SlideShare a Scribd company logo
Taking AppSec to 11
AppSec Pipelines, DevOps,
and Making Things Better.
BSidess Austin 2016
Matt Tesauro, Infinitiv
Taking AppSec to 11 - BSides Austin 2016
Assembly Lines
Taking AppSec to 11 - BSides Austin 2016
The Phoenix
Project
3 Ways of DevOps
Strategies for
Improving Operations
#1 - Workflow
Look at your purpose
and those processes
which aid it
Timeline
Business Operations Customer
Flow [rate] – the speed work goes through the process
Development
#1 Workflow
First of the three ways
- Each Step Repeatable
- Never Pass on Defects
- Local optimizations with a global view
AppSec Pipelines
Figuring out your workflow
Taking AppSec to 11 - BSides Austin 2016
AppSec Pipelines
Taking AppSec to 11 - BSides Austin 2016
Key Features of
AppSec Pipelines
◇ Designed for iterative improvement
◇ Provides a reusable path for AppSec activities to
follow
◇ Provides a consistent process for both the team and
our constituency
◇ One way flow with well-defined states
◇ Relies heavily on automation
◇ Grow in functionality organically over time
◇ Gracefully interconnects with the development
process
Pearson AppSec Pipeline
Integrating into the DevOps Pipeline
DevOps Pipeline AppSec Pipeline
“
Spending time
optimizing anything
other than the critical
resource is an illusion.
W. Edwards Deming
Key Goals of
AppSec Pipelines
◇ Optimize the critical resource - AppSec personnel
■ Automate all the things that don’t require a
human brain
■ Drive up consistency
■ Increase tracking of work status
■ Increase flow through the system
■ Increase visibility and metrics
■ Reduce any dev team friction with application
security
Pipeline - Intake
◇ “First Impression”
◇ Major categories of Intake
■ Existing App
■ New App
■ Previously tested App
■ App to re-test findings
◇ Key Concepts
■ Ask for data about Apps only once
■ Have data reviewed when an App
returns
■ Adapt data collected based on broad
categories of Apps
Pipeline - Testing
◇ Inbound request triage
◇ Ala Carte App Sec
■ Dynamic Testing
■ Static Testing
■ Re-Testing mitigated findings
■ Mix and match based on risk
◇ Key Concepts
■ Activities can be run in
parallel
■ Automation on setup,
configuration, data export
◇ People focus on customization
rather than setup
Pipeline - Testing
◇ Results from your CI/CD could flow into Threadfix from
build Pipeline
◇ Gauntlt runs results could also flow into the AppSec
Pipeline
◇ Choose the tools that make sense for you organization
Pipeline - Deliver
◇ Source of truth for all AppSec
activities
◇ ThreadFix is used to
■ Dedup / Consolidate findings
■ Normalize scanner data
■ Generate Metrics
■ Push issues to bug trackers
◇ Report and metrics automation
■ REST + tfclient
◇ Source of many touch points with
external teams
◇ Allow us to have visibility into WIP
◇ Better understand/track/optimize flow of
engagements
◇ Average static test takes ...
◇ Great increase in consistency
◇ Easier re-allocation of engagements between staff
◇ Each step has a well defined interface
◇ Knowing who has what allows for more informed
“cost of switching” conversations
◇ Flexible enough for a range of skills and
app maturity
Why we like AppSec
Pipelines
~5x increase
2014
44 assessments
2015
~200 assessments
Changes from 2014 to 2015:
- Created the AppSec Pipeline - initial launch in March 2015
- AppSec team numbers dropped - lost a couple of key people approx 3.5 FTEs
- Two of the AppSec team members went meta for most of 2015
Bag of Holding
aka BoH
github.com/PearsonEducation/bag-of-holding
◇ Manages the Application Security Program
◇ Application Repository
◇ Engagement Tracking
◇ Report Repository
◇ Comments on any application, engagement or activity
◇ Data Classification and PII data
◇ Time taken on secure software activities
◇ Historical knowledge of past assessments
◇ Credential repository
◇ Environment details
What does BoH do?
Scheduling of Secure
Software Activities
Application Repository
Application Security Profile
Defect Dojo
◇ DefectDojo is a tool created by the Security
Engineering team at Rackspace to track testing
efforts.
◇ Streamlines the testing process by offering features
such as templating, report generation, metrics, and
baseline self-service tools.
◇ Though it was designed with security folks in mind,
there is nothing keeping QA/QE testers, or any other
testers for that matter, from using it productively.
◇ https://github.com/rackerlabs/django-DefectDojo
Taking AppSec to 11 - BSides Austin 2016
Now with more OWASP!
Open yourself to upstream
and downstream information
#2 - Improve Feedback
Taking AppSec to 11 - BSides Austin 2016
AppSec ChatOps
aka Will
Your command line where you have your
conversations.
AppSec Help
AppSec Advice
Threadfix Integration
And more:
• Create an Application
• Get Summary Metrics for
AppSec Program
BOH/Threadfix/Static
Integration
Setup recurring static analysis in about 10 minutes!
Create a culture of innovation and
experimentation
#3 - Continual
Experimentation &
Learning
Taking AppSec to 11 - BSides Austin 2016
“I fear not the man
who has practiced
ten thousand kicks
once,
but I fear the man
who has practiced
one kick ten thousand
times.”
Taking AppSec to 11 - BSides Austin 2016
Dev & AppSec Tool Integration
OWASP ZAP
Proxy
BuildManageCode Store
RAPTOR
Deploy
OWASP ZAP
Proxy
*Not a comprehensive list. The OWASP DevOps AppSec Pipeline will have a complete listing.
Taking AppSec to 11 - BSides Austin 2016
Taking AppSec to 11 - BSides Austin 2016
Demo Time
A quick bit of show and tell...
Key Take Aways
◇ Automate, automate, automate
■ Look for “paper cuts” and fix those first
◇ Finding workflow – your AppSec Pipeline
■ Figure this out and standardize / optimize
◇ Create systems which can grow organically
■ App is never done, it’s just created to easily be
added to over time
■ e.g. Finding blocks become templates for next
report
◇ Learn to talk “dev”
Thanks!
Matt Tesauro
@matt_tesauro
matt.tesauro@infinitiv.io
matt.tesauro@owasp.org
/in/matttesauro
github.com/mtesauro
Resources
Exercises left to the student
Orchestration
◇ Integrate Security Tools and Workflow
Example:
◇ Generic API for dynamic scanning
■ URL
■ Credentials
■ Profile
■ Call any Dynamic Scanner:
○ OWASP ZAP
○ BurpSuite
○ AppScan
Gauntlt
◇ Open source, MIT License
◇ Gauntlt comes with pre-canned steps that hook
security testing tools
◇ Gauntlt does not install tools
◇ Gauntlt wants to be part of the CI/CD pipeline
◇ Be a good citizen of exit status and stdout/stderr
Tiaga
◇ Project Management Software
■ Focused on usability and speed
■ Kanban / Scrum
■ Backlog
■ Tasks
■ Sprints
■ Issues
■ Wiki
◇ Open Source – Python / Django app
■ Entire functionality is driven by a REST API !!
■ https://taiga.io/
Taking AppSec to 11 - BSides Austin 2016
Taking AppSec to 11 - BSides Austin 2016
Defect Dojo
◇ DefectDojo is a tool created by the Security
Engineering team at Rackspace to track testing
efforts.
◇ Streamlines the testing process by offering features
such as templating, report generation, metrics, and
baseline self-service tools.
◇ Though it was designed with security folks in mind,
there is nothing keeping QA/QE testers, or any other
testers for that matter, from using it productively.
◇ https://github.com/rackerlabs/django-DefectDojo
Taking AppSec to 11 - BSides Austin 2016
Experimentation
Kick things up a notch
Findings directly to
bug trackers
◇ PDFs are great, bugs are better
◇ Security issues are now part of the normal work flow
◇ ThreadFix is nice for pumping issues into defect
trackers - http://code.google.com/p/threadfix/
For the reticent: nag,
nag, nag
◇ Attach a SLA to each severity level for findings
◇ Walk up the Org chart as things get older
◇ Bonus points for dashboards and defect tracker APIs
◇ Get management sold first
Agent – one mole to
rule them all
◇ Add an agent to the standard deploy
◇ Add a dashboard to visualize state of infrastructure
◇ Roll your own or find a vendor
Mozilla MIG
Turn Vuln Scanning on
its Head
◇ Add value for your Ops teams
◇ Roll your own or find a vendor
◇ Reverse the scan then report standard
Related Presentations
AppSec EU 2015 – Ops Track Keynote
http://www.slideshare.net/mtesauro/mtesauro-keynote-appseceu
https://www.youtube.com/watch?v=tDnyFitE0y4
AppSec EU 2015 – Building an AppSec Pipeline
http://www.slideshare.net/weaveraaaron/building-an-appsec-
pipeline-keeping-your-program-and-your-life-sane
https://www.youtube.com/watch?v=1CDSOSl4DQU
Books to Read
#1 Workflow
Each Step Repeatable
◇ Remove all haphazard and ad hoc work from the
process
◇ Scripting languages are your friends
◇ Config Mgmt – Puppet, Chef, Salt, Ansible, CFEngine
◇ Make sure what you do can be done on 1 server or
10,000 servers
#1 Workflow
Never Pass on Defects
◇ Test early and often
◇ Increase the rigor of testing as you work left to right
◇ When a failure occurs end that flow and start a new
one after corrections
◇ The further right you are, the more expensive failure is
so concentrate your early work on left side (intake)
◇ In AppSec, defects are false positives
#1 Workflow
Local optimizations with a global view
◇ Ensure no single-step optimizations degrade the
overall performance of the workflow
◇ Find the bottleneck in your workflow and start there
■ Upstream changes will just back things up
■ Downstream changes won't manifest since input
is limited
◇ Each new optimization creates a new bottleneck
■ Iterate on this!
“
Spending time
optimizing anything
other than the critical
resource is an illusion.
W. Edwards Deming
Japan's post-war miracle
Henry Ford in a field:
http://henryfordgiantdifferenceaward.weebly.com/works-cited.html
Assembly Lines:
http://www.pictofcar.website/henry-ford-assembly-line-diagram/
http://www.fasttrackteaching.com/burns/Unit_3_Industry/U3_Ford.html
http://en.wikipedia.org/wiki/Assembly_line
http://actionspeaksradio.org/tag/henry-ford/
http://blogs.internetautoguide.com/6582595/manufacturing/henry-ford-didnt-invent-the-assembly-line-
ransom-e-olds-did/index.html
W. Edward Deming
http://www.motortrend.com/features/consumer/1005_30_who_count/photo_04.html
Japan's Post War Miracle
http://www2.fultonschools.org/teacher/robertsw1/thursday.nov1.htm
http://dylewski.com.pl/menu-boczne/iluzja-pieniadza/usa-vs-japonia/
http://en.wikipedia.org/wiki/Japanese_post-war_economic_miracle
Image References
Thomas Edison:
http://www.allposters.com/-sp/Thomas-Edison-Posters_i1859026_.htm
Food line:
http://www.slideshare.net/weaveraaaron/building-an-appsec-pipeline-keeping-your-program-and-your-life-
sane
Phoenix Project Book Cover:
https://puppetlabs.com/blog/why-we-need-devops-now
Goes to 11:
https://arturogalletti.files.wordpress.com/2010/12/spinaltap.jpg
Image References
What’s this?
This is a free presentation template
for Google Slides designed by
SlidesCarnival.
We believe that good design serves
to better communicate ideas, so we
create free quality presentation
templates for you to focus on the
content.
Enjoy them at will and share with us
your results at:
twitter.com/SlidesCarnival
facebook.com/slidescarnival
About this template
How can I use it?
Open this document in Google Slides (if you are at slidescarnival.
com use the button below this presentation)
You have to be signed in to your Google account
◇ Edit in Google Slides
Go to the File menu and select Make a copy. You will get
a copy of this document on your Google Drive and will be
able to edit, add or delete slides.
◇ Edit in Microsoft PowerPoint®
Go to the File menu and select Download as Microsoft
PowerPoint. You will get a .pptx file that you can edit in
PowerPoint. Remember to download and install the fonts
used in this presentation (you’ll find the links to the font
files needed in the Presentation design slide)
This template is free to use under Creative Commons Attribution license. If you use the graphic assets (photos,
icons and typographies) provided with this presentation you must keep the Credits slide.

More Related Content

What's hot

AppSec Pipelines and Event based Security
AppSec Pipelines and Event based SecurityAppSec Pipelines and Event based Security
AppSec Pipelines and Event based Security
Matt Tesauro
 
Building an Open Source AppSec Pipeline
Building an Open Source AppSec PipelineBuilding an Open Source AppSec Pipeline
Building an Open Source AppSec Pipeline
Matt Tesauro
 
DevOps AppSec Pipeline Velcocity NY 2015
DevOps AppSec Pipeline Velcocity NY 2015DevOps AppSec Pipeline Velcocity NY 2015
DevOps AppSec Pipeline Velcocity NY 2015
Aaron Weaver
 
DevOps, CLI, APIs, Oh My! Security Gone Agile
DevOps, CLI, APIs, Oh My!  Security Gone AgileDevOps, CLI, APIs, Oh My!  Security Gone Agile
DevOps, CLI, APIs, Oh My! Security Gone Agile
Matt Tesauro
 
Building a Secure DevOps Pipeline - for your AppSec Program
Building a Secure DevOps Pipeline - for your AppSec Program   Building a Secure DevOps Pipeline - for your AppSec Program
Building a Secure DevOps Pipeline - for your AppSec Program
Matt Tesauro
 
Automating OWASP Tests in your CI/CD
Automating OWASP Tests in your CI/CDAutomating OWASP Tests in your CI/CD
Automating OWASP Tests in your CI/CD
rkadayam
 
Succeeding-Marriage-Cybersecurity-DevOps final
Succeeding-Marriage-Cybersecurity-DevOps finalSucceeding-Marriage-Cybersecurity-DevOps final
Succeeding-Marriage-Cybersecurity-DevOps final
rkadayam
 
OSMC 2015: Monitoring at Spotify-When things go ping in the night by Martin Parm
OSMC 2015: Monitoring at Spotify-When things go ping in the night by Martin ParmOSMC 2015: Monitoring at Spotify-When things go ping in the night by Martin Parm
OSMC 2015: Monitoring at Spotify-When things go ping in the night by Martin Parm
NETWAYS
 
Building an AppSec Pipeline: Keeping your program, and your life, sane
Building an AppSec Pipeline: Keeping your program, and your life, saneBuilding an AppSec Pipeline: Keeping your program, and your life, sane
Building an AppSec Pipeline: Keeping your program, and your life, sane
weaveraaaron
 
Connect Ops and Security with Flexible Web App and API Protection
Connect Ops and Security with Flexible Web App and API ProtectionConnect Ops and Security with Flexible Web App and API Protection
Connect Ops and Security with Flexible Web App and API Protection
DevOps.com
 
AppSec Fast and Slow: Your DevSecOps CI/CD Pipeline Isn’t an SSA Program
AppSec Fast and Slow: Your DevSecOps CI/CD Pipeline Isn’t an SSA ProgramAppSec Fast and Slow: Your DevSecOps CI/CD Pipeline Isn’t an SSA Program
AppSec Fast and Slow: Your DevSecOps CI/CD Pipeline Isn’t an SSA Program
Denim Group
 
SecDevOps Risk Workflow - v0.6
SecDevOps Risk Workflow - v0.6SecDevOps Risk Workflow - v0.6
SecDevOps Risk Workflow - v0.6
Dinis Cruz
 
How to go from waterfall app dev to secure agile development in 2 weeks
How to go from waterfall app dev to secure agile development in 2 weeks How to go from waterfall app dev to secure agile development in 2 weeks
How to go from waterfall app dev to secure agile development in 2 weeks
Ulf Mattsson
 
we45 - SecDevOps Concept Presentation
we45 - SecDevOps Concept Presentationwe45 - SecDevOps Concept Presentation
we45 - SecDevOps Concept Presentation
Abhay Bhargav
 
AppSec is Eating Security
AppSec is Eating SecurityAppSec is Eating Security
AppSec is Eating Security
Alex Stamos
 
TechTalk 2021: Peran IT Security dalam Penerapan DevOps
TechTalk 2021: Peran IT Security dalam Penerapan DevOpsTechTalk 2021: Peran IT Security dalam Penerapan DevOps
TechTalk 2021: Peran IT Security dalam Penerapan DevOps
DicodingEvent
 
Building a Modern Security Engineering Organization
Building a Modern Security Engineering OrganizationBuilding a Modern Security Engineering Organization
Building a Modern Security Engineering Organization
Zane Lackey
 
DevOps: Cultural and Tooling Tips Around the World
DevOps: Cultural and Tooling Tips Around the WorldDevOps: Cultural and Tooling Tips Around the World
DevOps: Cultural and Tooling Tips Around the World
Dynatrace
 
Security & DevOps- Ways To Make Sure Your Apps & Infrastructure Are Secure
Security & DevOps- Ways To Make Sure Your Apps & Infrastructure Are SecureSecurity & DevOps- Ways To Make Sure Your Apps & Infrastructure Are Secure
Security & DevOps- Ways To Make Sure Your Apps & Infrastructure Are Secure
Puppet
 
Embracing the Rise of SecDevOps
Embracing the Rise of SecDevOpsEmbracing the Rise of SecDevOps
Embracing the Rise of SecDevOps
Tom Cappetta
 

What's hot (20)

AppSec Pipelines and Event based Security
AppSec Pipelines and Event based SecurityAppSec Pipelines and Event based Security
AppSec Pipelines and Event based Security
 
Building an Open Source AppSec Pipeline
Building an Open Source AppSec PipelineBuilding an Open Source AppSec Pipeline
Building an Open Source AppSec Pipeline
 
DevOps AppSec Pipeline Velcocity NY 2015
DevOps AppSec Pipeline Velcocity NY 2015DevOps AppSec Pipeline Velcocity NY 2015
DevOps AppSec Pipeline Velcocity NY 2015
 
DevOps, CLI, APIs, Oh My! Security Gone Agile
DevOps, CLI, APIs, Oh My!  Security Gone AgileDevOps, CLI, APIs, Oh My!  Security Gone Agile
DevOps, CLI, APIs, Oh My! Security Gone Agile
 
Building a Secure DevOps Pipeline - for your AppSec Program
Building a Secure DevOps Pipeline - for your AppSec Program   Building a Secure DevOps Pipeline - for your AppSec Program
Building a Secure DevOps Pipeline - for your AppSec Program
 
Automating OWASP Tests in your CI/CD
Automating OWASP Tests in your CI/CDAutomating OWASP Tests in your CI/CD
Automating OWASP Tests in your CI/CD
 
Succeeding-Marriage-Cybersecurity-DevOps final
Succeeding-Marriage-Cybersecurity-DevOps finalSucceeding-Marriage-Cybersecurity-DevOps final
Succeeding-Marriage-Cybersecurity-DevOps final
 
OSMC 2015: Monitoring at Spotify-When things go ping in the night by Martin Parm
OSMC 2015: Monitoring at Spotify-When things go ping in the night by Martin ParmOSMC 2015: Monitoring at Spotify-When things go ping in the night by Martin Parm
OSMC 2015: Monitoring at Spotify-When things go ping in the night by Martin Parm
 
Building an AppSec Pipeline: Keeping your program, and your life, sane
Building an AppSec Pipeline: Keeping your program, and your life, saneBuilding an AppSec Pipeline: Keeping your program, and your life, sane
Building an AppSec Pipeline: Keeping your program, and your life, sane
 
Connect Ops and Security with Flexible Web App and API Protection
Connect Ops and Security with Flexible Web App and API ProtectionConnect Ops and Security with Flexible Web App and API Protection
Connect Ops and Security with Flexible Web App and API Protection
 
AppSec Fast and Slow: Your DevSecOps CI/CD Pipeline Isn’t an SSA Program
AppSec Fast and Slow: Your DevSecOps CI/CD Pipeline Isn’t an SSA ProgramAppSec Fast and Slow: Your DevSecOps CI/CD Pipeline Isn’t an SSA Program
AppSec Fast and Slow: Your DevSecOps CI/CD Pipeline Isn’t an SSA Program
 
SecDevOps Risk Workflow - v0.6
SecDevOps Risk Workflow - v0.6SecDevOps Risk Workflow - v0.6
SecDevOps Risk Workflow - v0.6
 
How to go from waterfall app dev to secure agile development in 2 weeks
How to go from waterfall app dev to secure agile development in 2 weeks How to go from waterfall app dev to secure agile development in 2 weeks
How to go from waterfall app dev to secure agile development in 2 weeks
 
we45 - SecDevOps Concept Presentation
we45 - SecDevOps Concept Presentationwe45 - SecDevOps Concept Presentation
we45 - SecDevOps Concept Presentation
 
AppSec is Eating Security
AppSec is Eating SecurityAppSec is Eating Security
AppSec is Eating Security
 
TechTalk 2021: Peran IT Security dalam Penerapan DevOps
TechTalk 2021: Peran IT Security dalam Penerapan DevOpsTechTalk 2021: Peran IT Security dalam Penerapan DevOps
TechTalk 2021: Peran IT Security dalam Penerapan DevOps
 
Building a Modern Security Engineering Organization
Building a Modern Security Engineering OrganizationBuilding a Modern Security Engineering Organization
Building a Modern Security Engineering Organization
 
DevOps: Cultural and Tooling Tips Around the World
DevOps: Cultural and Tooling Tips Around the WorldDevOps: Cultural and Tooling Tips Around the World
DevOps: Cultural and Tooling Tips Around the World
 
Security & DevOps- Ways To Make Sure Your Apps & Infrastructure Are Secure
Security & DevOps- Ways To Make Sure Your Apps & Infrastructure Are SecureSecurity & DevOps- Ways To Make Sure Your Apps & Infrastructure Are Secure
Security & DevOps- Ways To Make Sure Your Apps & Infrastructure Are Secure
 
Embracing the Rise of SecDevOps
Embracing the Rise of SecDevOpsEmbracing the Rise of SecDevOps
Embracing the Rise of SecDevOps
 

Viewers also liked

ContainerCon - Test Driven Infrastructure
ContainerCon - Test Driven InfrastructureContainerCon - Test Driven Infrastructure
ContainerCon - Test Driven Infrastructure
Yury Tsarev
 
BsidesMCR_2016-what-can-infosec-learn-from-devops
BsidesMCR_2016-what-can-infosec-learn-from-devopsBsidesMCR_2016-what-can-infosec-learn-from-devops
BsidesMCR_2016-what-can-infosec-learn-from-devops
James '​-- Mckinlay
 
Scaling Operations At Spotify
Scaling Operations At SpotifyScaling Operations At Spotify
Scaling Operations At Spotify
David Poblador i Garcia
 
SREcon 2016 Performance Checklists for SREs
SREcon 2016 Performance Checklists for SREsSREcon 2016 Performance Checklists for SREs
SREcon 2016 Performance Checklists for SREs
Brendan Gregg
 
Five steps to Continuous Delivery
Five steps to Continuous DeliveryFive steps to Continuous Delivery
Five steps to Continuous Delivery
Marko Klemetti
 
DevOps by examples - DevOps@Work 2017
DevOps by examples - DevOps@Work 2017DevOps by examples - DevOps@Work 2017
DevOps by examples - DevOps@Work 2017
Giulio Vian
 
SPOF - Single "Person" of Failure
SPOF - Single "Person" of FailureSPOF - Single "Person" of Failure
SPOF - Single "Person" of Failure
Sasha Rosenbaum
 
Chaos patterns - architecting for failure in distributed systems
Chaos patterns - architecting for failure in distributed systemsChaos patterns - architecting for failure in distributed systems
Chaos patterns - architecting for failure in distributed systems
Jos Boumans
 
Un-broken Logging - Operability.io 2015 - Matthew Skelton
Un-broken Logging - Operability.io 2015 - Matthew SkeltonUn-broken Logging - Operability.io 2015 - Matthew Skelton
Un-broken Logging - Operability.io 2015 - Matthew Skelton
Skelton Thatcher Consulting Ltd
 
A Coherent Discussion About Performance
A Coherent Discussion About PerformanceA Coherent Discussion About Performance
A Coherent Discussion About Performance
Theo Schlossnagle
 
Monitoring Is Never Done
Monitoring Is Never DoneMonitoring Is Never Done
Monitoring Is Never Done
Melanie Cey
 
Devops and Immutable infrastructure - Cloud Expo 2015 NYC
Devops and Immutable infrastructure  - Cloud Expo 2015 NYCDevops and Immutable infrastructure  - Cloud Expo 2015 NYC
Devops and Immutable infrastructure - Cloud Expo 2015 NYC
John Willis
 
Test Automation In The Hands of "The Business"
Test Automation In The Hands of "The Business"Test Automation In The Hands of "The Business"
Test Automation In The Hands of "The Business"
Greg Tutunjian
 
Time to say goodbye to your Nagios based setup
Time to say goodbye to your Nagios based setupTime to say goodbye to your Nagios based setup
Time to say goodbye to your Nagios based setup
Check my Website
 
Production testing through monitoring
Production testing through monitoringProduction testing through monitoring
Production testing through monitoring
Leon Fayer
 
Continuous Delivery Tools Collaboration Conways Law - QCon London - Matthew S...
Continuous Delivery Tools Collaboration Conways Law - QCon London - Matthew S...Continuous Delivery Tools Collaboration Conways Law - QCon London - Matthew S...
Continuous Delivery Tools Collaboration Conways Law - QCon London - Matthew S...
Skelton Thatcher Consulting Ltd
 
Metrics to Power DevOps
Metrics to Power DevOpsMetrics to Power DevOps
Metrics to Power DevOps
CollabNet
 
AWS re:Invent 2016: Fraud Detection with Amazon Machine Learning on AWS (FIN301)
AWS re:Invent 2016: Fraud Detection with Amazon Machine Learning on AWS (FIN301)AWS re:Invent 2016: Fraud Detection with Amazon Machine Learning on AWS (FIN301)
AWS re:Invent 2016: Fraud Detection with Amazon Machine Learning on AWS (FIN301)
Amazon Web Services
 
DevOps Kaizen: Practical Steps to Start & Sustain a Transformation
DevOps Kaizen: Practical Steps to Start & Sustain a TransformationDevOps Kaizen: Practical Steps to Start & Sustain a Transformation
DevOps Kaizen: Practical Steps to Start & Sustain a Transformation
dev2ops
 
Stop using Nagios (so it can die peacefully)
Stop using Nagios (so it can die peacefully)Stop using Nagios (so it can die peacefully)
Stop using Nagios (so it can die peacefully)
Andy Sykes
 

Viewers also liked (20)

ContainerCon - Test Driven Infrastructure
ContainerCon - Test Driven InfrastructureContainerCon - Test Driven Infrastructure
ContainerCon - Test Driven Infrastructure
 
BsidesMCR_2016-what-can-infosec-learn-from-devops
BsidesMCR_2016-what-can-infosec-learn-from-devopsBsidesMCR_2016-what-can-infosec-learn-from-devops
BsidesMCR_2016-what-can-infosec-learn-from-devops
 
Scaling Operations At Spotify
Scaling Operations At SpotifyScaling Operations At Spotify
Scaling Operations At Spotify
 
SREcon 2016 Performance Checklists for SREs
SREcon 2016 Performance Checklists for SREsSREcon 2016 Performance Checklists for SREs
SREcon 2016 Performance Checklists for SREs
 
Five steps to Continuous Delivery
Five steps to Continuous DeliveryFive steps to Continuous Delivery
Five steps to Continuous Delivery
 
DevOps by examples - DevOps@Work 2017
DevOps by examples - DevOps@Work 2017DevOps by examples - DevOps@Work 2017
DevOps by examples - DevOps@Work 2017
 
SPOF - Single "Person" of Failure
SPOF - Single "Person" of FailureSPOF - Single "Person" of Failure
SPOF - Single "Person" of Failure
 
Chaos patterns - architecting for failure in distributed systems
Chaos patterns - architecting for failure in distributed systemsChaos patterns - architecting for failure in distributed systems
Chaos patterns - architecting for failure in distributed systems
 
Un-broken Logging - Operability.io 2015 - Matthew Skelton
Un-broken Logging - Operability.io 2015 - Matthew SkeltonUn-broken Logging - Operability.io 2015 - Matthew Skelton
Un-broken Logging - Operability.io 2015 - Matthew Skelton
 
A Coherent Discussion About Performance
A Coherent Discussion About PerformanceA Coherent Discussion About Performance
A Coherent Discussion About Performance
 
Monitoring Is Never Done
Monitoring Is Never DoneMonitoring Is Never Done
Monitoring Is Never Done
 
Devops and Immutable infrastructure - Cloud Expo 2015 NYC
Devops and Immutable infrastructure  - Cloud Expo 2015 NYCDevops and Immutable infrastructure  - Cloud Expo 2015 NYC
Devops and Immutable infrastructure - Cloud Expo 2015 NYC
 
Test Automation In The Hands of "The Business"
Test Automation In The Hands of "The Business"Test Automation In The Hands of "The Business"
Test Automation In The Hands of "The Business"
 
Time to say goodbye to your Nagios based setup
Time to say goodbye to your Nagios based setupTime to say goodbye to your Nagios based setup
Time to say goodbye to your Nagios based setup
 
Production testing through monitoring
Production testing through monitoringProduction testing through monitoring
Production testing through monitoring
 
Continuous Delivery Tools Collaboration Conways Law - QCon London - Matthew S...
Continuous Delivery Tools Collaboration Conways Law - QCon London - Matthew S...Continuous Delivery Tools Collaboration Conways Law - QCon London - Matthew S...
Continuous Delivery Tools Collaboration Conways Law - QCon London - Matthew S...
 
Metrics to Power DevOps
Metrics to Power DevOpsMetrics to Power DevOps
Metrics to Power DevOps
 
AWS re:Invent 2016: Fraud Detection with Amazon Machine Learning on AWS (FIN301)
AWS re:Invent 2016: Fraud Detection with Amazon Machine Learning on AWS (FIN301)AWS re:Invent 2016: Fraud Detection with Amazon Machine Learning on AWS (FIN301)
AWS re:Invent 2016: Fraud Detection with Amazon Machine Learning on AWS (FIN301)
 
DevOps Kaizen: Practical Steps to Start & Sustain a Transformation
DevOps Kaizen: Practical Steps to Start & Sustain a TransformationDevOps Kaizen: Practical Steps to Start & Sustain a Transformation
DevOps Kaizen: Practical Steps to Start & Sustain a Transformation
 
Stop using Nagios (so it can die peacefully)
Stop using Nagios (so it can die peacefully)Stop using Nagios (so it can die peacefully)
Stop using Nagios (so it can die peacefully)
 

Similar to Taking AppSec to 11 - BSides Austin 2016

DevOps Pipeline for Liferay Application
DevOps Pipeline for Liferay ApplicationDevOps Pipeline for Liferay Application
DevOps Pipeline for Liferay Application
Maruti Gollapudi
 
DevSecOps: Bringing security to the DevOps pipeline
DevSecOps: Bringing security to the DevOps pipelineDevSecOps: Bringing security to the DevOps pipeline
DevSecOps: Bringing security to the DevOps pipeline
Aarno Aukia
 
DevSecOps: Bringing security to the DevOps pipeline
DevSecOps: Bringing security to the DevOps pipelineDevSecOps: Bringing security to the DevOps pipeline
DevSecOps: Bringing security to the DevOps pipeline
Aarno Aukia
 
Agile & DevOps - It's all about project success
Agile & DevOps - It's all about project successAgile & DevOps - It's all about project success
Agile & DevOps - It's all about project success
Adam Stephensen
 
Confoo-Montreal-2016: Controlling Your Environments using Infrastructure as Code
Confoo-Montreal-2016: Controlling Your Environments using Infrastructure as CodeConfoo-Montreal-2016: Controlling Your Environments using Infrastructure as Code
Confoo-Montreal-2016: Controlling Your Environments using Infrastructure as Code
Steve Mercier
 
DevOps Deconstructed
DevOps DeconstructedDevOps Deconstructed
DevOps Deconstructed
Jeremy Pullen
 
Exercising and Scaling Up Mobile DevOps in the Enterprise
Exercising and Scaling Up Mobile DevOps in the EnterpriseExercising and Scaling Up Mobile DevOps in the Enterprise
Exercising and Scaling Up Mobile DevOps in the Enterprise
Bitbar
 
DevOps with Microsoft Stack
DevOps with Microsoft StackDevOps with Microsoft Stack
DevOps with Microsoft Stack
Deepti Jain
 
Testing in the new age of DevOps
Testing in the new age of DevOpsTesting in the new age of DevOps
Testing in the new age of DevOps
Moataz Mahmoud
 
DevOps Foundations
DevOps FoundationsDevOps Foundations
DevOps Foundations
Amr Fawzy
 
Rapise Overview Presentation (2021)
Rapise Overview Presentation (2021)Rapise Overview Presentation (2021)
Rapise Overview Presentation (2021)
Inflectra
 
Getting to Walk with DevOps
Getting to Walk with DevOpsGetting to Walk with DevOps
Getting to Walk with DevOps
Eklove Mohan
 
SoCal DevOps Meetup 1/26/2017 - Habitat by Chef
SoCal DevOps Meetup 1/26/2017 - Habitat by ChefSoCal DevOps Meetup 1/26/2017 - Habitat by Chef
SoCal DevOps Meetup 1/26/2017 - Habitat by Chef
Trevor Hess
 
Pay pal paypal continuous performance as a self-service with fully-automated...
Pay pal  paypal continuous performance as a self-service with fully-automated...Pay pal  paypal continuous performance as a self-service with fully-automated...
Pay pal paypal continuous performance as a self-service with fully-automated...
Dynatrace
 
AWS18 Startup Day Toronto- Launching your Application the Amazon Way
AWS18 Startup Day Toronto- Launching your Application the Amazon WayAWS18 Startup Day Toronto- Launching your Application the Amazon Way
AWS18 Startup Day Toronto- Launching your Application the Amazon Way
Amazon Web Services
 
OpsWorks for Chef Automate - Auckland AWS
OpsWorks for Chef Automate - Auckland AWS OpsWorks for Chef Automate - Auckland AWS
OpsWorks for Chef Automate - Auckland AWS
Matt Ray
 
Building an In-House DevOps Service Platform for Mobility Solutions | Mindtree
Building an In-House DevOps Service Platform for Mobility Solutions | Mindtree	Building an In-House DevOps Service Platform for Mobility Solutions | Mindtree
Building an In-House DevOps Service Platform for Mobility Solutions | Mindtree
AnikeyRoy
 
Forward5 Auxis VMware
Forward5 Auxis VMwareForward5 Auxis VMware
Forward5 Auxis VMware
Auxis Consulting & Outsourcing
 
GitOps, Driving NGN Operations Teams 211127 #kcdgt 2021
GitOps, Driving NGN Operations Teams 211127 #kcdgt 2021GitOps, Driving NGN Operations Teams 211127 #kcdgt 2021
GitOps, Driving NGN Operations Teams 211127 #kcdgt 2021
William Caban
 
Harman deepak v - agile on steriod - dev ops led transformation
Harman  deepak v - agile on steriod - dev ops led transformationHarman  deepak v - agile on steriod - dev ops led transformation
Harman deepak v - agile on steriod - dev ops led transformation
Xebia India
 

Similar to Taking AppSec to 11 - BSides Austin 2016 (20)

DevOps Pipeline for Liferay Application
DevOps Pipeline for Liferay ApplicationDevOps Pipeline for Liferay Application
DevOps Pipeline for Liferay Application
 
DevSecOps: Bringing security to the DevOps pipeline
DevSecOps: Bringing security to the DevOps pipelineDevSecOps: Bringing security to the DevOps pipeline
DevSecOps: Bringing security to the DevOps pipeline
 
DevSecOps: Bringing security to the DevOps pipeline
DevSecOps: Bringing security to the DevOps pipelineDevSecOps: Bringing security to the DevOps pipeline
DevSecOps: Bringing security to the DevOps pipeline
 
Agile & DevOps - It's all about project success
Agile & DevOps - It's all about project successAgile & DevOps - It's all about project success
Agile & DevOps - It's all about project success
 
Confoo-Montreal-2016: Controlling Your Environments using Infrastructure as Code
Confoo-Montreal-2016: Controlling Your Environments using Infrastructure as CodeConfoo-Montreal-2016: Controlling Your Environments using Infrastructure as Code
Confoo-Montreal-2016: Controlling Your Environments using Infrastructure as Code
 
DevOps Deconstructed
DevOps DeconstructedDevOps Deconstructed
DevOps Deconstructed
 
Exercising and Scaling Up Mobile DevOps in the Enterprise
Exercising and Scaling Up Mobile DevOps in the EnterpriseExercising and Scaling Up Mobile DevOps in the Enterprise
Exercising and Scaling Up Mobile DevOps in the Enterprise
 
DevOps with Microsoft Stack
DevOps with Microsoft StackDevOps with Microsoft Stack
DevOps with Microsoft Stack
 
Testing in the new age of DevOps
Testing in the new age of DevOpsTesting in the new age of DevOps
Testing in the new age of DevOps
 
DevOps Foundations
DevOps FoundationsDevOps Foundations
DevOps Foundations
 
Rapise Overview Presentation (2021)
Rapise Overview Presentation (2021)Rapise Overview Presentation (2021)
Rapise Overview Presentation (2021)
 
Getting to Walk with DevOps
Getting to Walk with DevOpsGetting to Walk with DevOps
Getting to Walk with DevOps
 
SoCal DevOps Meetup 1/26/2017 - Habitat by Chef
SoCal DevOps Meetup 1/26/2017 - Habitat by ChefSoCal DevOps Meetup 1/26/2017 - Habitat by Chef
SoCal DevOps Meetup 1/26/2017 - Habitat by Chef
 
Pay pal paypal continuous performance as a self-service with fully-automated...
Pay pal  paypal continuous performance as a self-service with fully-automated...Pay pal  paypal continuous performance as a self-service with fully-automated...
Pay pal paypal continuous performance as a self-service with fully-automated...
 
AWS18 Startup Day Toronto- Launching your Application the Amazon Way
AWS18 Startup Day Toronto- Launching your Application the Amazon WayAWS18 Startup Day Toronto- Launching your Application the Amazon Way
AWS18 Startup Day Toronto- Launching your Application the Amazon Way
 
OpsWorks for Chef Automate - Auckland AWS
OpsWorks for Chef Automate - Auckland AWS OpsWorks for Chef Automate - Auckland AWS
OpsWorks for Chef Automate - Auckland AWS
 
Building an In-House DevOps Service Platform for Mobility Solutions | Mindtree
Building an In-House DevOps Service Platform for Mobility Solutions | Mindtree	Building an In-House DevOps Service Platform for Mobility Solutions | Mindtree
Building an In-House DevOps Service Platform for Mobility Solutions | Mindtree
 
Forward5 Auxis VMware
Forward5 Auxis VMwareForward5 Auxis VMware
Forward5 Auxis VMware
 
GitOps, Driving NGN Operations Teams 211127 #kcdgt 2021
GitOps, Driving NGN Operations Teams 211127 #kcdgt 2021GitOps, Driving NGN Operations Teams 211127 #kcdgt 2021
GitOps, Driving NGN Operations Teams 211127 #kcdgt 2021
 
Harman deepak v - agile on steriod - dev ops led transformation
Harman  deepak v - agile on steriod - dev ops led transformationHarman  deepak v - agile on steriod - dev ops led transformation
Harman deepak v - agile on steriod - dev ops led transformation
 

More from Matt Tesauro

Tenants for Going at DevSecOps Speed - LASCON 2023
Tenants for Going at DevSecOps Speed - LASCON 2023Tenants for Going at DevSecOps Speed - LASCON 2023
Tenants for Going at DevSecOps Speed - LASCON 2023
Matt Tesauro
 
Hacking and Defending APIs - Red and Blue make Purple.pdf
Hacking and Defending APIs - Red and Blue make Purple.pdfHacking and Defending APIs - Red and Blue make Purple.pdf
Hacking and Defending APIs - Red and Blue make Purple.pdf
Matt Tesauro
 
Practical DevSecOps: Fundamentals of Successful Programs
Practical DevSecOps: Fundamentals of Successful ProgramsPractical DevSecOps: Fundamentals of Successful Programs
Practical DevSecOps: Fundamentals of Successful Programs
Matt Tesauro
 
Black and Blue APIs: Attacker's and Defender's View of API Vulnerabilities
Black and Blue APIs: Attacker's and Defender's View of API VulnerabilitiesBlack and Blue APIs: Attacker's and Defender's View of API Vulnerabilities
Black and Blue APIs: Attacker's and Defender's View of API Vulnerabilities
Matt Tesauro
 
Landmines in the API Landscape
Landmines in the API LandscapeLandmines in the API Landscape
Landmines in the API Landscape
Matt Tesauro
 
Peeling the Onion: Making Sense of the Layers of API Security
Peeling the Onion: Making Sense of the Layers of API SecurityPeeling the Onion: Making Sense of the Layers of API Security
Peeling the Onion: Making Sense of the Layers of API Security
Matt Tesauro
 
The Final Frontier, Automating Dynamic Security Testing
The Final Frontier, Automating Dynamic Security TestingThe Final Frontier, Automating Dynamic Security Testing
The Final Frontier, Automating Dynamic Security Testing
Matt Tesauro
 
Intro to DefectDojo at OWASP Switzerland
Intro to DefectDojo at OWASP SwitzerlandIntro to DefectDojo at OWASP Switzerland
Intro to DefectDojo at OWASP Switzerland
Matt Tesauro
 
Taking the Best of Agile, DevOps and CI/CD into security
Taking the Best of Agile, DevOps and CI/CD into securityTaking the Best of Agile, DevOps and CI/CD into security
Taking the Best of Agile, DevOps and CI/CD into security
Matt Tesauro
 
DevSecOps Fundamentals and the Scars to Prove it.
DevSecOps Fundamentals and the Scars to Prove it.DevSecOps Fundamentals and the Scars to Prove it.
DevSecOps Fundamentals and the Scars to Prove it.
Matt Tesauro
 
Continuous Security: Using Automation to Expand Security's Reach
Continuous Security: Using Automation to Expand Security's ReachContinuous Security: Using Automation to Expand Security's Reach
Continuous Security: Using Automation to Expand Security's Reach
Matt Tesauro
 
OWASP DefectDojo - Open Source Security Sanity
OWASP DefectDojo - Open Source Security SanityOWASP DefectDojo - Open Source Security Sanity
OWASP DefectDojo - Open Source Security Sanity
Matt Tesauro
 
Running FaaS with Scissors
Running FaaS with ScissorsRunning FaaS with Scissors
Running FaaS with Scissors
Matt Tesauro
 
Making Continuous Security a Reality with OWASP’s AppSec Pipeline - Matt Tesa...
Making Continuous Security a Reality with OWASP’s AppSec Pipeline - Matt Tesa...Making Continuous Security a Reality with OWASP’s AppSec Pipeline - Matt Tesa...
Making Continuous Security a Reality with OWASP’s AppSec Pipeline - Matt Tesa...
Matt Tesauro
 
Dev ops ci-ap-is-oh-my_security-gone-agile_ut-austin
Dev ops ci-ap-is-oh-my_security-gone-agile_ut-austinDev ops ci-ap-is-oh-my_security-gone-agile_ut-austin
Dev ops ci-ap-is-oh-my_security-gone-agile_ut-austin
Matt Tesauro
 
OWASP WTE - Now in the Cloud!
OWASP WTE - Now in the Cloud!OWASP WTE - Now in the Cloud!
OWASP WTE - Now in the Cloud!
Matt Tesauro
 
Testing at-cloud-speed sans-app-sec-austin-2013
Testing at-cloud-speed sans-app-sec-austin-2013Testing at-cloud-speed sans-app-sec-austin-2013
Testing at-cloud-speed sans-app-sec-austin-2013
Matt Tesauro
 
DevOps, CI, APIs, Oh My! - Texas Linux Fest 2012
DevOps, CI, APIs, Oh My! - Texas Linux Fest 2012DevOps, CI, APIs, Oh My! - Texas Linux Fest 2012
DevOps, CI, APIs, Oh My! - Texas Linux Fest 2012
Matt Tesauro
 

More from Matt Tesauro (18)

Tenants for Going at DevSecOps Speed - LASCON 2023
Tenants for Going at DevSecOps Speed - LASCON 2023Tenants for Going at DevSecOps Speed - LASCON 2023
Tenants for Going at DevSecOps Speed - LASCON 2023
 
Hacking and Defending APIs - Red and Blue make Purple.pdf
Hacking and Defending APIs - Red and Blue make Purple.pdfHacking and Defending APIs - Red and Blue make Purple.pdf
Hacking and Defending APIs - Red and Blue make Purple.pdf
 
Practical DevSecOps: Fundamentals of Successful Programs
Practical DevSecOps: Fundamentals of Successful ProgramsPractical DevSecOps: Fundamentals of Successful Programs
Practical DevSecOps: Fundamentals of Successful Programs
 
Black and Blue APIs: Attacker's and Defender's View of API Vulnerabilities
Black and Blue APIs: Attacker's and Defender's View of API VulnerabilitiesBlack and Blue APIs: Attacker's and Defender's View of API Vulnerabilities
Black and Blue APIs: Attacker's and Defender's View of API Vulnerabilities
 
Landmines in the API Landscape
Landmines in the API LandscapeLandmines in the API Landscape
Landmines in the API Landscape
 
Peeling the Onion: Making Sense of the Layers of API Security
Peeling the Onion: Making Sense of the Layers of API SecurityPeeling the Onion: Making Sense of the Layers of API Security
Peeling the Onion: Making Sense of the Layers of API Security
 
The Final Frontier, Automating Dynamic Security Testing
The Final Frontier, Automating Dynamic Security TestingThe Final Frontier, Automating Dynamic Security Testing
The Final Frontier, Automating Dynamic Security Testing
 
Intro to DefectDojo at OWASP Switzerland
Intro to DefectDojo at OWASP SwitzerlandIntro to DefectDojo at OWASP Switzerland
Intro to DefectDojo at OWASP Switzerland
 
Taking the Best of Agile, DevOps and CI/CD into security
Taking the Best of Agile, DevOps and CI/CD into securityTaking the Best of Agile, DevOps and CI/CD into security
Taking the Best of Agile, DevOps and CI/CD into security
 
DevSecOps Fundamentals and the Scars to Prove it.
DevSecOps Fundamentals and the Scars to Prove it.DevSecOps Fundamentals and the Scars to Prove it.
DevSecOps Fundamentals and the Scars to Prove it.
 
Continuous Security: Using Automation to Expand Security's Reach
Continuous Security: Using Automation to Expand Security's ReachContinuous Security: Using Automation to Expand Security's Reach
Continuous Security: Using Automation to Expand Security's Reach
 
OWASP DefectDojo - Open Source Security Sanity
OWASP DefectDojo - Open Source Security SanityOWASP DefectDojo - Open Source Security Sanity
OWASP DefectDojo - Open Source Security Sanity
 
Running FaaS with Scissors
Running FaaS with ScissorsRunning FaaS with Scissors
Running FaaS with Scissors
 
Making Continuous Security a Reality with OWASP’s AppSec Pipeline - Matt Tesa...
Making Continuous Security a Reality with OWASP’s AppSec Pipeline - Matt Tesa...Making Continuous Security a Reality with OWASP’s AppSec Pipeline - Matt Tesa...
Making Continuous Security a Reality with OWASP’s AppSec Pipeline - Matt Tesa...
 
Dev ops ci-ap-is-oh-my_security-gone-agile_ut-austin
Dev ops ci-ap-is-oh-my_security-gone-agile_ut-austinDev ops ci-ap-is-oh-my_security-gone-agile_ut-austin
Dev ops ci-ap-is-oh-my_security-gone-agile_ut-austin
 
OWASP WTE - Now in the Cloud!
OWASP WTE - Now in the Cloud!OWASP WTE - Now in the Cloud!
OWASP WTE - Now in the Cloud!
 
Testing at-cloud-speed sans-app-sec-austin-2013
Testing at-cloud-speed sans-app-sec-austin-2013Testing at-cloud-speed sans-app-sec-austin-2013
Testing at-cloud-speed sans-app-sec-austin-2013
 
DevOps, CI, APIs, Oh My! - Texas Linux Fest 2012
DevOps, CI, APIs, Oh My! - Texas Linux Fest 2012DevOps, CI, APIs, Oh My! - Texas Linux Fest 2012
DevOps, CI, APIs, Oh My! - Texas Linux Fest 2012
 

Recently uploaded

Bai-Tập-Tiếng-Anh-On-Tập-He lớp 1- lớp 5 hot nhất
Bai-Tập-Tiếng-Anh-On-Tập-He lớp 1- lớp 5  hot nhấtBai-Tập-Tiếng-Anh-On-Tập-He lớp 1- lớp 5  hot nhất
Bai-Tập-Tiếng-Anh-On-Tập-He lớp 1- lớp 5 hot nhất
Thiên Đường Tình Yêu
 
202254.com免费观看《长相思第二季》免费观看高清,长相思第二季线上看,《长相思第二季》最新电视剧在线观看,杨紫最新电视剧
202254.com免费观看《长相思第二季》免费观看高清,长相思第二季线上看,《长相思第二季》最新电视剧在线观看,杨紫最新电视剧202254.com免费观看《长相思第二季》免费观看高清,长相思第二季线上看,《长相思第二季》最新电视剧在线观看,杨紫最新电视剧
202254.com免费观看《长相思第二季》免费观看高清,长相思第二季线上看,《长相思第二季》最新电视剧在线观看,杨紫最新电视剧
ffg01100
 
Jarren Duran Fuck EM T shirts Jarren Duran Fuck EM T shirts
Jarren Duran Fuck EM T shirts Jarren Duran Fuck EM T shirtsJarren Duran Fuck EM T shirts Jarren Duran Fuck EM T shirts
Jarren Duran Fuck EM T shirts Jarren Duran Fuck EM T shirts
exgf28
 
Megalive99 Situs Betting Online Gacor Terpercaya
Megalive99 Situs Betting Online Gacor TerpercayaMegalive99 Situs Betting Online Gacor Terpercaya
Megalive99 Situs Betting Online Gacor Terpercaya
Megalive99
 
@Girls @Call Chennai 🛬 XXXXXXXXXX 🛬 available 24*7 cash payment book now pay ...
@Girls @Call Chennai 🛬 XXXXXXXXXX 🛬 available 24*7 cash payment book now pay ...@Girls @Call Chennai 🛬 XXXXXXXXXX 🛬 available 24*7 cash payment book now pay ...
@Girls @Call Chennai 🛬 XXXXXXXXXX 🛬 available 24*7 cash payment book now pay ...
shamrisumri
 
High Profile Girls Call ServiCe Chennai XX00XXX00X Tanisha Best High Class Ch...
High Profile Girls Call ServiCe Chennai XX00XXX00X Tanisha Best High Class Ch...High Profile Girls Call ServiCe Chennai XX00XXX00X Tanisha Best High Class Ch...
High Profile Girls Call ServiCe Chennai XX00XXX00X Tanisha Best High Class Ch...
shamrisumri
 
Book dating , international dating phgra
Book dating , international dating phgraBook dating , international dating phgra
Book dating , international dating phgra
thomaskurtha9
 
Draya Michele’s Son – Kniko Howard’s Rise to Fame.pptx
Draya Michele’s Son – Kniko Howard’s Rise to Fame.pptxDraya Michele’s Son – Kniko Howard’s Rise to Fame.pptx
Draya Michele’s Son – Kniko Howard’s Rise to Fame.pptx
ashishkumarrana9
 
Tarun Gaur On Data Breaches and Privacy Fears
Tarun Gaur On Data Breaches and Privacy FearsTarun Gaur On Data Breaches and Privacy Fears
Tarun Gaur On Data Breaches and Privacy Fears
Tarun Gaur
 
2023. Archive - Gigabajtos selfpublisher homepage
2023. Archive - Gigabajtos selfpublisher homepage2023. Archive - Gigabajtos selfpublisher homepage
2023. Archive - Gigabajtos selfpublisher homepage
Zsolt Nemeth
 
202254.com香蕉影视,在线观看《我才不要和你做朋友呢》在线观看最新电影,香蕉影视在线观看《我才不要和你做朋友呢》在线观看高清电影
202254.com香蕉影视,在线观看《我才不要和你做朋友呢》在线观看最新电影,香蕉影视在线观看《我才不要和你做朋友呢》在线观看高清电影202254.com香蕉影视,在线观看《我才不要和你做朋友呢》在线观看最新电影,香蕉影视在线观看《我才不要和你做朋友呢》在线观看高清电影
202254.com香蕉影视,在线观看《我才不要和你做朋友呢》在线观看最新电影,香蕉影视在线观看《我才不要和你做朋友呢》在线观看高清电影
ffg01100
 
Why Your Business Needs a Professional Web Design Company UAE
Why Your Business Needs a Professional Web Design Company UAEWhy Your Business Needs a Professional Web Design Company UAE
Why Your Business Needs a Professional Web Design Company UAE
adelewhite125
 
AWS Networking Basic , tanapat limsaiprom
AWS Networking Basic , tanapat limsaipromAWS Networking Basic , tanapat limsaiprom
AWS Networking Basic , tanapat limsaiprom
ธนาพัฒน์ ลิ้มสายพรหม
 
How-to-Diagnose-Hard-Drives-by-DFL-DDP-2024.pdf
How-to-Diagnose-Hard-Drives-by-DFL-DDP-2024.pdfHow-to-Diagnose-Hard-Drives-by-DFL-DDP-2024.pdf
How-to-Diagnose-Hard-Drives-by-DFL-DDP-2024.pdf
Dolphin Data Lab
 
Information Systems Auditing, Controls and Assurance , tanapat limsaiprom
Information Systems Auditing, Controls and Assurance , tanapat limsaipromInformation Systems Auditing, Controls and Assurance , tanapat limsaiprom
Information Systems Auditing, Controls and Assurance , tanapat limsaiprom
TanapatLimsaiprom1
 
Cyber Security Course & Guide. X.GI. pdf
Cyber Security Course & Guide. X.GI. pdfCyber Security Course & Guide. X.GI. pdf
Cyber Security Course & Guide. X.GI. pdf
RohitRoshanBengROHIT
 
Build a Professional Resume using Canva , Tanapat Limsaiprom
Build a Professional Resume using Canva , Tanapat LimsaipromBuild a Professional Resume using Canva , Tanapat Limsaiprom
Build a Professional Resume using Canva , Tanapat Limsaiprom
TanapatLimsaiprom1
 
Top 50 Telephone Conversation Sample Examples For IT Industries.pdf
Top 50 Telephone Conversation Sample Examples For IT Industries.pdfTop 50 Telephone Conversation Sample Examples For IT Industries.pdf
Top 50 Telephone Conversation Sample Examples For IT Industries.pdf
Krishna L
 
Quiz Quiz Hota Hai (School Quiz 2018-19)
Quiz Quiz Hota Hai (School Quiz 2018-19)Quiz Quiz Hota Hai (School Quiz 2018-19)
Quiz Quiz Hota Hai (School Quiz 2018-19)
Kashyap J
 
Effective Tips for Creating the Best Rich Media Ads .pptx
Effective Tips for Creating the Best Rich Media Ads .pptxEffective Tips for Creating the Best Rich Media Ads .pptx
Effective Tips for Creating the Best Rich Media Ads .pptx
AirtoryInc
 

Recently uploaded (20)

Bai-Tập-Tiếng-Anh-On-Tập-He lớp 1- lớp 5 hot nhất
Bai-Tập-Tiếng-Anh-On-Tập-He lớp 1- lớp 5  hot nhấtBai-Tập-Tiếng-Anh-On-Tập-He lớp 1- lớp 5  hot nhất
Bai-Tập-Tiếng-Anh-On-Tập-He lớp 1- lớp 5 hot nhất
 
202254.com免费观看《长相思第二季》免费观看高清,长相思第二季线上看,《长相思第二季》最新电视剧在线观看,杨紫最新电视剧
202254.com免费观看《长相思第二季》免费观看高清,长相思第二季线上看,《长相思第二季》最新电视剧在线观看,杨紫最新电视剧202254.com免费观看《长相思第二季》免费观看高清,长相思第二季线上看,《长相思第二季》最新电视剧在线观看,杨紫最新电视剧
202254.com免费观看《长相思第二季》免费观看高清,长相思第二季线上看,《长相思第二季》最新电视剧在线观看,杨紫最新电视剧
 
Jarren Duran Fuck EM T shirts Jarren Duran Fuck EM T shirts
Jarren Duran Fuck EM T shirts Jarren Duran Fuck EM T shirtsJarren Duran Fuck EM T shirts Jarren Duran Fuck EM T shirts
Jarren Duran Fuck EM T shirts Jarren Duran Fuck EM T shirts
 
Megalive99 Situs Betting Online Gacor Terpercaya
Megalive99 Situs Betting Online Gacor TerpercayaMegalive99 Situs Betting Online Gacor Terpercaya
Megalive99 Situs Betting Online Gacor Terpercaya
 
@Girls @Call Chennai 🛬 XXXXXXXXXX 🛬 available 24*7 cash payment book now pay ...
@Girls @Call Chennai 🛬 XXXXXXXXXX 🛬 available 24*7 cash payment book now pay ...@Girls @Call Chennai 🛬 XXXXXXXXXX 🛬 available 24*7 cash payment book now pay ...
@Girls @Call Chennai 🛬 XXXXXXXXXX 🛬 available 24*7 cash payment book now pay ...
 
High Profile Girls Call ServiCe Chennai XX00XXX00X Tanisha Best High Class Ch...
High Profile Girls Call ServiCe Chennai XX00XXX00X Tanisha Best High Class Ch...High Profile Girls Call ServiCe Chennai XX00XXX00X Tanisha Best High Class Ch...
High Profile Girls Call ServiCe Chennai XX00XXX00X Tanisha Best High Class Ch...
 
Book dating , international dating phgra
Book dating , international dating phgraBook dating , international dating phgra
Book dating , international dating phgra
 
Draya Michele’s Son – Kniko Howard’s Rise to Fame.pptx
Draya Michele’s Son – Kniko Howard’s Rise to Fame.pptxDraya Michele’s Son – Kniko Howard’s Rise to Fame.pptx
Draya Michele’s Son – Kniko Howard’s Rise to Fame.pptx
 
Tarun Gaur On Data Breaches and Privacy Fears
Tarun Gaur On Data Breaches and Privacy FearsTarun Gaur On Data Breaches and Privacy Fears
Tarun Gaur On Data Breaches and Privacy Fears
 
2023. Archive - Gigabajtos selfpublisher homepage
2023. Archive - Gigabajtos selfpublisher homepage2023. Archive - Gigabajtos selfpublisher homepage
2023. Archive - Gigabajtos selfpublisher homepage
 
202254.com香蕉影视,在线观看《我才不要和你做朋友呢》在线观看最新电影,香蕉影视在线观看《我才不要和你做朋友呢》在线观看高清电影
202254.com香蕉影视,在线观看《我才不要和你做朋友呢》在线观看最新电影,香蕉影视在线观看《我才不要和你做朋友呢》在线观看高清电影202254.com香蕉影视,在线观看《我才不要和你做朋友呢》在线观看最新电影,香蕉影视在线观看《我才不要和你做朋友呢》在线观看高清电影
202254.com香蕉影视,在线观看《我才不要和你做朋友呢》在线观看最新电影,香蕉影视在线观看《我才不要和你做朋友呢》在线观看高清电影
 
Why Your Business Needs a Professional Web Design Company UAE
Why Your Business Needs a Professional Web Design Company UAEWhy Your Business Needs a Professional Web Design Company UAE
Why Your Business Needs a Professional Web Design Company UAE
 
AWS Networking Basic , tanapat limsaiprom
AWS Networking Basic , tanapat limsaipromAWS Networking Basic , tanapat limsaiprom
AWS Networking Basic , tanapat limsaiprom
 
How-to-Diagnose-Hard-Drives-by-DFL-DDP-2024.pdf
How-to-Diagnose-Hard-Drives-by-DFL-DDP-2024.pdfHow-to-Diagnose-Hard-Drives-by-DFL-DDP-2024.pdf
How-to-Diagnose-Hard-Drives-by-DFL-DDP-2024.pdf
 
Information Systems Auditing, Controls and Assurance , tanapat limsaiprom
Information Systems Auditing, Controls and Assurance , tanapat limsaipromInformation Systems Auditing, Controls and Assurance , tanapat limsaiprom
Information Systems Auditing, Controls and Assurance , tanapat limsaiprom
 
Cyber Security Course & Guide. X.GI. pdf
Cyber Security Course & Guide. X.GI. pdfCyber Security Course & Guide. X.GI. pdf
Cyber Security Course & Guide. X.GI. pdf
 
Build a Professional Resume using Canva , Tanapat Limsaiprom
Build a Professional Resume using Canva , Tanapat LimsaipromBuild a Professional Resume using Canva , Tanapat Limsaiprom
Build a Professional Resume using Canva , Tanapat Limsaiprom
 
Top 50 Telephone Conversation Sample Examples For IT Industries.pdf
Top 50 Telephone Conversation Sample Examples For IT Industries.pdfTop 50 Telephone Conversation Sample Examples For IT Industries.pdf
Top 50 Telephone Conversation Sample Examples For IT Industries.pdf
 
Quiz Quiz Hota Hai (School Quiz 2018-19)
Quiz Quiz Hota Hai (School Quiz 2018-19)Quiz Quiz Hota Hai (School Quiz 2018-19)
Quiz Quiz Hota Hai (School Quiz 2018-19)
 
Effective Tips for Creating the Best Rich Media Ads .pptx
Effective Tips for Creating the Best Rich Media Ads .pptxEffective Tips for Creating the Best Rich Media Ads .pptx
Effective Tips for Creating the Best Rich Media Ads .pptx
 

Taking AppSec to 11 - BSides Austin 2016

  • 1. Taking AppSec to 11 AppSec Pipelines, DevOps, and Making Things Better. BSidess Austin 2016 Matt Tesauro, Infinitiv
  • 5. The Phoenix Project 3 Ways of DevOps Strategies for Improving Operations
  • 6. #1 - Workflow Look at your purpose and those processes which aid it
  • 7. Timeline Business Operations Customer Flow [rate] – the speed work goes through the process Development
  • 8. #1 Workflow First of the three ways - Each Step Repeatable - Never Pass on Defects - Local optimizations with a global view
  • 13. Key Features of AppSec Pipelines ◇ Designed for iterative improvement ◇ Provides a reusable path for AppSec activities to follow ◇ Provides a consistent process for both the team and our constituency ◇ One way flow with well-defined states ◇ Relies heavily on automation ◇ Grow in functionality organically over time ◇ Gracefully interconnects with the development process
  • 15. Integrating into the DevOps Pipeline DevOps Pipeline AppSec Pipeline
  • 16. “ Spending time optimizing anything other than the critical resource is an illusion. W. Edwards Deming
  • 17. Key Goals of AppSec Pipelines ◇ Optimize the critical resource - AppSec personnel ■ Automate all the things that don’t require a human brain ■ Drive up consistency ■ Increase tracking of work status ■ Increase flow through the system ■ Increase visibility and metrics ■ Reduce any dev team friction with application security
  • 18. Pipeline - Intake ◇ “First Impression” ◇ Major categories of Intake ■ Existing App ■ New App ■ Previously tested App ■ App to re-test findings ◇ Key Concepts ■ Ask for data about Apps only once ■ Have data reviewed when an App returns ■ Adapt data collected based on broad categories of Apps
  • 19. Pipeline - Testing ◇ Inbound request triage ◇ Ala Carte App Sec ■ Dynamic Testing ■ Static Testing ■ Re-Testing mitigated findings ■ Mix and match based on risk ◇ Key Concepts ■ Activities can be run in parallel ■ Automation on setup, configuration, data export ◇ People focus on customization rather than setup
  • 20. Pipeline - Testing ◇ Results from your CI/CD could flow into Threadfix from build Pipeline ◇ Gauntlt runs results could also flow into the AppSec Pipeline ◇ Choose the tools that make sense for you organization
  • 21. Pipeline - Deliver ◇ Source of truth for all AppSec activities ◇ ThreadFix is used to ■ Dedup / Consolidate findings ■ Normalize scanner data ■ Generate Metrics ■ Push issues to bug trackers ◇ Report and metrics automation ■ REST + tfclient ◇ Source of many touch points with external teams
  • 22. ◇ Allow us to have visibility into WIP ◇ Better understand/track/optimize flow of engagements ◇ Average static test takes ... ◇ Great increase in consistency ◇ Easier re-allocation of engagements between staff ◇ Each step has a well defined interface ◇ Knowing who has what allows for more informed “cost of switching” conversations ◇ Flexible enough for a range of skills and app maturity Why we like AppSec Pipelines
  • 23. ~5x increase 2014 44 assessments 2015 ~200 assessments Changes from 2014 to 2015: - Created the AppSec Pipeline - initial launch in March 2015 - AppSec team numbers dropped - lost a couple of key people approx 3.5 FTEs - Two of the AppSec team members went meta for most of 2015
  • 24. Bag of Holding aka BoH github.com/PearsonEducation/bag-of-holding
  • 25. ◇ Manages the Application Security Program ◇ Application Repository ◇ Engagement Tracking ◇ Report Repository ◇ Comments on any application, engagement or activity ◇ Data Classification and PII data ◇ Time taken on secure software activities ◇ Historical knowledge of past assessments ◇ Credential repository ◇ Environment details What does BoH do?
  • 29. Defect Dojo ◇ DefectDojo is a tool created by the Security Engineering team at Rackspace to track testing efforts. ◇ Streamlines the testing process by offering features such as templating, report generation, metrics, and baseline self-service tools. ◇ Though it was designed with security folks in mind, there is nothing keeping QA/QE testers, or any other testers for that matter, from using it productively. ◇ https://github.com/rackerlabs/django-DefectDojo
  • 31. Now with more OWASP!
  • 32. Open yourself to upstream and downstream information #2 - Improve Feedback
  • 35. Your command line where you have your conversations.
  • 38. Threadfix Integration And more: • Create an Application • Get Summary Metrics for AppSec Program
  • 40. Create a culture of innovation and experimentation #3 - Continual Experimentation & Learning
  • 42. “I fear not the man who has practiced ten thousand kicks once, but I fear the man who has practiced one kick ten thousand times.”
  • 44. Dev & AppSec Tool Integration OWASP ZAP Proxy BuildManageCode Store RAPTOR Deploy OWASP ZAP Proxy *Not a comprehensive list. The OWASP DevOps AppSec Pipeline will have a complete listing.
  • 47. Demo Time A quick bit of show and tell...
  • 48. Key Take Aways ◇ Automate, automate, automate ■ Look for “paper cuts” and fix those first ◇ Finding workflow – your AppSec Pipeline ■ Figure this out and standardize / optimize ◇ Create systems which can grow organically ■ App is never done, it’s just created to easily be added to over time ■ e.g. Finding blocks become templates for next report ◇ Learn to talk “dev”
  • 51. Orchestration ◇ Integrate Security Tools and Workflow Example: ◇ Generic API for dynamic scanning ■ URL ■ Credentials ■ Profile ■ Call any Dynamic Scanner: ○ OWASP ZAP ○ BurpSuite ○ AppScan
  • 52. Gauntlt ◇ Open source, MIT License ◇ Gauntlt comes with pre-canned steps that hook security testing tools ◇ Gauntlt does not install tools ◇ Gauntlt wants to be part of the CI/CD pipeline ◇ Be a good citizen of exit status and stdout/stderr
  • 53. Tiaga ◇ Project Management Software ■ Focused on usability and speed ■ Kanban / Scrum ■ Backlog ■ Tasks ■ Sprints ■ Issues ■ Wiki ◇ Open Source – Python / Django app ■ Entire functionality is driven by a REST API !! ■ https://taiga.io/
  • 56. Defect Dojo ◇ DefectDojo is a tool created by the Security Engineering team at Rackspace to track testing efforts. ◇ Streamlines the testing process by offering features such as templating, report generation, metrics, and baseline self-service tools. ◇ Though it was designed with security folks in mind, there is nothing keeping QA/QE testers, or any other testers for that matter, from using it productively. ◇ https://github.com/rackerlabs/django-DefectDojo
  • 59. Findings directly to bug trackers ◇ PDFs are great, bugs are better ◇ Security issues are now part of the normal work flow ◇ ThreadFix is nice for pumping issues into defect trackers - http://code.google.com/p/threadfix/
  • 60. For the reticent: nag, nag, nag ◇ Attach a SLA to each severity level for findings ◇ Walk up the Org chart as things get older ◇ Bonus points for dashboards and defect tracker APIs ◇ Get management sold first
  • 61. Agent – one mole to rule them all ◇ Add an agent to the standard deploy ◇ Add a dashboard to visualize state of infrastructure ◇ Roll your own or find a vendor Mozilla MIG
  • 62. Turn Vuln Scanning on its Head ◇ Add value for your Ops teams ◇ Roll your own or find a vendor ◇ Reverse the scan then report standard
  • 63. Related Presentations AppSec EU 2015 – Ops Track Keynote http://www.slideshare.net/mtesauro/mtesauro-keynote-appseceu https://www.youtube.com/watch?v=tDnyFitE0y4 AppSec EU 2015 – Building an AppSec Pipeline http://www.slideshare.net/weaveraaaron/building-an-appsec- pipeline-keeping-your-program-and-your-life-sane https://www.youtube.com/watch?v=1CDSOSl4DQU
  • 65. #1 Workflow Each Step Repeatable ◇ Remove all haphazard and ad hoc work from the process ◇ Scripting languages are your friends ◇ Config Mgmt – Puppet, Chef, Salt, Ansible, CFEngine ◇ Make sure what you do can be done on 1 server or 10,000 servers
  • 66. #1 Workflow Never Pass on Defects ◇ Test early and often ◇ Increase the rigor of testing as you work left to right ◇ When a failure occurs end that flow and start a new one after corrections ◇ The further right you are, the more expensive failure is so concentrate your early work on left side (intake) ◇ In AppSec, defects are false positives
  • 67. #1 Workflow Local optimizations with a global view ◇ Ensure no single-step optimizations degrade the overall performance of the workflow ◇ Find the bottleneck in your workflow and start there ■ Upstream changes will just back things up ■ Downstream changes won't manifest since input is limited ◇ Each new optimization creates a new bottleneck ■ Iterate on this!
  • 68. “ Spending time optimizing anything other than the critical resource is an illusion.
  • 71. Henry Ford in a field: http://henryfordgiantdifferenceaward.weebly.com/works-cited.html Assembly Lines: http://www.pictofcar.website/henry-ford-assembly-line-diagram/ http://www.fasttrackteaching.com/burns/Unit_3_Industry/U3_Ford.html http://en.wikipedia.org/wiki/Assembly_line http://actionspeaksradio.org/tag/henry-ford/ http://blogs.internetautoguide.com/6582595/manufacturing/henry-ford-didnt-invent-the-assembly-line- ransom-e-olds-did/index.html W. Edward Deming http://www.motortrend.com/features/consumer/1005_30_who_count/photo_04.html Japan's Post War Miracle http://www2.fultonschools.org/teacher/robertsw1/thursday.nov1.htm http://dylewski.com.pl/menu-boczne/iluzja-pieniadza/usa-vs-japonia/ http://en.wikipedia.org/wiki/Japanese_post-war_economic_miracle Image References
  • 72. Thomas Edison: http://www.allposters.com/-sp/Thomas-Edison-Posters_i1859026_.htm Food line: http://www.slideshare.net/weaveraaaron/building-an-appsec-pipeline-keeping-your-program-and-your-life- sane Phoenix Project Book Cover: https://puppetlabs.com/blog/why-we-need-devops-now Goes to 11: https://arturogalletti.files.wordpress.com/2010/12/spinaltap.jpg Image References
  • 73. What’s this? This is a free presentation template for Google Slides designed by SlidesCarnival. We believe that good design serves to better communicate ideas, so we create free quality presentation templates for you to focus on the content. Enjoy them at will and share with us your results at: twitter.com/SlidesCarnival facebook.com/slidescarnival About this template How can I use it? Open this document in Google Slides (if you are at slidescarnival. com use the button below this presentation) You have to be signed in to your Google account ◇ Edit in Google Slides Go to the File menu and select Make a copy. You will get a copy of this document on your Google Drive and will be able to edit, add or delete slides. ◇ Edit in Microsoft PowerPoint® Go to the File menu and select Download as Microsoft PowerPoint. You will get a .pptx file that you can edit in PowerPoint. Remember to download and install the fonts used in this presentation (you’ll find the links to the font files needed in the Presentation design slide) This template is free to use under Creative Commons Attribution license. If you use the graphic assets (photos, icons and typographies) provided with this presentation you must keep the Credits slide.