1. Don’t Forget Security When Delivering Software
Kiriakos Kontostathis

2. Security is hard! Lots of testing Lots of documentation Lots of time
Few releases
Everlasting battle between security team incentives and dev team incentives
Security is rewarded when software is secure, but it’s hard to keep an ever changing project secure
Dev is rewarded when software includes more features and improvements, but hard to code to necessary secure coding principles

3. Automation is key

4. Software Development Life Cycle (SDLC)
This is full SDLC - discuss very briefly each step (1-1.5 mins for all sections)
What parts are Delivery Optimization? (Possible question to audience)

5. Delivery Optimization Pipeline
Why all of this?
Code is being delivered, so it should be part of delivery optimization
Code review and commit generate documentation
CI/CD - automate delivery process
More automated testing
Transition - Delivery complete, ready for next cycle

6. Security is Everywhere!
Security everywhere (go through each step and give brief explanation of what is being done)
Mention Demos where appropriate
code/commit/code review section
CI/CD automated security testing
Where do we start to include security team? (question to audience)

7. “Pushing Security Left”
Incorporate security as soon as possible
Smaller, more manageable security focused tasks are easier than performing a broad security review when application is ready to be released
Additional Benefits
Shorter feedback loops
Team efficiency
Quick Incident Response
Traceability
Ben Tomhave and Sean Kenefick in Gartner research “Security in a DevOps World”

8. Automate! The ability to run suite of security tests at any time
Tests need to be written in a repeatable way (use of tools can help with this)
Short Feedback loops allow tests to be continually added to the test suite
Demos
Using static analysis tools to check for secure coding principles
Automated security tests written specifically for a piece of software or environment

9. Automated Static Analysis
What is static analysis?
Why do static analysis?
Static Analysis Tools
Brakeman (Ruby on Rails)
DevBug (PHP)
VisualCodeGrepper (C++, C#, VB, PHP and Java)
Tools listed are all open source, but there are several other open source and commercial static anaylsis tools

10. Automated Static Analysis Demo
Brakeman
Ruby on Rails
Easy to configure
Customizable
Its Suspicious
High rate of false positives

11. Automated Security Tests
What are security tests?
Penetration Tests
Vulnerability Scanning
Security Scanning
Why do security tests?
Security testing tools
Gauntlt
OWASP Zed Attack Proxy (ZAP) Project

12. Automated Security Tests Demo
Gauntlt
Integration with existing security tools
Plain english language syntax
Integrates easily in build server
Travis CI
Open source continuous integration server
Allows for programmable build steps through travis.yml file

13. Conclusion Keys to Success Many Benefits Automation “Pushing left”
Automated testing
Documentation is completed throughout the process
Time spent on security is reduced
Development team can release more frequently
Security team is comfortable with those releases

14. Thanks! Demos and slides: https://github.com/kontostathisk
Blog: