Shifting Security Left - The Innovation of DevSecOps - AgileDC

Shifting Security Left - The Innovation of DevSecOps - AgileDC

• 1.
  © COPYRIGHT 2019COVEROS, INC. ALL RIGHTS RESERVED. 1@ThomasStiehm #AgileDC Agility. Security. Delivered. Shifting Security Left The Innovation of DevSecOps Tom Stiehm @ThomasStiehm
• 2.
  © COPYRIGHT 2019COVEROS, INC. ALL RIGHTS RESERVED. 2@ThomasStiehm #AgileDC About Coveros • Services • Agile Transformations & Coaching • Agile Software Development • Agile Testing & Automation • DevOps Implementations • DevSecOps Integrations • Agile, DevOps, DevSecOps Security, Testing Training • Open Source Products • SecureCI – DevSecOps toolchain • Selenified – Agile test framework Coveros helps organizations accelerate software delivery using agile and DevOps methods 2
• 3.
  © COPYRIGHT 2019COVEROS, INC. ALL RIGHTS RESERVED. 3@ThomasStiehm #AgileDC Why should you care about security? To reduce the likelihood of becoming the next:
• 4.
  © COPYRIGHT 2019COVEROS, INC. ALL RIGHTS RESERVED. 4@ThomasStiehm #AgileDC Shifting Security Left •Shifting Left is taking a practice or process done late in development and doing it earlier. •Shifting Security Left is doing security testing, analysis, and remediation during development, iteratively. Usually automating data collection to make it faster and cheaper. •The net result is making security practices part of the daily workflow of the development team.
• 5.
  © COPYRIGHT 2019COVEROS, INC. ALL RIGHTS RESERVED. 5@ThomasStiehm #AgileDC Why Shift Security Left? Application Security is hard, error prone, and expensive. It is often made harder by trying to shoehorn it into the end of a release. Shifting Left allows the teams to deal with security issues early and often: •Reducing Risk •Reducing Cost •Leads to fewer errors •Results in fewer security compromises
• 6.
  © COPYRIGHT 2019COVEROS, INC. ALL RIGHTS RESERVED. 6@ThomasStiehm #AgileDC How DevSecOps builds on DevOps DevSecOps is a practice that rose from DevOps that includes information technology security as a fundamental aspect in all the stages of software development. -- Wikipedia DevSecOps builds on DevOps by leveraging collaboration and feedback to address security concerns throughout the software development life cycle.
• 7.
  © COPYRIGHT 2019COVEROS, INC. ALL RIGHTS RESERVED. 7@ThomasStiehm #AgileDC Legacy Security Practices The Focus is on testing at the end.
• 8.
  © COPYRIGHT 2019COVEROS, INC. ALL RIGHTS RESERVED. 8@ThomasStiehm #AgileDC Security before the code is written Be proactive: •Architect and design security in from the start based on threat analysis. •Include security in your pipeline from the start. •Take time to analyze and remediate AppSec findings. Why? •Your software has security defects in it. •Testing security into software at the end doesn’t work. •Relying on network and OS security to protect applications doesn’t work. •Ignoring security concerns doesn’t work.
• 9.
  © COPYRIGHT 2019COVEROS, INC. ALL RIGHTS RESERVED. 9@ThomasStiehm #AgileDC Shifting Left includes reacting to the feedback on a regular basis. Security Practices in DevSecOps
• 10.
  © COPYRIGHT 2019COVEROS, INC. ALL RIGHTS RESERVED. 10@ThomasStiehm #AgileDC Where to Start •SCA - Install Software Composition Analysis •Expand existing CI/CD processes to scan your application dependencies •SAST - Start with Static Application Security Testing •Quick to integration into a build pipeline •Leverages existing CI/CD assets •DAST - Next integrate Dynamic Application Security Testing •Could be as simple as adding a DAST proxy to your existing automated or manual testing environment •Expand into using the automated aspects of DAST tools
• 11.
  © COPYRIGHT 2019COVEROS, INC. ALL RIGHTS RESERVED. 11@ThomasStiehm #AgileDC What to do next •Security Testing – Testing the security features of your software •Security Test Automation - Using test automation tools like Selenium or Cucumber •Penetration Testing – Human beings evaluating the security of your software with the aid of tools •Threat Analysis – Understand who will attack you, why, and how •Infrastructure Analysis Scanning & Testing – Securing your OS and Server Software
• 12.
  © COPYRIGHT 2019COVEROS, INC. ALL RIGHTS RESERVED. 12@ThomasStiehm #AgileDC Advanced DevSecOps Techniques •IAST - Interactive Application Security Testing is technique for detecting security vulnerabilities in a running application •RASP - Runtime Application Self-Protection building on the same technology base as IAST by providing a facility to react to a detected vulnerability as it is exploited, e.g. terminating the session •HAST - Hybrid Application Security Testing uses DAST with IAST to find vulnerabilities
• 13.
  © COPYRIGHT 2019COVEROS, INC. ALL RIGHTS RESERVED. 13@ThomasStiehm #AgileDC Operational Security •Security Information and Event Management (SIEM) •Infrastructure Analysis Scanning & Testing •Encrypting Data at Rest •Encrypting Data in all Network Channels
• 14.
  © COPYRIGHT 2019COVEROS, INC. ALL RIGHTS RESERVED. 14@ThomasStiehm #AgileDC Secure practices in a pipeline
• 15.
  © COPYRIGHT 2019COVEROS, INC. ALL RIGHTS RESERVED. 15@ThomasStiehm #AgileDC Culture Shift Goal Mindset: “Everyone is responsible for security.” Three things to try when changing culture: 1. Build a Knowledge base 2. Promote Openness 3. Create Cybersecurity Champions Need to experiment to find what works for your specific organization.
• 16.
  © COPYRIGHT 2019COVEROS, INC. ALL RIGHTS RESERVED. 16@ThomasStiehm #AgileDC DevSecOps Benefits •Faster vulnerability detection and mitigation •Always-known security posture •Less security-based risk •Smaller chance of getting exploited •Reduced cost of fixing AppSec bugs •Avoidance of publicity for getting pwned •Able to recover from security incidents faster
• 17.
  © COPYRIGHT 2019COVEROS, INC. ALL RIGHTS RESERVED. 17@ThomasStiehm #AgileDC Wrap UP #Coveros5 •Starting to Shift Left is more important then what practices you start with •Greenfield start with Threat Analysis and build security in •Legacy or brownfield start with SCA (or SAST or DAST) •Iteratively add more security practices into your process •Iteratively add more security to your build pipeline
• 18.
  © COPYRIGHT 2019COVEROS, INC. ALL RIGHTS RESERVED. 18@ThomasStiehm #AgileDC Periodic Table of DevOps Tools En Os Fm Os Pd Pd Fm En En En Fm Os En Os Pd Os Fm Fm Fm Fm Pd En En Os Fr Os Fr Os Pd Fr Fr Fr Os Fm Fm Fr Os Fm Os En Fm Fm Pd Pd En En Fm En En En Os Fm En Fr Os Os Os Os En En En Fm En Os En En Os En En Os Pd Os Os En Os Os En En Pd En Fm Fm Pd Pd Pd En Os En Pd Pd Fm Os Fm En Fm Pd Pd En Pd Os Os En En Os Fm Fm Pd Pd Os Os En Os Os Fm En En Pd Os Os En 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 3 4 5 6 7 8 9 10 1 2 11 12 13 14 15 16 17 18 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 Cw Sv Gh Gl At Nx Bb Dp Db Dt Rg Fw Pf Jn Ba Tr Cr Cs Vs Tc Cb XLi Sw Fn Se Ga Cu Ki Jr Ju Jm Tn Mc Nr Tl Ka Ja Tt Lo Dt Sk Su Sl Pe Mf Dd St Ch An Pu Sa Ad Cn Tf Ru Pa Ce El Ry XLd Oc Cd Eb Ni Ac Ud Go Ec Ca Zb Og Ku Dk XLr Ms Ra De Zn Pd Cc Ur Aws Gke Aks Ae Cx Sn Pr Af Az Om Rk Cf Sg Tw Al Ld Gc Cp Sp Hm Bd Ck Os Ic Op Cy Ir Aw Sr Vc Ps Fd Sg Sp It Mg Ls Hv Ff GitLab GitHub Subversion ISPW Artifactory Nexus BitBucket Datical DBMaestro Delphix Redgate Flyway Perforce FitNesse Selenium Gatling Cucumber Kibana Jira JUnit JMeter TestNG Mocha Trello New Relic Karma Jasmine Tricentis Tosca Locust.io Slack Dynatrace SoapUI Sauce Labs Perfecto Micro Focus UFT Stride Datadog Chef Ansible Puppet Salt CollabNet VersionOne AppDynamics Terraform Rudder Packer CFEngine Remedy ElasticSearch XebiaLabs XL Deploy Octopus Deploy AWS CodeDeploy ElasticBox Nagios Agile Central UrbanCode Deploy GoCD ElectricCloud CA Automic Zabbix OpsGenie Kubernetes Mesos Rancher Docker Enterprise Docker XebiaLabs XL Release Zenoss Pagerduty CA CD Director GKE AKS AWS ECS UrbanCode Release AWS Checkmarx SAST Snort Plutora Release OpenMake Rkt Codefresh Azure Functions Azure Signal Sciences Tripwire Alibaba Cloud AWS CodePipeline Spinnaker Helm Lambda Google Cloud BlackDuck CyberArk OpenStack Cloud Foundry Iron.io Apache OpenWhisk IBM Cloud OpenShift SonarQube Veracode Fluentd Prometheus Sumo Logic Splunk ITRS Moogsoft Logstash HashiCorp Vault Fortify SCA Jenkins Bamboo Travis CI Circle CI Codeship VSTS TeamCity AWS CodeBuild XebiaLabs XL Impact ServiceNow Deployment AIOps Cloud Release Orchestration Containers Configuration Testing Continuous Integration Database Automation Source Control Mgmt. Collaboration Security Monitoring AnalyticsOs Open Source Fr Free Fm Freemium Pd Paid En Enterprise PERIODIC TABLE OF DEVOPS TOOLS (V3) https://xebialabs.com/periodic-table-of-devops-tools/
• 19.
  © COPYRIGHT 2019COVEROS, INC. ALL RIGHTS RESERVED. 19@ThomasStiehm #AgileDC Questions? @thomasstiehm • Join me on the TechWell Hub • https://hub.techwell.com/ • #devops