Presenting a framework for building an AppSec program in a DevOps environment; specifically one that is moving towards CI/CD.
Abstract:
Pentesters are tired of breaking things, writing a report, and walking away. Security teams are caught in a backlog that prevents them from ever staying ahead. Developers curse security for slowing them down. How can we address these seemingly incompatible and insurmountable issues in an organization, especially at scale? The answer to this may be found in a practice called "DevSecOps" that has been gaining momentum in large organizations that need to move fast and ensure a high level of security across their applications and operations. It is a practice that attempts to address all of these issues through two core principles- automation and education. Using experience gained from working with several large fortune 500 companies, this talk will cover the basics of DevSecOps, and dive into specific tools and processes that organizations of any size can implement to immediately improve their speed of delivery while maintaining a strong and measurable security baseline.
43. WHERE TO START
▸ SD Elements
▸ OWASP Top 10 Cheat Sheet
▸ CWE/SANS Top 25 Most Dangerous Software Errors
▸ Again- old findings and mistakes
44. WHERE TO START (OTHER TOOLS)
▸ Lemur (Netflix): https://github.com/Netflix/lemur
▸ Repokid (Netflix): https://github.com/Netflix/repokid
▸ Simian Army (Netflix): https://github.com/Netflix/SimianArmy
▸ Phan (Etsy): https://github.com/etsy/phan
▸ Elastalert (Yelp): https://github.com/Yelp/elastalert
▸ Brakeman: http://brakemanscanner.org/
▸ Twitter uses this and hired the developer
45. WHERE TO START (AWS)
▸ AWS CodePipeline
▸ AWS Inspector
▸ CloudFormation
▸ AWS Config
▸ AWS CloudWatch Events
▸ Action with Lambda
46. ▸ Education
▸ Developers are being asked to write code securely. Enable this through
Continuous Learning (CI/CD... CL!)
▸ Automation
▸ Build an integrated system that finds security issues easily and
automatically, with actionable results
▸ Remediation
▸ CI/CD allows us to push out security fixes faster than ever before
Education + Automation = Remediation
Aaron Hnatiw
aaron@securitycompass.com
Twitter: @insp3ctre
www.securitycompass.com
