Anzeige
DevOps or DevSecOps
3. Mar 2019•0 gefällt mir•985 Aufrufe
1 gefällt mir
Sei der Erste, dem dies gefällt
Mehr anzeigen
Aufrufe
Aufrufe insgesamt
0
Auf Slideshare
0
Aus Einbettungen
0
Anzahl der Einbettungen
0
Downloaden Sie, um offline zu lesen
Melden
Ingenieurwesen
In 2009 Patrick Dubois coined the term "DevOps" when he organised the first "DevOpsDays" In Ghent, Belgium. Since then the term has become a term to explain the collaboration between all organisational stakeholders in IT projects (developers, operations, QA, marketing, security, legal, …) to deliver high quality, reliable solutions where issues are tackled early on in the value stream. But reality shows that many businesses that implement "DevOps" are actually talking about a collaboration between development, QA and operations (DQO). Solutions are being provided but lack the security and/or legal regulations causing hard-to-fix problems in production environments. In this talk I will explain how the original idea of Patrick to include all stakeholders got reduced to development, QA and operations and why it's so difficult to apply security or compliance improvements in this model. I will also talk about ways to make the DQO model welcoming for security experts and legal teams and why "DevSecOps" is now the term to be used to ensure security is no longer omitted from the value process. Finally we'll have a vote if we keep the term "DevOps" as an all-inclusive representation for all stakeholders or if we need to start using "DevSecOps" to ensure the business understands can no longer ignore the importance of security.
Michelangelo van DamFolgen
Senior PHP architect & QA Specialist um In2ITAnzeige
Anzeige
Anzeige
Recomendados
2019 DevSecOps Reference ArchitecturesSonatype
Benefits of DevSecOpsFinto Thomas , CISSP, TOGAF, CCSP, ITIL. JNCIS
The New Security Playbook: DevSecOpsJames Wickett
SCS DevSecOps Seminar - State of DevSecOpsStefan Streichsbier
Introduction to DevSecOpsSetu Parimi
DevSecOps in Baby StepsPriyanka Aash
DevOps or DevSecOps
- DEVOPS OR DEVSECOPS? Why do we need to focus on security in development and operations?
- MICHELANGELO VAN DAM I'm a senior #php architect, co-founder and #ceo of @in2itvof, #community leader at @phpbenelux, coach at @CoderDojoBelgium, #MVP, #digitalnomad, likes #coffee. Follow me on Twitter: @DragonBe
- DEVOPS Let’s have a look at DevOps first
- PATRICK DEBOIS Patrick Debois coined the term “DevOps” at the first DevOpsDays in Ghent (Belgium) and started a very important movement in the tech industry.
- THE THREE WAYS THE PRINCIPLES UNDERPINNING DEVOPS
- THE THREE WAYS THE PRINCIPLES UNDERPINNING DEVOPS System thinking: performance of complete system
- THE THREE WAYS THE PRINCIPLES UNDERPINNING DEVOPS System thinking: performance of complete system Amplify feedback loops: notify issues early in the process
- THE THREE WAYS THE PRINCIPLES UNDERPINNING DEVOPS System thinking: performance of complete system Amplify feedback loops: notify issues early in the process Culture of continuous learning & experimenting
- DEVOPS
- DEVOPS Unifying software development & operations
- DEVOPS Unifying software development & operations Automation & monitoring of software construction
- DEVOPS Unifying software development & operations Automation & monitoring of software construction Shorter development cycles, increased deployment frequencies & produce dependable releases
- DEVELOPMENT & OPERATIONS
- DEVELOPMENT & OPERATIONS Project management & development
- DEVELOPMENT & OPERATIONS Project management & development Network & systems engineering
- DEVELOPMENT & OPERATIONS Project management & development Network & systems engineering Security, testing, legal, compliance & support
- DEVELOPMENT & OPERATIONS Project management, development & testing Network & systems engineering Security, testing, legal, compliance & support
- AUTOMATION & MONITORING
- AUTOMATION & MONITORING Infrastructure as code
- AUTOMATION & MONITORING Infrastructure as code Increased telemetry on whole application stack
- AUTOMATION & MONITORING Infrastructure as code Increased telemetry on whole application stack Repeatable processes for continuous improvement
- SHORTER DEVELOPMENT CYCLES, INCREASED DEPLOYMENT FREQUENCIES & DEPENDABLE RELEASES
- SHORTER DEVELOPMENT CYCLES, INCREASED DEPLOYMENT FREQUENCIES & DEPENDABLE RELEASES 10, 100, 1K, 10K commits a day
- SHORTER DEVELOPMENT CYCLES, INCREASED DEPLOYMENT FREQUENCIES & DEPENDABLE RELEASES 10, 100, 1K, 10K commits a day Each N commits results in a deployment (could be 1)
- SHORTER DEVELOPMENT CYCLES, INCREASED DEPLOYMENT FREQUENCIES & DEPENDABLE RELEASES 10, 100, 1K, 10K commits a day Each N commits results in a deployment (could be 1) Each release is better than the previous
- TRUST ME, I’M A PROFESSIONAL Each commit has the potential of introducing a new risk or break the system. Without any safeguards, we’re just increasing the speed of creating a Pandora’s Box.
- DEVSECOPS
- DEVSECOPS
- DEVSECOPS Security integrated part of dev & ops
- DEVSECOPS Security integrated part of dev & ops Each commit & systems change must meet security standards
- DEVSECOPS Security integrated part of dev & ops Each commit & systems change must meet security standards Security by design
- THIS IS 2018
- THIS IS 2018
- THIS IS 2018
- THIS IS 2018
- SECURITY FOCUS
- SECURITY FOCUS Hackers
- SECURITY FOCUS Hackers Data loss prevention
- SECURITY FOCUS Hackers Data loss prevention Privacy protection
- SECURITY FOCUS Hackers Data loss prevention Privacy protection Bad configuration
- SECURITY FOCUS Hackers Data loss prevention Privacy protection Bad configuration Compliance
- SECURITY FOCUS Hackers Data loss prevention Privacy protection Bad configuration Compliance Verified trust
- WHAT’S YOUR OPINION? Raise your hand if you feel security needs to be emphasised with DevSecOps
- WHAT’S YOUR OPINION? Raise your hand if you feel security is part of DevOps
- SECURITY IS PART OF DEVOPS Project management, development & testing Network & systems engineering Security, testing, legal, compliance & support
- THE DEVOPS CYCLE
- A TYPICAL BUILD PROCESS
- A TYPICAL BUILD PROCESS
- SECURITY TESTING WITH RIPSTECH Project X 2019-03-02 16:43:11
- SECURITY TESTING WITH BURP SUITE
- SECURITY TESTING WITH ARACHNI
- SECURITY TESTING WITH BEHAT
- MANUAL SECURITY TESTING
- SUMMARY
- SUMMARY Security integrated part of dev & ops
- SUMMARY Security integrated part of dev & ops TRUE === ($this->DevOps || $this->DevSecOps)
- SUMMARY Security integrated part of dev & ops TRUE === ($this->DevOps || $this->DevSecOps) Security is a MUST: we can no longer ignore it!
- REFERENCES
- SHAMELESS PLUG DRAGONBE/HIBP
- QUESTIONS?
- QUESTIONS? Slides online slideshare.net/DragonBe
- QUESTIONS? Slides online slideshare.net/DragonBe Leave feedback joind.in/event
- QUESTIONS? Slides online slideshare.net/DragonBe Leave feedback joind.in/event Contact me twitter.com/DragonBe
Anzeige