As software increasingly plays a critical role in how leaders run businesses, we are seeing that organizations want more software produced faster while at the same time protecting themselves against cyber attackers who are finding software a more attractive target to explore. For security professionals, this expanded and more complex threat landscape requires taking on a new defensive approach that is different from the traditional playbook they have been following. For developers, this simply means that their jobs are changing. The need to get software out the door faster has led to a shift to DevSecOps – where software ships quickly and incrementally, and where both teams address security and operational concerns early and often.

1. © 2017 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.1
DEVSECOPS

2. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.2
Who are we?
Tim Jarrett (@tojarrett)
• Over 20 years in software: development,
project management, product management &
strategy
• At Veracode since 2008
• Grammy award winner, Bacon number of 3
Diptesh Shah
• Over 15 years experience as a developer and
engineering leader
• At Veracode since 2017
• Recent Winter Olympics “swept” me into Curling

3. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.3 © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES
Why appsec
integrations?

4. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.4
• Continuous Delivery
• Shorten feedback loops
• Learn quickly
DevSecOps: the end of manual security?

5. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.5
Fix earlier = fix cheaper
0
20
40
60
80
100
120
Design Implementation Testing Maintenance
Source: IBM,based on Boehm, 1981/2001

6. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.6
Avoid rework
Code Ship
Discover
issue
Fix and
ship again
Development process –
current state
Code
Discover
issue
Fix issue Ship
Development process
with integrations

7. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.7
Avoid context switching

8. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.8 © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES

9. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.9
DevSecOps – Follow the Code

10. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.10
Code phase
1
Develop
2
Check in
Team processes
(build, test, agile
planning)

11. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.11
Build phase
1
Get latest check-ins
from source control
2
Build and
Run Tests
Test
Failures
3
Stage/
Deploy

12. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.12
Deploy and Production phase
Deployment
pipeline
Stage/
Deploy
Monitor for
Incidents
Scan for issues
in production

13. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.13
Different development methodologies =
different integration approaches
Waterfall Agile DevOps
1-4 Releases
Per Year
12-24 Releases
Per Year
100+ Releases
Per Year
50+ people 6-12 people 6-12 people

14. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.14
1
Develop
4
Check in
Static
Analysis
3
Build
& Test
2
Backlog (tickets)
Waterfall to agile: “build and test”
Pass?
7
Synchronize
No Yes
6
Static
Analysis
6
Unit
Tests Manual
acceptance
testing, move
to stage,
move to prod
Nightly/
weekly
5
Build
Scheduled
Build
3a
Manual
Testing*

15. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.15
CI
CD
1
Develop
4
Check in
Static
Analysis
3
Build
& Test
2
Backlog
DevOps: Protect the Pipeline
Pass?
7
Synchronize
No Yes
7
Deploy to
QA/Stage
6
Static
Analysis
6
Unit
Tests
8
Dynamic
Analysis
8
Regression
Testing
Pass?
Yes
Stage
then
Prod
Per
Check-in
5
Build
CI/CD
Pipeline
1a
Static
Analysis

16. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.16 © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES

17. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.17
Veracode Integrations Team
Focused on delivering integration capabilities with the Veracode platform
that enable development teams to “shift security left” and make the idea
of “DevSecOps” a reality.
• 12 person team; geographically distributed
• Responsible for 20+ applications & supporting modules
• 75 releases in 2017 (on pace for 144 releases in 2018)
• SAFe / Agile Scrum
• DevSecOps (evolution continues)
• Vested interest in achieving our mission!!

18. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.18
In The Beginning
3
Build
4
Static
Analysis
5
Security
Results
2
Check in
1
Develop
Backlog
Scheduled
Build
Nightly/
weekly

19. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.19
Initially Fast Forward to Now
Empower Developers – IDE Integration
1
Develop
4
Check in
Sandbox
Static Analysis
3
Build
& Test
2
1
Develop
4
Check in
Sandbox
Static Analysis
3
Build
& Test
2
1a
Greenlight
Static Analysis

20. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.20
1
Develop
4
Check in
Sandbox
Static Analysis
3
Build
& Test
2
Automated Assessment – Build Server Integration
6
Static
Analysis
Nightly/
weekly
5
Build
Scheduled
Build
1a
Greenlight
Static Analysis
Security
Results
7

21. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.21
1
Develop
4
Check in
Sandbox
Static Analysis
3
Build
& Test
2
Automated Issue Tracking
Nightly/
weekly
Scheduled
Build
1a
Greenlight
Static Analysis
6
Static
Analysis
5
Build
7
Synchronize

22. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.22
1
Develop
4
Check in
Sandbox
Static Analysis
3
Build
& Test
2
Automated Assurance – Fail the Build
Pass?
7
Synchronize
No Yes
6
Static
Analysis
6
Unit
Tests Manual
acceptance
testing, move to
stage, move to
prod
Nightly/
weekly
5
Build
Scheduled
Build
1a
Greenlight
Static Analysis

23. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.23
CI
CD
1
Develop
4
Check in
Sandbox
Static Analysis
3
Build
& Test
2
Continued Assurance
Pass?
7
Synchronize
No Yes
7
Deploy to
QA/Stage
6
Static
Analysis
6
Unit
Tests
Per
Check-in
5
Build
CI/CD
Pipeline
1a
Greenlight
Static Analysis
Manual
acceptance
testing, move to
stage, move to
prod

24. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.24
CI
CD
1
Develop
4
Check in
Sandbox
Static Analysis
3
Build
& Test
2
Continued Assurance – End Goal
Pass?
7
Synchronize
No Yes
7
Deploy to
QA/Stage
6
Static
Analysis
6
Unit
Tests
8
Dynamic
Analysis
8
Regression
Testing
Pass?
Yes
Stage
then
Prod
Per
Check-in
5
Build
CI/CD
Pipeline
1a
Greenlight
Static Analysis

25. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.25 © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES
Making it
happen

26. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.26
Relationships
• Who is your peer in
development / security?
• Do you meet with them?
• Do you understand each
others’ goals?
• Are you sympathetic to
each others struggles?

27. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.27
Accountability
• Shared between
development and security
• Part of annual goals
for both teams
• Measured and
reported regularly

28. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.28
Plan Code Build Test Stage Deploy Monitor
Shift Left & Monitor
Dynamic Application Security Testing
Runtime Application
Self Protection
Open Source Risk MonitoringStatic Application Security Testing + 3rd Party Risk Analysis
Training
(eLearning, instructor led, metadata driven)
Manual Penetration Testing
Red Team Activities
Remediation and Mitigation Guidance
Secure Code Reviews
Threat Modeling
Security Grooming
Secure Design

29. © 2017 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.29 © 2017 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.
Questions?
@tojarrett