Zane Lackey and Andrew Becherer at DevOps Connect: Rugged DevOps during RSA Conference 2016

1. Silver Linings for Miles:
DevOps for Building Secure
Solutions
zane@signalsciences.com
@zanelackey
apb@datadoghq.com
@andrewbecherer

2. Who are these guys anyway?
• Zane built and led the Etsy Security Team
(spoiler alert: much of what this presentation
is about) and co-founded Signal Sciences
• Andrew ran a large application security
consulting practice for iSEC/NCC Group and
is now leading the Datadog Security Team
(spoiler alert: also much of what this
presentation is about)

3. This talk is about lessons learned being at
the forefront of the shift to agile/continuous
deployment/DevOps

4. For security teams, the world has changed
in three fundamental ways:
– Agility means code deployment is trending to
near-instantaneous
– Security is no longer the gatekeeper to
deployment
– If security is a blocker, it will be routed around

5. Near-instantaneous deployment?

6. A simulation of deploying code in the waterfall model

7. What is this shifting to?

8. An agility example: Etsy pushes to
production 50 times a day on average

9. Constant iteration in production via feature
flags, ramp ups, A/B testing

10. But doesn’t the
rapid rate of
change mean
things are less
secure?!

11. Actually, the opposite is
true

12. They key to realize is vulnerabilities occur in
all development methodologies
…But there’s no such thing as an out-of-
band patch in continuous deployment

13. They key to realize is vulnerabilities occur in
all development methodologies
…But there’s no such thing as an out-of-
band patch in continuous deployment

14. Compared to:
“We’ll rush that security fix. It will go out …
in about 6 weeks.”
- Former vendor at Etsy

15. What makes continuous deployment safe?

16. What makes continuous deployment safe?
Visibility

18. Source: http://www.slideshare.net/mikebrittain/advanced-topics-in-continuous-deployment

19. The same hard lessons are slowly shifting to
security

20. Ex: Which of these is a quicker way to spot
an attack?

23. Increase agility by surfacing security visibility
for everyone, not just the security team

24. Having to talk to security to get security
awareness causes delays

25. Having to talk to security to get security
awareness causes delays
Delays get routed around

26. To embrace agility, security has to
decentralize

27. Without strong gating we
never get security eyes
on code

28. Did you ever really, I
mean really, have
security eyes on code?

29. Let’s do better.
…But there’s no such thing as an out-of-
band patch in continuous deployment

30. “Communities of practice are groups of people
who share a concern, a set of problems, or a
passion about a topic, and who deepen their
knowledge and expertise in this area by
interacting on an ongoing basis.“
…But there’s no such thing as an out-of-band
patch in continuous deployment

31. Design for “aliveness.”

32. Challenge: Maintain
informality while building
trust across time-zones.

33. Can we measure it?
…But there’s no such thing as an out-of-
band patch in continuous deployment

34. Pro-move: Link your local
practices to global
practices to build
Extended Knowledge
Systems.

35. In closing, remember…

37. Lessons Learned:
– Embracing DevOps/Agile/Continuous
Deployment helps not harms security
– Visibility is the key to moving quickly and
safely
– You (in the general case) are never going to
be able to hire enough staff, so steal everyone
else’s

38. Thank you!
zane@signalsciences.com @zanelackey
apb@datadoghq.com @andrewbecherer