The document discusses the integration of security within DevOps, termed 'SecDevOps,' emphasizing collaboration and automation to enhance security measures across the development cycle. It outlines practices such as continuous compliance monitoring, automated testing, and stakeholder involvement to reduce silos and improve overall security posture. Practical examples illustrate how organizations can leverage DevOps momentum to incorporate security more effectively into their processes.

1. SecDevOps: The New Black of IT
Andrew Storms
CloudPassage
Director of DevOps
Alan Shimmel
DevOps.com
CEO & Co-founder

2. 1994 1995 2009

3. Cloud or Not – Still the Same
• Infrastructure
• Data & Storage
• Identity & Access Controls
• Privacy
• Governance
• Audit & Compliance
3

4. Infrastructure as code
Instrumentation
What about DevOps?
Orchestration
Continuous everything

5. about
security
DevOps?
What
with

6. DevOps & Security Division
6
This is NOT how we do DevOps at CloudPassage.
Collaboration Division
DevOps Security
Plan Code Test Release Deploy Operate

7. SecDevOps
• Less division
– More collaboration
• Less silos
– More sharing
• Less pipeline
– More chains & links
• Less manual
– More automation
7
Security
Plan
Release
Code
Test
Operate
Deploy

8. Plan
• Release Sherpa
– Ops, Dev, QA
– See a release thru from start to finish
• Change risk management
– What infrastructure changes?
– Unexpected or large code changes?
– Security risk assessment
– Threat vector analysis
Security
Plan
Release
Code
Test
Operate
Deploy

9. Code
• Standards enforcement
– Rubocop, Food Critic, Knife-Spork
• Review Process
– Peer & code review
– Continuous application & infrastructure testing
• Git feature branching
– Change control & isolation
Security
Plan
Release
Code
Test
Operate
Deploy

10. Test
• Automated code testing
– Over 10k tests run automatically
at check in
– Over 10k QA assertions
– Over 130 smoke test suites
• All the modules & third party integrations
• Deploy verifications
• External automated testing
• External code review
Security
Plan
Release
Code
Test
Operate
Deploy

11. Release & Deploy
• Stakeholders approval
• Standardized tools
– Capistrano, Chef
• Deploy testing
– 2-man rule
• System segregation
– Only Ops has production access
Security
Plan
Release
Code
Test
Operate
Deploy

12. • Continuous compliance monitoring
– All systems (prod & non-prod)
– Hourly & daily
– Halo
• Infrastructure security orchestration
– Thousands of control/change points enforced hourly (Chef)
– Validated by Halo
• Continuous risk assessment
– Third-party vulnerability testing of all systems
Operate
Security
Plan
Release
Code
Test
Operate
Deploy

13. JIRAgitChefCapistranoHalo
Initiate Approve
Implement
Audit
Records
Deploy
(Infrastructure)
Audit
Records
Deploy
(App Code)
Audit
Records
Audit
Records
Update
Baselines
Continuous
Monitoring
Audit
Records
End to end audit trail, built into the agile process…
“AGILE ASSURANCE”

14. Practical SecDevOps Examples
• Security automation potential
– Cloud APIs have exploded
• Latch on to DevOps momentum
– Take advantage of change
– Make Dev and Ops security stakeholders
• Use IFTTT thinking
– Channels, Triggers, Actions, Ingredients
 Recipes
14

15. Practical SecDevOps Automation
15

16. Practical SecDevOps Automation
16
git-push

17. Practical SecDevOps Automation
17

18. Practical SecDevOps Automation
18

19. SecDevOps in Summary
19
Old is new
Still solving the same problems,
but in new ways
SecDevOps
Automation
DevOps is here
SecDevOps is required
Security automation is here
And is required in the cloud

20. More Resources
20
Explore: www.DevOps.com
Learn: blog.cloudpassage.com
Start: www.cloudpassage.com/halo

21. Thank you!
21
Q&A