1. Automate Early... But Securely!
DevSecOps  Use Case
Automate Early...
                 But Securely!

2. About Me serban.bejan@euro-testing.com Information Security Consultant
Bucharest, Romania
169 X Calea Floreasca, Cube Center Building,
Ground Floor, Sector 1

3. Outline

4. Outline

5. DevOps + Security = DevSecOps
”The purpose and intent of DevSecOps, is to build on the mindset that ‘everyone is responsible for security’ with the goal of safely distributing security decisions at speed and scale to those who hold the highest level of context without sacrificing the safety required.” Shannon Lietz

6. SecDevOps / DevSecOps / DevOpsSec

7. Security shifting to the left
Cost to Remediate
30X
Somebody builds insecure software
IT deploys the insecure software
We are breached or pay to have someone tell us our code is bad
We convince and pay the developer to fix it
Somebody builds insecure software
QA finds vulnerabilities in software
We convince & pay the developer to fix it thereby delaying the release
15X 7X
Requirements
Design/ Architecture
Coding
Testing
Deployments/ Maintenance

8. Application Development
Security shifting to the left
Static Code Analysis
(SAST)
Dynamic Testing
(DAST)
Runtime Protection
(RASP)
Design
Code
Test,
Integration & Staging
Production
Application Development
IT Operations
Shift Left

9. Communication/ChatOps
Integration
Code repositories & apps
GitHub
Bitbucket
Requirements & issues
ALM Octane
JIRA
Bugzilla
Build servers
Jenkins
Bamboo
VSTS/TFS
Build tools
Maven
Ant
Make
Build tools
Gradle
ANT
Maven
Security
Vuln Mgmt
SIEM
WAFs
Communication/ChatOps
Continuous Monitoring and Protection
Secure Development
Security Testing
IDEs
Eclipse
Visual Studio
IntelliJ / Android Studio
Open Source
Sonatype
Blackduck
Fortify
Configuration automation
Puppet
Chef
Ansiable
Containers
Vagrant
Docker
kubernetes
Cloud
Azure
AWS

10. Integrating security in DevOps
Review
Build
Test
Plan
Code
Deploy
Operate
Monitor
Release
SAST
Secure cod review
Dev
Ops
Threat modeling
Risk assessment
SAST
SCA
DAST
Fuzzing
PenTest

11. Use Case

12. Detection of threats, security defects, and flaws Mean time to repair
Measuring Success
Deployment frequency
Lead time
Detection of threats, security defects, and flaws
Mean time to repair
Mean time to recovery

13. Technical Benefits: Benefits of DevSecOps Business Benefits:
Continuous software delivery
Less complex problems to fix
Faster resolution of issues when they arise
Secure environment
Business Benefits:
Faster delivery of features
More stable operating environments
More time available to add value (rather than waste it with fixes/maintenance)
No breaches / better image

14. Non-DevSecOps DevSecOps Main takeaways 92 days to fix a vulnerability
Using dynamic analysis in production
113 days
51 days
Using static analysis

15. THANK YOU