A session by Thomas R. Truitt, President, Open Systems Technologies Corporation on the topic of 'Software Security For DevOps And Continuous Deployment In The Cloud' at InterCon USA 2019, held at Caesars Palace, Las Vegas on 18-20 June, 2019.

1. InterCon Vegas 2019
InterCon Vegas 2019
KEYNOTE SESSION IV:
SOFTWARE SECURITY FOR DEVOPS AND
CONTINUOUS DEPLOYMENT IN THE CLOUD
SPEAKER: THOMAS R. TRUITT
FOUNDER/PRESIDENT/CEO
19 JUNE 2019

2. 2
InterCon Vegas 2019
InterCon Vegas 2019
Background of Speaker
• Involved in Systems / Software Development for Large Scale
Systems Since 1990
• Educated as Electrical Engineer at Virginia Tech in Blacksburg,
Virginia. Studied Digital Signal Processing at Johns Hopkins
University in Laurel, Maryland.
• Works with large government and Fortune 500 organizations
on building Enterprise Level software development “best-
practices” to promote the use of Open Source software
• Most recent focus is migrating from on-premise to cloud
solutions using public/private clouds such as AWS, Azure,
Google, and RedHat/OpenShift Container Platform

3. 3
InterCon Vegas 2019
InterCon Vegas 2019
History of Security in Software Development
• Coding 101 Security and the emergence of open
source security standards
• For more information review (OWASP) at
https://www.owasp.org/

4. 4
InterCon Vegas 2019
InterCon Vegas 2019
The Need for Software Security
• Insider and External Threats
• Authentication [Basic, Federation, Multi-Factor,
Bio-Security]
• Authorization [Attribute Based Access Control
(ABAC), Role Based Access Control (RBAC)]

5. 5
InterCon Vegas 2019
InterCon Vegas 2019
Security Breach Examples
• Breach From Internet:
– Office of Personnel Management (OPM) Security Breach
Affecting Millions
• Insider Security Breach:
– Federal Bureau of Investigation (FBI) - Robert Hanssen
– America Online Insider Threat
• Visit List of Breaches at:
https://en.wikipedia.org/wiki/List_of_data_breaches

6. 6
InterCon Vegas 2019
InterCon Vegas 2019
Security – In the Beginning
• On-Premise Security
– Agile
– Open Source
– Patching
– Log Monitoring/Analysis, SIEM Tools
– Application Performance Management (APM)
– Network Device Monitoring
– Release/Build Process
– Continuous Integration

7. 7
InterCon Vegas 2019
InterCon Vegas 2019
Security – Today and Beyond
• Continuous Deployment/Continuous Integration
– DevOps, DevSecOps
• Modern Software Tools
– Maven,
– GIT,
– Atlassian Suite,
– Jenkins,
– Code Quality,
– Puppet,
– Chef
• Security Standards (FedRAMP, FISMA, FIPS, PKI)

8. 8
InterCon Vegas 2019
InterCon Vegas 2019
Challenges In the Cloud
• Cross Domain Security
• Single-Sign-On
• Continuous Software Updates

9. 9
InterCon Vegas 2019
InterCon Vegas 2019
Looking Forward: Cloud Computing Security
• Cloud Computing to be more Security Provider
Agnostic regardless of Cloud Server Provider
• Example of Moving Security to the Cloud Edge with
Akamai

10. 10
InterCon Vegas 2019
InterCon Vegas 2019
Question and Answers
• Speaker Contact Information
– Thomas R. Truitt
– 301-305-3116 cell
– tom@ostcorp.net
– http://www.ostcorp.net