The Security Sprint By Ramnath Cidambi

Agile and DevOps DevOps is a “recent” concept though the building blocks have existed for a while – The understanding of what it is varies Agile is mature, well-defined Agile & DevOps are complimentary and need to co-exist

Agile and DevOps Methods and Goals – Rapid response to change – Speed to Market = Iterative and Fast – Focus on the Product = Focus on Customer – Small Chunks – Collaborate What happened to the “Focus on Security”?

More challenges! Refactoring of code could create security vulnerabilities Automation such as continuous integration results in less priority to change management

What is a IT Team to do?

Agile and DevOps Incorporate Security in three areas

Agile and DevOps Incorporate Security in Process

Step 1 – Risk Assessment (RA) & Security Architecture A new product or system ? Product/System owner should work with Security team to perform a RA that includes input from all Stakeholders Develop a System Security architecture that uses the RA as input. the ideal process

Step 2 – Security Assessment of every story Validate every story with respect to the system security architecture Every sprint should have a security risk indicator based on the validation Every security sensitive story – Factor into design – Security Acceptance criteria – Security testing the ideal process

What Really Happens? The need for speed and business priority takes over Security requirements are postponed to future sprints Business requirements take precedence over security There are not enough hours in the day It is not “going to happen to us” justifies the decisions Projects start running a security debt!

How do we solve it? Collect on the Security debt! Create Security Only Sprints (SOS) Involve the CISO and sell it to the business Use Security Only Sprints to educate Use Security Only sprints to get to the ideal process! Business Sprint Business Sprint Business Sprint Security Sprint

Agile and DevOps Incorporate Security using Tools

Tools make it easy! Use tools to scan code for vulnerabilities – Make it part of the development environment Automation of Security Testing – Use tools such as OWASP ZAP Pen test after integration and before user acceptance (this may be too late!) Continuous integration needs continuous security testing

Tools make it easy….and hard DevOps is all about automation. For your end product to be secure… Make sure Dev, Test, UAT and Prod environments are identical Ensure Security team has validated the environments Everything you need to do should be done before build Make sure it works for you and your organization!

Agile and DevOps Educate and Increase awareness

Agile and DevOps People and Security Integrate member(s) of security team with App dev experience in team Training in Secure development needs to be constant! People are your best defense!

Agile and DevOps There will be a constant tension between the need for speed and agility and meeting security needs of the organization. A healthy balance is important.