Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Safely Removing the Last Roadblock to Continuous Delivery
Similar to Safely Removing the Last Roadblock to Continuous Delivery (20)
More from SeniorStoryteller
More from SeniorStoryteller (20)
Recently uploaded
Recently uploaded (20)
Safely Removing the Last Roadblock to Continuous Delivery
- 1. 1 Intuit Confidential and Proprietary1 Safely Removing the Last Roadblock to Continuous Delivery Shannon Lietz Director DevSecOps, Intuit @devsecops
- 2. 2 Thanks to Henrik Kniberg When will you solve my problem?!! Can we discuss my feedback? (Uh - seatbelts?) A Traditional Supply Chain
- 3. 3 Thanks to Henrik Kniberg Awesome!When can I bring my kids with me? Does it come in Red? Can this be motorized to go faster and for longer trips? Better than walking, for sure… but not by much... A Customer Centric Supply Chain Shifting left solves problems faster…
- 4. 4 Google Trends • Several years after the Agile Manifesto, DevOps.com was registered (2004) • Google searches for “DevOps” started to rise in 2010 • Major influences: – Saving your Infrastructure from DevOps / Chicago Tribune – DevOps: A Culture Shift, Not a Technology / Information Week – DevOps: A Sharder’s Tale from Etsy – DevOps.com articles • RuggedSoftware.org was registered in 2010 https://www.google.com/trends/
- 5. 5 Business strategy is achieved with the collaboration of all departments and providers in service to the customer who requires better, faster, cheaper, secure products and services. What’s the Business benefit?
- 6. 6 1. Manual processes & meeting culture 2. Point in time assessments 3. Friction for friction’s sake 4. Contextual misunderstandings 5. Decisions being made outside of value creation 6. Late constraints and requirements 7. Big commitments, big teams, and big failures 8. Fear of failure, lack of learning 9. Lack of inspiration 10. Management and political interference (approvals, exceptions) ... So what hinders “secure” innovation @ speed & scale?
- 7. 7 7
- 8. 8 Traditional Security Security is Everyone’s Responsibility DEVSECOPS It’s time to Culture Hack…
- 9. 9 OPS SEC DEV AppSec How do we get started?
- 10. 10 Secure Software Supply Chain 1. Gating processes are not Deming-like 2. Security is a design constraint 3. Decisions made by engineering teams 4. It’s hard to avoid business catastrophes by applying one-size-fits-all strategies 5. Security defects is more like a security “recall” design build deploy operate How do I secure my app? What component is secure enough? How do I secure secrets for the app? Is my app getting attacked? How? Typical gates for security checks & balances Mistakes and drift often happen after design and build phases that result in weaknesses and potentially exploits Most costly mistakes Happen during design Faster security feedback loop
- 11. 11 Staffing Models Typical Traditional Supply Chain Ratio DevOps Staffing
- 12. 12 • Everyone knows Maslow… • If you can remember 5 things, remember these -> “Apps & data are as safe as where you put it, what’s in it, how you inspect it, who talks to it, and how its protected…” Simplifying Security for the Masses
- 13. 13 Reasonable Security was recently defined for California within the 2016 California Data Breach Report. “The 20 controls in the Center for Internet Security’s Critical Security Controls identify a minimum level of information security that all organizations that collect or maintain personal information should meet. The failure to implement all the Controls that apply to an organization’s environment constitutes a lack of reasonable security.” Why Governance?
- 14. 14 Migrating Security to the Left… design build deploy operate How do I secure my app? What component is secure enough? How do I secure secrets for the app? Is my app getting attacked? How? Typical gates for security checks & balances Mistakes and drift often happen after design and build phases that result in weaknesses and potentially exploits Most costly mistakes Happen during design Faster security feedback loop Security is a Design Constraint
- 15. 15 Monitor & Inspect Everything insights security sciencesecurity tools & data Cloud accounts S3 Glacier EC2 CloudTrail ingestion threat intel security feedback loop continuous response operate
- 16. 16 deploy Safe Continuous Deployment CloudProviderNetwork Backbone Backbone Cloud Platform (Orchestration) Network Compute Storage Internet CloudAccount(s) Load Balancers Compute Instances VPCs Block Storage Object Storage Relational Databases NoSQL Databases Containers Content Acceleration Messaging Email Utilities Key Management API/Templates Certificate Management Partner Platform Deployment Bundles In S3 Artifacts In Nexus/S3 safe deployment process secured accounts & services
- 17. 17 build Fanatical Security Testing dynamic run-timestatic UX & Interfaces Micro Services Web Services Code CFn Templates Build Artifacts Deployment Packages Resources Patterns & Baselines Security Groups Account Configuration Real-Time Updates Patterns & Baselines
- 18. 18 design Secure Baselines & Patterns templates resourcespatterns services AMI Amazon Elastic MapReduce AWS Import/ Export Security Monitoring Egress Proxy CFn Template Bastion CFn Template Secure VPC CFn Template CloudTrail CFn Template Secrets Bundle MarketPlace
- 19. 19 What’s this look like in practice?
- 20. 20 Red Team, Security Operations & Science API KEY EXPOSURE -> 8 HRS DEFAULT CONFIGS -> 24 HRS SECURITY GROUPS -> 24 HRS ESCALATION OF PRIVS -> 5 D KNOWN VULN -> 8 HRS
- 21. 21 Compliance Operations as Continuous Improvement https://www.kpmg.com/BE/en/IssuesAndInsights/ArticlesPublications/Documents/Transforming-Internal-Audit.pdf
- 23. 23 This could be your MTTR… MTTR Days… 6 months
- 24. 24 Get Involved and Join the Community • devsecops.org • @devsecops on Twitter • DevSecOps on LinkedIn • DevSecOps on Github • RuggedSoftware.org • Compliance at Velocity
Editor's Notes
- Prepare the environment in the right order and ensure inspections pass before making traffic available.
- What you test and how you test also make a big difference. Code can have immediate issues and mistakes that become costly later.
- The parts you consider using during design make a big difference. … When something isn’t secure by default it can have a profound effect on operations. As an example…