Découvrez le Rugged DevOps
•Download as PPTX, PDF•
2 likes•330 views
Retrouvez les slides du Petit déjeuner « Découvrez le Rugged DevOps » organisé le 15 juin chez Microsoft.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Découvrez le Rugged DevOps
Similar to Découvrez le Rugged DevOps (20)
Recently uploaded
Recently uploaded (20)
Découvrez le Rugged DevOps
- 1. ©2017 Avanade Inc. All Rights Reserved.©2017 Avanade Inc. All Rights Reserved.
- 2. A road to DevSecOps : Rugged DevOps Pierre-Henri Gache Guillaume Oudill Michel Perfetti Georges Rodrigues Sophie Tonnoir
- 3. Avanade GALLIA TC Security
- 4. ©2017 Avanade Inc. All Rights Reserved. Security… a challenge to enable Digital & Cloud With Cloud and Digital initiatives at the heart of today’s IT landscape, new risks and threats bring an evolution in the way security must be addressed. • How to facilitate users’ experience and protect my IT assets? • How can I prevent threats of data loss, data leakage or misusage ? • Does it meet Industry & Regulation Compliance criteria (PCI DSS, SOX, Solvency, GDPR) ? • Can we monitor Access Control (Identities, mobility, APIs, CSPs) ? • How can I protect my most valuable asset: the information/data? • … Protecting Information Cloud Many concerns & questions Digital Securing Application & Infrastructure Managing Identity & Access Avanade answers Aim Securing Endpoint
- 5. ©2017 Avanade Inc. All Rights Reserved. • Because security is at the heart of today’s IT revolution, we aim at combining best of both world to provide our customer the best experience in securing their IT infrastructure. We provide the ability to carry out business-driven initiatives while addressing security as a business enabler at the users, infrastructure and applications level. In a nutshell Workforce & experience • Security expertise in Identity & Access Management, Infrastructure Security and Data Protection • Certified consultants on security solutions Various technologies Security domains • Authentication, SSO and cloud enablement • AD & O365 Security • DevSecOps • Privileged Accounts • Identity Governance • CASBs Our engagements Consulting Transformation ( Design / Build ) Managed Services (Run) Fixed Price and T&M Buy&resell • More than 29 000 collaborators • 800+ customers worldwide • 70+ locations in 23 countries • 95% Customer Sat rating
- 6. Avanade GALLIA TC Agile & DevOps coaching
- 7. ©2017 Avanade Inc. All Rights Reserved. talentagile.com
- 8. Rugged DevOps Sophie TONNOIR Georges RODRIGUES
- 9. ©2017 Avanade Inc. All Rights Reserved. Software is eating up the world
- 10. ©2017 Avanade Inc. All Rights Reserved. AppSec 2015-2017 Attacks increased 25% US Office of Personnel Management 19,7 Tesco Bank 40,00 0 accounts Vodafone 200 0 customer Carphone Warehouse 2,5 M customer Charlie Hebdo 19,0 00 website s Russian Cyber Attack On France Electi
- 11. ©2017 Avanade Inc. All Rights Reserved. Software Design : how much of my software is actually mine? 80% 20% open source Custom 80% of your applications …are open source * Data based on maven central repository, by Sonatype
- 12. ©2017 Avanade Inc. All Rights Reserved. Microsoft is changing Microsoft is embracing the open source!
- 13. ©2017 Avanade Inc. All Rights Reserved. Did you know using the following tools makes your code vulnerable ? Those are just few examples, different versions could generate even worth… EntLib 4.1 : CVE-2009-3275, CVE-2015-2264 Successful attack could allow attackers to crash application or CPU consumption and to cause denial of service. Telerik : CVE-2015-2264, CVE-2014-4958, CVE-2014-2217 Local users can gain privileges, XSS vulnerability. ComponentOne : CVE-2012-0227, CVE-2008-4827, CVE-2008-4132, CVE-2007-6028 Buffer Overflow, denial of service. MongoDB : 8 vulnerabilities ! MySQL : 244 vulnerabilities !!!! Why Securing Libraries or Dependencies ? 13 | Examples from existing solutions 80% of your applications …are open source * Data based on maven central repository, by Sonatype 80% 20% open source Custom
- 14. ©2017 Avanade Inc. All Rights Reserved. How is my repository security ? 8 years later, vulnerable versions of Bouncy Castle were downloaded… 5.7M times CVE-2007-6721 CVSS Base Score: 10.0 HIGH Impact Subscore: 10.0 Exploitability Subscore: 10.0 2007 2015 Castles (and Things) are Lurking…
- 15. ©2017 Avanade Inc. All Rights Reserved. Visualization of open source dependencies Hundreds of thousands of open source suppliers and millions of components
- 16. ©2017 Avanade Inc. All Rights Reserved. 16 Dependency Graph Example
- 17. ©2017 Avanade Inc. All Rights Reserved. 17 • Your own code is vulnerable • Two methods: 1. SAST: Static Application Security Testing: source analysis 2. DAST: Dynamic Application Security Testing : running application analysis • Use the right tool for the right job • The sooner the better • Main objective: to avoid a long security review before deployment (Time To Market) Packages are secured, what’s next?
- 18. ©2017 Avanade Inc. All Rights Reserved. Rugged Triangle DAST SAST Rugged Devops SCA DAST: Dynamic Application Security Testing SAST: Static Application Security Testing SCA: Software Component Analysis
- 19. ©2017 Avanade Inc. All Rights Reserved. Secure continuous software delivery Packages Code source Build Analyze Compliance KO Developers Check Compliance to policies Detect vulnerabilities
- 20. Monitoring opensource code with WhiteSource @ALMRangers Michel Perfetti
- 21. ©2017 Avanade Inc. All Rights Reserved. 21 Who are we? We are a group of around 100 part-time volunteer engineers and 2 full-time Ranger PMs, scattered across the globe. Mission The Visual Studio ALM Rangers provide professional guidance, practical experience and gap- filling solutions to the developer community. What do we do? We are focused primarily on the delivery of out-of-band tooling and practical guidance to remove adoption blockers in real world environments. Microsoft ALM Rangers
- 22. ©2017 Avanade Inc. All Rights Reserved. 22 • The ALM Rangers create VSTS/TFS Extensions • A VSTS/TFS Extensions • Is written in Javascript • Runs on the cloud or on your server • Accesses your data with your credentials • Uses open source javascript libraries to work • What we don’t want: • Add a backdoor to your data with our code • Developpers avoid using our extensions because they are not secure Context
- 23. ©2017 Avanade Inc. All Rights Reserved. 23 • Security • Detect vulnerability • Provide actions to fix • License Compliance management • Inventory • Integration • Bug tracking Whitesource
- 24. ©2017 Avanade Inc. All Rights Reserved. 24 • 21 products • 31 different OSS licences • We reject explicitly some licences (like GPL) • Throught whitesource policy • 1600 open source libraries • Folder management: 0 OSS according the team: 458 OSS libraries • Countdown widget: 5 OSS according the team: 693 OSS libraries Current status
- 25. ©2017 Avanade Inc. All Rights Reserved. The countdown widget Demo 25
- 26. Hands On
- 27. ©2017 Avanade Inc. All Rights Reserved. Dependencies Analysis with Lifecycle Démo - Guillaume Oudill
- 28. ©2017 Avanade Inc. All Rights Reserved. Secure continuous software delivery Packages Code source Build Analyze Compliance KO Developers Check Compliance to policies Detect vulnerabilities
- 29. ©2017 Avanade Inc. All Rights Reserved. Code analysis with Checkmarx Démo - Pierre-Henri Gache
- 30. ©2017 Avanade Inc. All Rights Reserved. Secure continuous software delivery Packages Code source Build Analyze Compliance KO Developers Check Compliance to policies Detect vulnerabilities
- 32. ©2017 Avanade Inc. All Rights Reserved. 32 On retrouve deux types de faux positifs : 1. Un résultat d’analyse qui se révèle ne pas être une vulnérabilité 2. Une vulnérabilité partiellement exploitable Qu’est ce qu’un faux positif ?
- 33. ©2017 Avanade Inc. All Rights Reserved. 33 Pas de “recette miracle” : il faut parcourir chaque résultat Pour chacun il faut analyser son origine et la pertinence de l’analyse Analyser les résultats
- 34. ©2017 Avanade Inc. All Rights Reserved. Entrée utilisateur Vulnérabilité Sortie écran / BDD 34 Qualifier une vulnérabilité
- 35. ©2017 Avanade Inc. All Rights Reserved. ALM Team Dev Security Ops 35 Un travail d’équipe L’équipe ALM maintient les outils et est le relais de la sécurité L’équipe sécurité valide les faux positifs Les développeurs fournissent les information nécessaires à la qualification de la vulnérabilité Les Ops sont en support pour les pentests
- 36. ©2017 Avanade Inc. All Rights Reserved. The web application uses the wrong kind of encoding to protect against Cross-Site Scripting (XSS), specifically using standard HTML encoding, HtmlEncode at srcOrchard.WebModulesOrchard.ContentPickerViewsEditorTemplatesParts.ContentMenuItem.E dit.cshtml:1, to output JavaScript. Premier exemple 36
- 37. ©2017 Avanade Inc. All Rights Reserved. Second exemple 37
- 38. ©2017 Avanade Inc. All Rights Reserved. 38 On retrouve peu de faux positifs dans le résultat des analyses. La complexité est ailleurs : • Comprendre et qualifier les vulnérabilités • Déterminer le niveau de criticité • Mettre en place un plan de remédiation Les faux positifs : un vrai problème ?
- 39. ©2017 Avanade Inc. All Rights Reserved. • Comparaison du résultat des outils avec ceux des pentests • Mise à jour de règles pour prendre en compte ces différences • Répéter ce processus après chaque pentest Dev Analyse DéploiementPentests Correctifs 39 Faux négatifs & Pentests
- 40. Road to DevSecOps? Sophie TONNOIR Georges RODRIGUES
- 41. ©2017 Avanade Inc. All Rights Reserved. Securing the application : How to industrialize and automate? Application security is often considered a last challenge to go through (or around) before going into production …
- 42. ©2017 Avanade Inc. All Rights Reserved. Secure continuous software delivery Packages Code source Build Analyze Compliance KO Developers Check Compliance to policies Detect vulnerabilities
- 43. ©2017 Avanade Inc. All Rights Reserved. What is DevSecOps ? The purpose and intent of DevSecOps is to build on the mindset that "everyone is responsible for security" with the goal of safely distributing security decisions at speed and scale to those who hold the highest level of context without sacrificing the safety required. The Rugged Manifesto ...I recognize that software has become a foundation of our modern world. I recognize that my code will be attacked by talented and persistent adversaries who threaten our physical, economic and national security. I recognize these things – and I choose to be rugged. I am rugged because I refuse to be a source of vulnerability or weakness. http://www.ruggedsoftware.org/ http://www.devsecops.org/
- 44. Questions ?
- 45. Merci! Pierre-Henri Gache @phgache http://www.pierrehe nrigache.com Michel Perfetti @Miiitch http://www.buildme imfamous.net Georges Rodrigues Sophie Tonnoir @sophietonnoir Guillaume Oudill @guillaumeoudill http://guillaumeoud illblog.wordpress.co m
- 46. ©2017 Avanade Inc. All Rights Reserved.©2017 Avanade Inc. All Rights Reserved.
Editor's Notes
- Qui est familier du devops? Question à l’auditoire
- Dans vos lampes Dans vos maisons, Dans votre electroménager Dans l’administration Il y a du software pour tout avec l’explosion de l’IOT, machine learning, IA…
- attacks on the application layer are growing by more than 25 percent annually (Akamai Q3 2015 State of the Internet - Security Report). US Office of Personnel Management This breach was one of the biggest ever of US government systems. Although not proved, the attack was believed to be perpetrated by Chinese hackers. The data theft consisted of stealing addresses, health and financial details of 19.7 million people who had been subjected to government background checks as well as 1.8 million others. Carphone Warehouse One of the biggest breaches in the UK this year was when the details of almost 2.5 million customers was stolen http://www.information-age.com/top-10-most-devastating-cyber-hacks-2015-123460657/ http://www.welivesecurity.com/2016/12/30/biggest-security-incidents-2016/ http://www.cbsnews.com/news/france-hit-by-19000-cyber-attacks-after-charlie-hebdo-terror-attacks/ http://en.rfi.fr/europe/20170219-french-fm-ayrault-accuses-russia-election-cyberattacks
- Il y avait moins d’open source il y a 10 ans,
- Microsoft on github by business insider http://uk.businessinsider.com/microsoft-github-open-source-2016-9?r=US&IR=T Microsoft today counts on open source developers to feed azure with applications. Nadella in 2014 said, "Microsoft loves Linux". http://www.infoworld.com/article/3042699/open-source-tools/microsoft-loves-open-source-only-when-its-convenient.html http://www.zdnet.com/article/why-microsoft-is-turning-into-an-open-source-company/ Ex : Xamarin for Visual Studio free and opensource
- Failles sans que les dev ne le sachent, on introduit des failles de sécu sans le savoir Entlib is a collection of reusable software components designed to assist software developers (such as logging, validation, data access). Application blocks are provided source code, test cases and documentation. Telerik : UI frameworks and app development tools ComponentOne Studio provides enterprise application developers with innovative UI and data management controls for all major platforms.
- Bounty castle is a cryptography Exemple de repository avec des failles découvertes en 2007 et pourtant encore téléchargé en 2015
- Visualization of maven central, those organic looking dust mites represent components and their dependencies to other components. Qu’utilisez-vous comme dependances ? Maitrisez-vous bien votre code open source ? Cb de dépendances avez-vous ? On connait juste le haut du paquet Dépendances non connues rajoutées par les IDE (utilisées ?)
- SAST: Static Application Security Testing DAST: Dynamic Application Security Testing SCA: Software component analysis DAST teste une application Web en cours d'exécution (les requêtes et les réponses) selon des techniques similaires à celles utilisées par un pirate informatique. SAST examine le code source d'une application afin de détecter les vulnérabilités potentielles. SCA Open source components Checkmarx SAST et SCA Sonatype SCA Exemple DAST : acunetix, IBM, HPE, PortSwigger
- More test, more checks, more visibility to each key player Parler ROI,TTM,CDepl.
- https://blogs.msdn.microsoft.com/visualstudioalmrangers/2017/01/17/manage-your-open-source-usage-and-security-in-your-pipeline/
- https://blogs.msdn.microsoft.com/visualstudioalmrangers/2017/06/08/manage-your-open-source-usage-and-security-as-reported-by-your-cicd-pipeline/
- More test, more checks, more visibility to each key player Parler ROI,TTM,CDepl.
- More test, more checks, more visibility to each key player Parler ROI,TTM,CDepl.
- For a developer : security officers are simply always standing in the way, they force rather tiring procedures (pen testing, waf, code audit) right before production which usually creates change requests that adds time and money to an almost done project. HP published a paper that says while devops should theoretically improve the security it does the opposite. From their point of view it failed to improve security http://www.computerweekly.com/news/450401645/DevOps-largely-failing-to-improve-security-study-shows
- More test, more checks, more visibility to each key player
- http://www.devsecops.org/ http://www.ruggedsoftware.org/
- Guillaume Oudill @guillaumeoudill guillaumeoudillblog.wordpress.com