Download as PDF, PPTX
Uploaded byJohn Willis
swampUP - 2018 - The Divine and Felonious Nature of Cyber Security
The document discusses the divine and felonious nature of cyber security and introduces the concept of DevSecOps. It notes that traditional perimeter-based security is no longer sufficient given changes in applications and infrastructure. DevSecOps integrates security practices like training, requirements, threat modeling directly into the development pipeline from the beginning. This helps automate security testing and monitoring throughout the software development lifecycle and supply chain. When done right, DevSecOps helps create a "new Goldilocks zone" where security is no longer a bottleneck to rapid software development and deployment.
More Related Content
Similar to swampUP - 2018 - The Divine and Felonious Nature of Cyber Security
swampUP - 2018 - The Divine and Felonious Nature of Cyber Security
- 1. The Divine andFelonious Nature of Cyber Security ( Introduction to DevSecOps ) John Willis @botchagalupe
- 2.
- 4. The Felonious Nature of Cyber Security
- 5.
- 6. • 1.5M JavaModules Per Week • 5M Node Modules Per Week • 31B Modules Per Year • 230k Modules Per Enterprise/Per Year • 8% Have Known Vulnerabilities • 8M Average Cost to Remediate a Breach By The Numbers modulecounts.com and 2017 Software Supply Chain Report
- 7.
- 9. Actual Exploitation 2015VZ DBIR
- 10. • Discovered 3/6/2017 •Announced 3/9/2017 • CVE created 3/10/2017 • Equifax Oracle Patches 4/2017 • Equifax Patches 6/30/2017 • Equifax discovers 7/29/2017 • Equifax announced 9/2017 Anatomy of CVE-2017-5638
- 12. • Discovered -3/9/2017 • Action - 3/10/2017 • Remediation - 3/14/2017 Anatomy of CVE-2017-5638 @botchagalupe
- 13. Anatomy of CVE-2017-8046 (FoolMe Once) • Published 9/21/17 • CVE created 01/04/2018 • Discovered 2/18/17 • Corrected 3/6/18 @botchagalupe
- 14. Security and theGoldilocks Zone • The fallacious nature of cyber security relates to the standard legacy security model specifically on the idea of perimeter security. • This concept involves the implementation of a state-full firewall at a routed point within the network that very rarely gets looked at unless an operational change is required. • The problem with having only premier security is that applications have changed significantly in the last ten years and the infrastructure they run upon is playing by the same old rules.
- 15.
- 16.
- 17. • CAMS • Culture •Automation • Measurement • Sharing Devops Taxonomies • The Three Ways •The First Way •The Second Way •The Third Way
- 19. Devops Automated DeploymentPipeline Source: Wikipedia - Continuous Delivery @botchagalupe
- 20. Devops Automated DeploymentPipeline @botchagalupe
- 21. 21 Summary • Agile tookus from months to days to deliver software • Devops took from months to days to deploy software • Now security is the bottleneck @botchagalupe
- 22.
- 23. You Build It,You Secure It @botchagalupe
- 25. DevSecOps as SupplyChain? 25 Source: Wikipedia - Continuous Delivery @botchagalupe
- 26. Software Supply Chain 26 Delivery Team Version Control BuildTest Release DevOps Example Stage Prod @botchagalupe
- 27. Software Supply Chain 27 Delivery Team Version Control BuildTest Release DevOps Example Stage Prod @botchagalupe
- 28. Security in theSoftware Supply Chain 28 Delivery Team Version Control Build Test Release DevOps Example Delivery Team Version Control Build Test Release DevOps and Security Stage Prod @botchagalupe
- 29. Security in theSoftware Supply Chain 29 Delivery Team Version Control Build Test Release DevOps Example Delivery Team Version Control Build Test Release DevSecOps Example Stage Prod @botchagalupe
- 30. 30 Delivery Team Version Control Build Test Release DevSecOpsSupply Chain Stage Prod The New Goldilocks Zone (DevSecOps) Security Training Security Requirements Threat Modeling Architecture Review OWASP Top 10 IDE Plugins Code Examples Fail the Build SAST/DAST/IAST Configuration Analysis Application Module Scanning Threat Modeling as Unit Test Automated Pen Testing Static Code Analysis Security Policy Testing Configuration Analysis Security Monitoring Configuration Monitoring
- 31. Best Practices forDevSecOps • Train development teams to develop secure code • Track security issues the same as software issues • Security as code, Security Built In. • Integrate security controls in the software pipeline • Automate security test in the build process • Detect known vulnerabilities during the pipeline • Monitor security in production for known states • Inject failure to ensure security is hardened Gene Kim, Jez Humble, Patrick Dubois, and John Willis. The DevOps Handbook; It Revolution Press, LLC.;2016.@botchagalupe
- 32. Knowing Adversities andMotivations
- 33. Knowing Adversities andMotivations
- 35.
- 36.
- 37. The Felonious Natureof Cyber Security @botchagalupe