Security In CI/CD by using Secure DevOps Kit for Azure

1. Security in CI/CD
By
Eng Soon Cheah
Microsoft MVP
@CheahEngSoon

2. Prerequisite
• Microsoft Azure Account (https://aka.ms/azfr/463/free)
• Deploy Project from Azure DevOps Demo Generator to Azure DevOps
Account (https://azuredevopsdemogenerator.azurewebsites.net/)

3. 1. Go to Release.
2. Go to New and Select “+ New release pipeline”

5. Change the stage name to the role
,eg Dev,QA or Production.
For this scenario, using “Dev1”

6. Select “+ Add an artifact”

7. 1. Select “Specify at the time of release creation”
in Default version.
2. Select “Add”.

8. 1. Name your pipelines “AzDevOpsKit_SVT”.
2. Select Dev1 add your Azure Subscription and
App service Name.

9. 1. Select “Run on agent”.
2. Select “Agent Pool” based on your environment.

10. Select Package or Folder of your project.

11. Select your project zip file.

12. Ensure your project zip file is correct path.

13. Select “+” Add a task to Run on agent.

14. 1. Add “Secure DevOps Kit(AzSK) CICD Extensions
for Azure.
2. Add “AzSK Security Verification Tests”.

15. 1. Select your AzureRM Subscription.
2. Select “ResourceGroupName” as Parameter Set.
3. Enter your ResourceGroup Names that you had
created in Azure Portal.
4. Enter your Azure Subscription ID.

16. 1. In Control Options, Check [ / ] Continue on
error.
2. Select “Even if a previous task has failed,unles
the deployment was canceled”.
3. Select “Save”.

17. Select “OK”

18. Select “Create release”.

19. 1. Select “Dev1” stage .
2. Select your Build Version.
3. Select “Create”.

20. Select “Release-1”

21. Select “Not deployed”

22. Select “Deploy”

23. Now the Stages start Queue the task

24. Task In Progress

25. After completed, Select “Partially succeeded”

26. Select the screen and see the results in next slide

27. For more information, please refer
to
https://azsk.azurewebsites.net/03-
Security-In-CICD/Readme.html

28. References
• Secure DevOps Kit for Azure
https://azsk.azurewebsites.net/
• Blog (Azure Security Center)
http://www.techconnect.io/category/azure-security/
• YouTube Channel
https://www.youtube.com/user/cheahengsoon