Securing Your Deployment Pipeline With Docker

Securing your
Deployment
Pipeline
Strategy & Tech Talk - April 19, 2016
Maximilian Schöfmann | @schoefmann
Container Solutions Switzerland

www.container-solutions.com | info@container-solutions.com
B.C. (Before Continuous Integration)

B.C. (Before Continuous Integration)
homo abap-cobolus integrating software modules, ca. 200000 B.C

A.D. - but Pre-DevOps (CI only)

DevOps (present time)

DevOps + Continuous Delivery + PaaS

… and Security

Avg: 103 days to ﬁx a vulnerability
http://darkmatters.norsecorp.com/2015/06/09/security-vulnerabilities-take-average-of-103-days-to-remediate/

CD improves reaction time!

So we need to:

…with better tooling!

Stages of a delivery pipeline
Commit Integration Acceptance Release

unit tests

unit tests service tests

unit tests service tests UI tests

unit tests service tests UI tests (exploratory tests)

Test pyramid
Unit Tests
Service Tests
UI tests
fasterfeedback
confidence
coverage

“AppSec Pipeline”

static code 
analysis

static code 
analysis
vulnerability
scanning

static code 
analysis
vulnerability
scanning
end-to-end
security tests

static code 
analysis
vulnerability
scanning
end-to-end
security tests
(penetration
tests)

AppSec pyramid?
static code analysis
vulnerability
scanning
E2E
security tests
fasterfeedback
confidence
coverage

Challenge: False Positives
• maintain exception/fine tuning config for scanner
• run with sensitive heuristics nightly, then update config
• or branch to manual stage to check false positives

Static analysis
• SonarQube (multiple languages)
• Brakeman (Ruby/Rails)
• OWASP WAP (PHP)
• FindBugs (Java)
• FlawFinder (C/C++)
• … (many commercial, e.g. CHECKMARX)

Vulnerability scanners (many commercial)
• OWASP Zed Attack Proxy (ZAP)
• Burp suite
• Acunetix
• Nessus, OpenVAS
• Nikto
• w3af
• … (lots and lots more)

End to end security tests
• Standard tools like Selenium work well
• BDD-Security if you fancy text or want to integrate PO
friendly E2E tests with vulnerability scans
continuumsecurity.net/bdd-intro.html

more…
owasp.org/index.php/Appendix_A:_Testing_Tools

But…
• Too many!
• Too different!
• Too complex!
• Stuff to install (lots!)
• Stuff to conﬁgure…

And what about…

If we just had a way to package those tools uniformly…

Demo: Static analysis

If we just had an easy way to connect scanners to apps…

Demo: Vulnerability scanners

If there was just a way to scale those tests…

maximilian.schoefmann@container-solutions.com | @schoefmann 
 
container-solutions.com

Securing Your Deployment Pipeline With Docker

More Related Content

What's hot

Similar to Securing Your Deployment Pipeline With Docker

Recently uploaded

Securing Your Deployment Pipeline With Docker