DevSecOps: Security at the Speed of DevOp
•Als PPTX, PDF herunterladen•
0 gefällt mir•1,281 views
SpringOne Platform 2018 DevSecOps: Security at the Speed of DevOp Larry Maccherone, Comcast
![LinkedIn.com/in/LarryMaccherone
Only 21% of [companies] believe
that their organization's present
culture and practices support
collaboration across development,
operations and security.
~Freeform Dynamics
(IT industry analyst)](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Ähnlich wie DevSecOps: Security at the Speed of DevOp
Ähnlich wie DevSecOps: Security at the Speed of DevOp (20)
Mehr von VMware Tanzu
Mehr von VMware Tanzu (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
DevSecOps: Security at the Speed of DevOp
- 1. LinkedIn.com/in/LarryMaccherone Security at the Speed of Software Development A lean/agile transformation approach to achieving a DevSecOps culture Larry Maccherone LinkedIn.com/in/LarryMaccherone
- 2. LinkedIn.com/in/LarryMaccherone Only 21% of [companies] believe that their organization's present culture and practices support collaboration across development, operations and security. ~Freeform Dynamics (IT industry analyst)
- 4. LinkedIn.com/in/LarryMaccherone Dev[Sec]Ops is… empowered engineering teams taking ownership of how their product performs in production [including security]
- 5. Dev[Sec]Ops different decisions
- 6. LinkedIn.com/in/LarryMaccherone Dev[Sec]Ops Results • Dramatically faster time to market happier customers more revenue • 5x lower rate of failures caused by changes1 • 96x faster recovery from downtime failures1 It’s scary to QA and Security, but “moving fast and breaking things” leads to dramatically lower rates of customer experienced defects and vulnerabilities 1Puppet’s 2017 State of DevOps Report
- 7. What is Software Security?
- 8. LinkedIn.com/in/LarryMaccherone When you say “security” to a developer, he/she thinks… Authentication & authorization Encryption
- 9. LinkedIn.com/in/LarryMaccherone The bad guys… Don’t attack the bank vault door (breaking auth/encryption) They try to bust through the walls (vulnerabilities in the non-security parts of your code)
- 11. Software security puts focus on the bank vault walls
- 12. DevSecOps puts focus on the people, practices, and tools used to build the bank vault walls
- 13. Security practices on DevOps continuum DevSecOps • Static/IAST analysis • Abuse case tests • Code review • Interrupt-the-pipeline code analysis • Threat modeling backlog items • Analyze/Predict backlog items • Design complies with policy? • Test security features • Common abuse cases • Pen testing (Vuls found Test scripts) • Compliance validation (PCI, etc.) • Fuzzing • If we do X will it mitigate Y? • Capacity forecasting • Learning Update playbooks and Training • Configuration validation • Feature toggles/Traffic shaping configuration • Secrets management • Log information for after-incident analysis • Intrusion detection • App attack detection • Restore/maintain service for non-attack usage • RASP auto respond • Roll-back or toggle off • Block attacker • Shut down services • Analysis Learning • Defect/Incident 3-step • New attack surface? Plan to update threat model
- 14. That’s a lot of stuff! How do we get engineering teams to adopt?
- 15. A 3-part framework for adopting new practices and Dev[Sec]Ops culture change
- 16. 1 Win the hearts and minds of developers
- 17. LinkedIn.com/in/LarryMaccherone Lack of TRUST between dev teams and security teams
- 18. Build security in more than bolt it on Rely on empowered engineering teams more than security specialists Implement features securely more than security features Rely on continuous learning more than end-of-phase gates Build on culture change more than policy enforcement DevSecOpsManifestoComcastSDL GuidingPrinciples
- 19. We, the Security Team… Recognize that Engineering Teams… • Want to do the right thing • Are closer to the business context and will make smart trade-off decisions between security and other risks • Want information and assistance so they can improve our security posture Pledge to… • Lower the cost/effort side of any investment in developer security tools or practices • Assist 2x as much with preventative initiatives as we beg for your assistance reacting to security incidents Understand that… • We are no longer gate keepers but rather tool-smiths and advisors
- 20. Credibility + Reliability + Empathy Trust = ———————————————— Apparent self-interest https://www.devsecopsdays.com/articles/trust-algorithm-applied-to-devsecops
- 21. 2 Easy for dev teams to know what the right thing is and easy to do it
- 23. After self-assessment ask the team to pick some to turn dark(er) green in the next quarter
- 24. 3 Management gets: Transparency of rollout status A mechanism to set goals
- 26. Many DevSecOps tools are just DevOps lipstick on a traditional tool pig DevSecOps tools talk Tomorrow 12:30-1pm Woodrow Wilson A
- 27. LinkedIn.com/in/LarryMaccherone What’s next? • DevSecOps tools talk tomorrow 12:30-1pm – Woodrow Wilson A • Read about the Trust Algorithm https://www.devsecopsdays.com/articles/ trust-algorithm-applied-to-devsecops • Connect with me LinkedIn.com/in/LarryMaccherone • Rate the talk in your app • Questions?
Hinweis der Redaktion
- Add a step to the threat modeling row for how well they are doing it. Risk driven.
- We need a way to tie into the org leadership to get their input on what they want to do next. This visualization is fine, but we need an engagement model for execs and other management layers.