Download as PDF, PPTX
Uploaded bySonatype
Static Analysis For Security and DevOps Happiness w/ Justin Collins
The document discusses the integration of static analysis security tools, specifically Brakeman, within the DevSecOps framework to enhance code security during development. It emphasizes the need for developers to take responsibility for secure coding practices and provides insights on the automation of security tools for early feedback. Various strategies for incorporating security measures into the development workflow are outlined, highlighting the benefits of source code analysis for continuous integration and deployment processes.
More Related Content
![[DevSecOps Live] DevSecOps: Challenges and Opportunities](https://cdn.slidesharecdn.com/ss_thumbnails/20200316dsochallengesopportunities-200416111818-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to Static Analysis For Security and DevOps Happiness w/ Justin Collins
Static Analysis For Security and DevOps Happiness w/ Justin Collins
- 4.
- 5. @presidentbeef Obligatory “About Me” 6years of application security (AT&T Interactive, Twitter, SurveyMonkey) 6 years working on Brakeman OSS (Static analysis security tool for Rails) 2.5 years working on (More pro static analysis security tool for Rails)
- 6. @presidentbeef The Ratio ofDoom 100 : 10 : 1 Dev Ops Sec Shannon Lietz http://www.slideshare.net/SeniorStoryteller/the-journey-to-devsecops
- 7. @presidentbeef The Ratio ofDoom 100 developers - experts on their slice of the code 1 security person - responsible for ALL code + systems
- 8.
- 10. @presidentbeef DevOps Developers as responsiblefor stable code as ops team is DevSecOps Developers as responsible for secure code as security team is
- 11.
- 12. @presidentbeef Security Tools inDevOps Land Automation friendly Fast Consistent Provide early feedback for developers
- 14.
- 15.
- 17. @presidentbeef Automation Friendly Input: SourceCode Output: Report
- 18.
- 19.
- 20. @presidentbeef Fast (Especially in comparisonto “web scanners”)
- 21. @presidentbeef Project Controllers ModelsTemplates Scan Time Diaspora 48 54 44 5s Discourse 78 162 57 15s Redmine 50 86 342 24s GitlabHQ 150 123 707 61s Canvas LMS 176 384 455 161s Brakeman Scan Times Brakeman 3.4.1, Ruby 2.3.1p112
- 22. @presidentbeef Consistent (Especially in comparisonto “web scanners”)
- 23. @presidentbeef Consistent Baseline scan ->Incremental results
- 24.
- 25. @presidentbeef Early Feedback (forDevelopers) “Amplify feedback loops”
- 26. @presidentbeef “Shift Left” Write Code Unit Tests Commit Code Push to CI Code Review QA Tests Deploy!Plan/ Reqs In Production Security?
- 27. @presidentbeef “Shift Left” Write Code Unit Tests Commit Code Push to CI Code Review QA Tests Deploy!Plan/ Reqs In Production Security!
- 28. @presidentbeef Source Code Analysis Write Code Unit Tests Commit Code Pushto CI Code Review QA Tests Deploy!Plan / Reqs In Production Security! Kind of Late but Possible
- 29. @presidentbeef Source Code Analysis Write Code Unit Tests Commit Code Pushto CI Code Review QA Tests Deploy!Plan / Reqs In Production Security! Deployment Gate
- 30. @presidentbeef Source Code Analysis Write Code Unit Tests Commit Code Pushto CI Code Review QA Tests Deploy!Plan / Reqs In Production Security! QA? Why not?
- 31. @presidentbeef Source Code Analysis Write Code Unit Tests Commit Code Pushto CI Code Review QA Tests Deploy!Plan / Reqs In Production Security! Manual Scans
- 32. @presidentbeef Source Code Analysis Write Code Unit Tests Commit Code Pushto CI Code Review QA Tests Deploy!Plan / Reqs In Production Security! New Warnings Fail Build
- 33. @presidentbeef Source Code Analysis Write Code Unit Tests Commit Code Pushto CI Code Review QA Tests Deploy!Plan / Reqs In Production Security! Commit Hooks
- 34. @presidentbeef Source Code Analysis Write Code Unit Tests Commit Code Pushto CI Code Review QA Tests Deploy!Plan / Reqs In Production Security! Run in Tests
- 35. @presidentbeef Source Code Analysis Write Code Unit Tests Commit Code Pushto CI Code Review QA Tests Deploy!Plan / Reqs In Production Security! Run in IDE / On Save
- 36. @presidentbeef Early Feedback Few dependenciesmakes integration easy Fast tools can be “in line” with workflow Incremental results relevant to changes
- 37.
- 38.
- 39.
- 40.
- 41.
- 42.
- 43.
- 44. @presidentbeef require "brakeman/test/minitest" class TestBrakemanWarnings< Minitest::Test def test_no_brakeman_warnings assert_no_brakeman_warnings end end (Brakeman Pro only)
- 45. @presidentbeef Types of StaticAnalysis Tools Security - Vulnerabilities Composition - Old/vulnerable dependencies Quality - Complexity Style
- 46.
- 47.
- 48. @presidentbeef In Conclusion Source codeanalysis fits well with DevOps Enables security review inside workflow Provides feedback early in development Multiple options for integration points
- 49. @presidentbeef Thank You @presidentbeef /presidentbeef.com