afraid to Ask)So You Want a Threat Intelligence Function (But Were Afraid to Ask)
So You Want a Threat Intelligence Function (But Were Afraid to Ask)
 
Future Perspective: Cloud Connectivity in an IoT World
Future Perspective: Cloud Connectivity in an IoT WorldFuture Perspective: Cloud Connectivity in an IoT World
Future Perspective: Cloud Connectivity in an IoT World
 
A new hope for 2023? What developers must learn next
A new hope for 2023? What developers must learn nextA new hope for 2023? What developers must learn next
A new hope for 2023? What developers must learn next
 
Stay One Step Ahead of Cyber Threats - Check Point
Stay One Step Ahead of Cyber Threats - Check PointStay One Step Ahead of Cyber Threats - Check Point
Stay One Step Ahead of Cyber Threats - Check Point
 
Giants of the web - creadigitalday
Giants of the web - creadigitaldayGiants of the web - creadigitalday
Giants of the web - creadigitalday
 
Why AppSec Matters
Why AppSec MattersWhy AppSec Matters
Why AppSec Matters
 
Invisible Architectures - Supporting Public-Facing Technologies
Invisible Architectures - Supporting Public-Facing TechnologiesInvisible Architectures - Supporting Public-Facing Technologies
Invisible Architectures - Supporting Public-Facing Technologies
 
Cl16 wit io_t
Cl16 wit io_tCl16 wit io_t
Cl16 wit io_t
 

Recently uploaded

Preparing Non - Technical Founders for Engaging a Tech Agency
Preparing Non - Technical Founders for Engaging  a  Tech AgencyPreparing Non - Technical Founders for Engaging  a  Tech Agency
Preparing Non - Technical Founders for Engaging a Tech Agency
ISH Technologies
 
如何办理(hull学位证书)英国赫尔大学毕业证硕士文凭原版一模一样
如何办理(hull学位证书)英国赫尔大学毕业证硕士文凭原版一模一样如何办理(hull学位证书)英国赫尔大学毕业证硕士文凭原版一模一样
如何办理(hull学位证书)英国赫尔大学毕业证硕士文凭原版一模一样
gapen1
 
UI5con 2024 - Bring Your Own Design System
UI5con 2024 - Bring Your Own Design SystemUI5con 2024 - Bring Your Own Design System
UI5con 2024 - Bring Your Own Design System
Peter Muessig
 
Lecture 2 - software testing SE 412.pptx
Lecture 2 - software testing SE 412.pptxLecture 2 - software testing SE 412.pptx
Lecture 2 - software testing SE 412.pptx
TaghreedAltamimi
 
在线购买加拿大英属哥伦比亚大学毕业证本科学位证书原版一模一样
在线购买加拿大英属哥伦比亚大学毕业证本科学位证书原版一模一样在线购买加拿大英属哥伦比亚大学毕业证本科学位证书原版一模一样
在线购买加拿大英属哥伦比亚大学毕业证本科学位证书原版一模一样
mz5nrf0n
 
Oracle Database 19c New Features for DBAs and Developers.pptx
Oracle Database 19c New Features for DBAs and Developers.pptxOracle Database 19c New Features for DBAs and Developers.pptx
Oracle Database 19c New Features for DBAs and Developers.pptx
Remote DBA Services
 
Artificia Intellicence and XPath Extension Functions
Artificia Intellicence and XPath Extension FunctionsArtificia Intellicence and XPath Extension Functions
Artificia Intellicence and XPath Extension Functions
Octavian Nadolu
 
14 th Edition of International conference on computer vision
14 th Edition of International conference on computer vision14 th Edition of International conference on computer vision
14 th Edition of International conference on computer vision
ShulagnaSarkar2
 
Microservice Teams - How the cloud changes the way we work
Microservice Teams - How the cloud changes the way we workMicroservice Teams - How the cloud changes the way we work
Microservice Teams - How the cloud changes the way we work
Sven Peters
 
Using Query Store in Azure PostgreSQL to Understand Query Performance
Using Query Store in Azure PostgreSQL to Understand Query PerformanceUsing Query Store in Azure PostgreSQL to Understand Query Performance
Using Query Store in Azure PostgreSQL to Understand Query Performance
Grant Fritchey
 
Project Management: The Role of Project Dashboards.pdf
Project Management: The Role of Project Dashboards.pdfProject Management: The Role of Project Dashboards.pdf
Project Management: The Role of Project Dashboards.pdf
Karya Keeper
 
UI5con 2024 - Keynote: Latest News about UI5 and it’s Ecosystem
UI5con 2024 - Keynote: Latest News about UI5 and it’s EcosystemUI5con 2024 - Keynote: Latest News about UI5 and it’s Ecosystem
UI5con 2024 - Keynote: Latest News about UI5 and it’s Ecosystem
Peter Muessig
 
What next after learning python programming basics
What next after learning python programming basicsWhat next after learning python programming basics
What next after learning python programming basics
Rakesh Kumar R
 
Measures in SQL (SIGMOD 2024, Santiago, Chile)
Measures in SQL (SIGMOD 2024, Santiago, Chile)Measures in SQL (SIGMOD 2024, Santiago, Chile)
Measures in SQL (SIGMOD 2024, Santiago, Chile)
Julian Hyde
 
Fundamentals of Programming and Language Processors
Fundamentals of Programming and Language ProcessorsFundamentals of Programming and Language Processors
Fundamentals of Programming and Language Processors
Rakesh Kumar R
 
Enums On Steroids - let's look at sealed classes !
Enums On Steroids - let's look at sealed classes !Enums On Steroids - let's look at sealed classes !
Enums On Steroids - let's look at sealed classes !
Marcin Chrost
 
Modelling Up - DDDEurope 2024 - Amsterdam
Modelling Up - DDDEurope 2024 - AmsterdamModelling Up - DDDEurope 2024 - Amsterdam
Modelling Up - DDDEurope 2024 - Amsterdam
Alberto Brandolini
 
fiscal year variant fiscal year variant.
fiscal year variant fiscal year variant.fiscal year variant fiscal year variant.
fiscal year variant fiscal year variant.
AnkitaPandya11
 
一比一原版(UMN毕业证)明尼苏达大学毕业证如何办理
一比一原版(UMN毕业证)明尼苏达大学毕业证如何办理一比一原版(UMN毕业证)明尼苏达大学毕业证如何办理
一比一原版(UMN毕业证)明尼苏达大学毕业证如何办理
dakas1
 
How to write a program in any programming language
How to write a program in any programming languageHow to write a program in any programming language
How to write a program in any programming language
Rakesh Kumar R
 

Recently uploaded (20)

Preparing Non - Technical Founders for Engaging a Tech Agency
Preparing Non - Technical Founders for Engaging  a  Tech AgencyPreparing Non - Technical Founders for Engaging  a  Tech Agency
Preparing Non - Technical Founders for Engaging a Tech Agency
 
如何办理(hull学位证书)英国赫尔大学毕业证硕士文凭原版一模一样
如何办理(hull学位证书)英国赫尔大学毕业证硕士文凭原版一模一样如何办理(hull学位证书)英国赫尔大学毕业证硕士文凭原版一模一样
如何办理(hull学位证书)英国赫尔大学毕业证硕士文凭原版一模一样
 
UI5con 2024 - Bring Your Own Design System
UI5con 2024 - Bring Your Own Design SystemUI5con 2024 - Bring Your Own Design System
UI5con 2024 - Bring Your Own Design System
 
Lecture 2 - software testing SE 412.pptx
Lecture 2 - software testing SE 412.pptxLecture 2 - software testing SE 412.pptx
Lecture 2 - software testing SE 412.pptx
 
在线购买加拿大英属哥伦比亚大学毕业证本科学位证书原版一模一样
在线购买加拿大英属哥伦比亚大学毕业证本科学位证书原版一模一样在线购买加拿大英属哥伦比亚大学毕业证本科学位证书原版一模一样
在线购买加拿大英属哥伦比亚大学毕业证本科学位证书原版一模一样
 
Oracle Database 19c New Features for DBAs and Developers.pptx
Oracle Database 19c New Features for DBAs and Developers.pptxOracle Database 19c New Features for DBAs and Developers.pptx
Oracle Database 19c New Features for DBAs and Developers.pptx
 
Artificia Intellicence and XPath Extension Functions
Artificia Intellicence and XPath Extension FunctionsArtificia Intellicence and XPath Extension Functions
Artificia Intellicence and XPath Extension Functions
 
14 th Edition of International conference on computer vision
14 th Edition of International conference on computer vision14 th Edition of International conference on computer vision
14 th Edition of International conference on computer vision
 
Microservice Teams - How the cloud changes the way we work
Microservice Teams - How the cloud changes the way we workMicroservice Teams - How the cloud changes the way we work
Microservice Teams - How the cloud changes the way we work
 
Using Query Store in Azure PostgreSQL to Understand Query Performance
Using Query Store in Azure PostgreSQL to Understand Query PerformanceUsing Query Store in Azure PostgreSQL to Understand Query Performance
Using Query Store in Azure PostgreSQL to Understand Query Performance
 
Project Management: The Role of Project Dashboards.pdf
Project Management: The Role of Project Dashboards.pdfProject Management: The Role of Project Dashboards.pdf
Project Management: The Role of Project Dashboards.pdf
 
UI5con 2024 - Keynote: Latest News about UI5 and it’s Ecosystem
UI5con 2024 - Keynote: Latest News about UI5 and it’s EcosystemUI5con 2024 - Keynote: Latest News about UI5 and it’s Ecosystem
UI5con 2024 - Keynote: Latest News about UI5 and it’s Ecosystem
 
What next after learning python programming basics
What next after learning python programming basicsWhat next after learning python programming basics
What next after learning python programming basics
 
Measures in SQL (SIGMOD 2024, Santiago, Chile)
Measures in SQL (SIGMOD 2024, Santiago, Chile)Measures in SQL (SIGMOD 2024, Santiago, Chile)
Measures in SQL (SIGMOD 2024, Santiago, Chile)
 
Fundamentals of Programming and Language Processors
Fundamentals of Programming and Language ProcessorsFundamentals of Programming and Language Processors
Fundamentals of Programming and Language Processors
 
Enums On Steroids - let's look at sealed classes !
Enums On Steroids - let's look at sealed classes !Enums On Steroids - let's look at sealed classes !
Enums On Steroids - let's look at sealed classes !
 
Modelling Up - DDDEurope 2024 - Amsterdam
Modelling Up - DDDEurope 2024 - AmsterdamModelling Up - DDDEurope 2024 - Amsterdam
Modelling Up - DDDEurope 2024 - Amsterdam
 
fiscal year variant fiscal year variant.
fiscal year variant fiscal year variant.fiscal year variant fiscal year variant.
fiscal year variant fiscal year variant.
 
一比一原版(UMN毕业证)明尼苏达大学毕业证如何办理
一比一原版(UMN毕业证)明尼苏达大学毕业证如何办理一比一原版(UMN毕业证)明尼苏达大学毕业证如何办理
一比一原版(UMN毕业证)明尼苏达大学毕业证如何办理
 
How to write a program in any programming language
How to write a program in any programming languageHow to write a program in any programming language
How to write a program in any programming language
 

RVASec 2017- Bringing Law and Order to CICD