Automate Early... But Securely! DevSecOps  Use Case Automate Early...                  But Securely!

About Me serban.bejan@euro-testing.com Information Security Consultant Bucharest, Romania 169 X Calea Floreasca, Cube Center Building, Ground Floor, Sector 1 www.euro-testing.com

Outline

Outline

DevOps + Security = DevSecOps ”The purpose and intent of DevSecOps, is to build on the mindset that ‘everyone is responsible for security’ with the goal of safely distributing security decisions at speed and scale to those who hold the highest level of context without sacrificing the safety required.” Shannon Lietz

SecDevOps / DevSecOps / DevOpsSec

Security shifting to the left Cost to Remediate 30X Somebody builds insecure software IT deploys the insecure software We are breached or pay to have someone tell us our code is bad We convince and pay the developer to fix it Somebody builds insecure software QA finds vulnerabilities in software We convince & pay the developer to fix it thereby delaying the release 15X 7X Requirements Design/ Architecture Coding Testing Deployments/ Maintenance

Application Development Security shifting to the left Static Code Analysis (SAST) Dynamic Testing (DAST) Runtime Protection (RASP) Design Code Test, Integration & Staging Production Application Development IT Operations Shift Left

Communication/ChatOps Integration Code repositories & apps GitHub Bitbucket Requirements & issues ALM Octane JIRA Bugzilla Build servers Jenkins Bamboo VSTS/TFS Build tools Maven Ant Make Build tools Gradle ANT Maven Security Vuln Mgmt SIEM WAFs Communication/ChatOps Continuous Monitoring and Protection Secure Development Security Testing IDEs Eclipse Visual Studio IntelliJ / Android Studio Open Source Sonatype Blackduck Fortify Configuration automation Puppet Chef Ansiable Containers Vagrant Docker kubernetes Cloud Azure AWS

Integrating security in DevOps Review Build Test Plan Code Deploy Operate Monitor Release SAST Secure cod review Dev Ops Threat modeling Risk assessment SAST SCA DAST Fuzzing PenTest

Use Case

Detection of threats, security defects, and flaws Mean time to repair Measuring Success Deployment frequency Lead time Detection of threats, security defects, and flaws Mean time to repair Mean time to recovery

Technical Benefits: Benefits of DevSecOps Business Benefits: Continuous software delivery Less complex problems to fix Faster resolution of issues when they arise Secure environment Business Benefits: Faster delivery of features More stable operating environments More time available to add value (rather than waste it with fixes/maintenance) No breaches / better image

Non-DevSecOps DevSecOps Main takeaways 92 days to fix a vulnerability Using dynamic analysis in production 113 days 51 days Using static analysis

THANK YOU