The "Ops" Side of DevSecOps
•
1 like•703 views
Damon Edwards, co-founder of Rundeck, presentation at Nexus Conf 2018 on how Security teams can help Operations and, in turn, help themselves. See a Demo of Rundeck Enterprise : https://www.rundeck.com/see-demo --or-- Download Rundeck Open Source here: https://rundeck.com/open-source Connect: Stack Overflow community: https://stackoverflow.com/questions/tagged/rundeck Github: https://github.com/rundeck/rundeck/issues Twitter: https://twitter.com/Rundeck Facebook: https://www.facebook.com/RundeckInc/ LinkedIn: www.linkedin.com › company › rundeck-inc
Recommended
More Related Content
What's hot
What's hot (20)
Similar to The "Ops" Side of DevSecOps
Similar to The "Ops" Side of DevSecOps (20)
More from Rundeck
More from Rundeck (20)
Recently uploaded
Recently uploaded (20)
The "Ops" Side of DevSecOps
- 1. The “Ops” Side of DevSecOps Damon Edwards @damonedwards DevSecOps@RSA AJP - 25 July 2017
- 6. Now here comes DevSecOps DevOps
- 7. Now here comes DevSecOps Dev Ops
- 8. Now here comes DevSecOps Dev OpsSec
- 9. Now here comes DevSecOps Dev OpsSec
- 10. Now here comes DevSecOps Dev OpsSec
- 11. Operations is getting squeezed OpsBusiness Idea Shorter Time-to-Market Fast Feedback from Users Dev Ops Running Services Improved Quality Digital and DevOps Availability Auditing Security Compliance "Go faster!" “Be flexible!” “Lock it down!”
- 12. Operations is getting squeezed OpsBusiness Idea Shorter Time-to-Market Fast Feedback from Users Dev Ops Running Services Improved Quality Digital and DevOps Availability Auditing Security Compliance "Go faster!" “Be flexible!” “Lock it down!”
- 13. What Keeps Ops Under This Pressure? Silos Queues Centralization Backlog Information I need X PrioritiesTools Backlog I do X Requests for X Silo A Information Priorities Silo B Tools ?? Silo A Silo B Ticket Queue
- 15. Backlog Information I need X PrioritiesTools Silos
- 16. Backlog Information I need X PrioritiesTools Silos Backlog I do X Requests for X Silo A Information Priorities Silo B Tools
- 17. Silos cause disconnects and mismatches Backlog Information I need X PrioritiesTools Backlog I do X Requests for X Silo A Information Priorities Silo B Tools Context Context Process Process Tooling Tooling Capacity Capacity
- 18. Function A Function B Function C Org becomes siloed pools of functional specialists Requests fulfilled by semi- manual or manual effort Primary management focus is on protecting team capacity
- 19. How do we cover for our silos disconnects and mismatches? Silo A Silo B
- 20. How do we cover for our silos disconnects and mismatches? Silo A Silo B Ticket Queue
- 21. ?? Silo A Silo B We all know how well that works Ticket Queue
- 22. Request queues are an expensive way to manage work Ticket Queue Queues Create… Longer Cycle Time Increased Risk More Variability More Overhead Lower Quality Less Motivation Adapted from Donald G. Reinertsen, The Principles of Product Development Flow: Second Generation Lean Product Development
- 23. Tickets queues become “snowflake makers” ?? Silo A Silo B Ticket Queue
- 24. Tickets queues become “snowflake makers” ?? Silo A Silo B Ticket Queue Snowflakes (each unique, technically acceptable but unreproducible and brittle)
- 25. Tickets queues become “snowflake makers” ?? Silo A Silo B Ticket Queue Snowflakes (each unique, technically acceptable but unreproducible and brittle) Unintended variability = Security risks!
- 26. Where are decisions made? Who can take action? escalate 1° 2° 3° 4° escalate escalateor
- 27. Where are decisions made? Who can take action? escalate 1° 2° 3° 4° escalate escalateor Most common decision methods: 1. Similar history 2. Folklore 3. Mostly guessing
- 28. All work is contextual John Allspaw
- 29. All work is contextual rm -rf $PATHNAME John Allspaw
- 30. All work is contextual rm -rf $PATHNAME Is this dangerous? John Allspaw
- 31. All work is contextual rm -rf $PATHNAME John Allspaw
- 32. All work is contextual rm -rf $PATHNAME John Allspaw
- 33. All work is contextual rm -rf $PATHNAME Is this dangerous? John Allspaw
- 34. All work is contextual rm -rf $PATHNAME John Allspaw
- 35. All work is contextual rm -rf $PATHNAME Answer is always “it depends” John Allspaw
- 36. escalate 1° 2° 3° 4° escalate escalateor Context Where are decisions made? Who can take action?
- 37. “Shift Left” the ability to take action Push the ability to take action this direction escalate 1° 2° 3° 4° escalate escalateor
- 38. How can you help operations? (and help yourself) OpsBusiness Idea Shorter Time-to-Market Fast Feedback from Users Dev Ops Running Services Improved Quality Digital and DevOps Availability Auditing Security Compliance "Go faster!" “Be flexible!” “Lock it down!” Silos Queues Centralization Backlog Information I need X PrioritiesTools Backlog I do X Requests for X Silo A Information Priorities Silo B Tools ?? Silo A Silo B Ticket Queue
- 39. How can you help operations? (and help yourself) OpsBusiness Idea Shorter Time-to-Market Fast Feedback from Users Dev Ops Running Services Improved Quality Digital and DevOps Availability Auditing Security Compliance "Go faster!" “Be flexible!” “Lock it down!” Silos Queues Centralization Backlog Information I need X PrioritiesTools Backlog I do X Requests for X Silo A Information Priorities Silo B Tools ?? Silo A Silo B Ticket Queue
- 40. How can you help operations? (and help yourself) OpsBusiness Idea Shorter Time-to-Market Fast Feedback from Users Dev Ops Running Services Improved Quality Digital and DevOps Availability Auditing Security Compliance "Go faster!" “Be flexible!” “Lock it down!” Silos Queues Centralization Backlog Information I need X PrioritiesTools Backlog I do X Requests for X Silo A Information Priorities Silo B Tools ?? Silo A Silo B Ticket Queue Self-Service
- 41. How can you help operations? (and help yourself) OpsBusiness Idea Shorter Time-to-Market Fast Feedback from Users Dev Ops Running Services Improved Quality Digital and DevOps Availability Auditing Security Compliance "Go faster!" “Be flexible!” “Lock it down!” Silos Queues Centralization Backlog Information I need X PrioritiesTools Backlog I do X Requests for X Silo A Information Priorities Silo B Tools ?? Silo A Silo B Ticket Queue Self-Service
- 42. How do we decentralize control, but stay under control?
- 43. Automated Procedures have three essential elements Definition of the automated procedure Execution of the automated procedure Governance of the automated procedure Define Execute Govern
- 44. Automated Procedures have three essential elements Definition of the automated procedure Execution of the automated procedure Governance of the automated procedure Define Execute Govern (security, oversight, compliance, etc.)
- 45. Traditional Ops Silo Define Execute Govern “Consumers of Ops” (Dev, QA, Release, NOC, Security, etc.) Ops
- 46. Rigid Self-Service Define Execute Govern “Consumers of Ops” (Dev, QA, Release, NOC, Security, etc.) Ops
- 47. Define Execute Govern Execute “Consumers of Ops” (Dev, QA, Release, NOC, Security, etc.) Ops Rigid Self-Service (ends up being limited)
- 48. High-Velocity Handoffs Define Govern Execute “Consumers of Ops” (Dev, QA, Release, NOC, Security, etc.) Ops
- 49. Self-Service Operations Define Govern Execute “Consumers of Ops” (Dev, QA, Release, NOC, Security, etc.) Ops
- 50. Self-Service Operations Define Govern Execute Govern “Consumers of Ops” (Dev, QA, Release, NOC, Security, etc.) Ops
- 51. “Operations as a Service” design pattern is the key enabler fdfd Operations as a Service E Define/Approve actions Define security policy Oversight Define actions Execute actions Execute actions Ops“Consumers of Ops” (Dev, QA, Release, NOC, etc.) D G
- 52. “Operations as a Service” design pattern is the key enabler Split definition, execution, and governance and move to where most effective use of labor fdfd Operations as a Service E Define/Approve actions Define security policy Oversight Define actions Execute actions Execute actions Ops“Consumers of Ops” (Dev, QA, Release, NOC, etc.) D G
- 53. Building out your Operations as a Service capability
- 54. Step 1: Establish a Secure Ops Hub Operations as a Service Engineers get visibility and controlled self-service Secrets Ops Procedures “Status” “Firewall Change” "Restart" deny allow Identity Audit Logs Infrastructure view Service health System metrics Ops Support use for remediation procedures Inventory and Health Execute + Observability/Monitoring Security and Ops manages access, configuration, and compliance
- 55. Step 2: Establish a SDLC for Ops Procedures Operations as a Service Engineers get visibility and controlled self-service Secrets Ops Procedures “Status” “Firewall Change” "Restart" deny allow Identity Audit Logs Infrastructure view Service health System metrics Ops Support use for remediation procedures Inventory and Health Execute Source Repo if (($state==wait)) then kill -9 $PID fi Change Product Engineers produce automated procedures and health checks. RISKY Automated Procedures and Health Checks FIX Code review + Observability/Monitoring Security and Ops manages access, configuration, and compliance Package Repo CI
- 56. Step 3: Connect with Enterprise Management Systems Service Desk CustomersOps Support get visibility and audit trail updated by support tools Service Ticket Execute Software Supply Chain Ops integrate with artifact flow Operations as a Service Engineers get visibility and controlled self-service Secrets Ops Procedures “Status” “Firewall Change” "Restart" deny allow Identity Audit Logs Infrastructure view Service health System metrics Ops Support use for remediation procedures Inventory and Health + Monitoring Tools Security and Ops manages access, configuration, and compliance Source Repo if (($state==wait)) then kill -9 $PID fi Change Product Engineers produce automated procedures and health checks. RISKY Automated Procedures and Health Checks FIX Code review Package Repo CI
- 57. Step 4: Reap the security and compliance benefits Service Desk CustomersOps Support get visibility and audit trail updated by support tools Service Ticket Execute Software Supply Chain Ops integrate with artifact flow Who reviewed it? Who ran it? When? Where? Approval trail? Who created the procedure? Who created the policy? Operations as a Service Engineers get visibility and controlled self-service Secrets Ops Procedures “Status” “Firewall Change” "Restart" deny allow Identity Audit Logs Infrastructure view Service health System metrics Ops Support use for remediation procedures Inventory and Health + Monitoring Tools Security and Ops manages access, configuration, and compliance Source Repo if (($state==wait)) then kill -9 $PID fi Change Product Engineers produce automated procedures and health checks. RISKY Automated Procedures and Health Checks FIX Code review Package Repo CI
- 58. Recap Understand the pressure on Ops Leverage the Operations as a Service design pattern “Shift-Left” control and decision making. Queues Create… Longer Cycle Time Increased Risk More Variability More Overhead Lower Quality Less Motivation Adapted from Donald G. Reinertsen, The Principles of Product Development Flow: Second Generation Lean Product Development Understand the cost of silos and queues Self-service to remove silos and queues OpsBusiness Idea Shorter Time-to-Market Fast Feedback from Users Dev Ops Running Services Improved Quality Digital and DevOps Availability Auditing Security Compliance "Go faster!" “Be flexible!” “Lock it down!” Team A (Dev) Team B (Ops) Ticket System ?? Service Desk CustomersOps Support get visibility and audit trail updated by support tools Service Ticket Execute Software Supply Chain Ops integrate with artifact flow Who reviewed it? Who ran it? When? Where? Approval trail? Who created the procedure? Who created the policy? Operations as a Service Engineers get visibility and controlled self-service Secrets Ops Procedures “Status” “Firewall Change” "Restart" deny allow Identity Audit Logs Infrastructure view Service health System metrics Ops Support use for remediation procedures Inventory and Health + Monitoring Tools Security and Ops manages access, configuration, and compliance Source Repo if (($state==wait)) then kill -9 $PID fi Change Product Engineers produce automated procedures and health checks. RISKY Automated Procedures and Health Checks FIX Code review Package Repo CI Reap the security and compliance benefits
- 59. Recap Understand the pressure on Ops Leverage the Operations as a Service design pattern “Shift-Left” control and decision making. Queues Create… Longer Cycle Time Increased Risk More Variability More Overhead Lower Quality Less Motivation Adapted from Donald G. Reinertsen, The Principles of Product Development Flow: Second Generation Lean Product Development Understand the cost of silos and queues Self-service to remove silos and queues OpsBusiness Idea Shorter Time-to-Market Fast Feedback from Users Dev Ops Running Services Improved Quality Digital and DevOps Availability Auditing Security Compliance "Go faster!" “Be flexible!” “Lock it down!” Team A (Dev) Team B (Ops) Ticket System ?? Service Desk CustomersOps Support get visibility and audit trail updated by support tools Service Ticket Execute Software Supply Chain Ops integrate with artifact flow Who reviewed it? Who ran it? When? Where? Approval trail? Who created the procedure? Who created the policy? Operations as a Service Engineers get visibility and controlled self-service Secrets Ops Procedures “Status” “Firewall Change” "Restart" deny allow Identity Audit Logs Infrastructure view Service health System metrics Ops Support use for remediation procedures Inventory and Health + Monitoring Tools Security and Ops manages access, configuration, and compliance Source Repo if (($state==wait)) then kill -9 $PID fi Change Product Engineers produce automated procedures and health checks. RISKY Automated Procedures and Health Checks FIX Code review Package Repo CI Reap the security and compliance benefits https://www.rundeck.com/oaas