Presentation by Shannon Lietz Software needs to be awesome, resilient, available and “secure”, but Security has long been a big roadblock to fast deployments and software improvement. What if it wasn’t? Continuous delivery requires operational functions to shift left and for an iterative approach to be taken. Security has not been easy to shift left and taking an iterative approach requires everyone to take responsibility. With a continuos security approach and everyone in the Software Supply Chain taking on the tasks of including security, its possible to achieve Rugged Software. This talk aims to provide a journey towards this approach and provide the path. Software needs to be awesome, resilient, available and “secure”, but Security has long been a big roadblock to fast deployments and software improvement. What if it wasn’t? Continuous delivery requires operational functions to shift left and for an iterative approach to be taken. Security has not been easy to shift left and taking an iterative approach requires everyone to take responsibility. With a continuos security approach and everyone in the Software Supply Chain taking on the tasks of including security, its possible to achieve Rugged Software. This talk aims to provide a journey towards this approach and provide the path.

1. 1 Intuit Confidential and Proprietary1
Safely Removing the Last Roadblock to
Continuous Delivery
Shannon Lietz
Director DevSecOps, Intuit
@devsecops

2. 2
Thanks to Henrik Kniberg
When will you solve my problem?!! Can we discuss my feedback?
(Uh - seatbelts?)
A Traditional Supply Chain

3. 3
Thanks to Henrik Kniberg
Awesome!When can I bring my kids with me?
Does it come in Red?
Can this be motorized
to go faster and for longer trips?
Better than walking, for sure…
but not by much...
A Customer Centric Supply Chain
Shifting left solves problems faster…

4. 4
Google Trends
• Several years after the Agile
Manifesto, DevOps.com
was registered (2004)
• Google searches for
“DevOps” started to rise in
2010
• Major influences:
– Saving your Infrastructure
from DevOps / Chicago
Tribune
– DevOps: A Culture Shift,
Not a Technology /
Information Week
– DevOps: A Sharder’s Tale
from Etsy
– DevOps.com articles
• RuggedSoftware.org
was registered in 2010
https://www.google.com/trends/

5. 5
Business strategy is achieved with the
collaboration of all departments and
providers in service to the customer who
requires better, faster, cheaper, secure
products and services.
What’s the Business benefit?

6. 6
1. Manual processes & meeting culture
2. Point in time assessments
3. Friction for friction’s sake
4. Contextual misunderstandings
5. Decisions being made outside of value creation
6. Late constraints and requirements
7. Big commitments, big teams, and big failures
8. Fear of failure, lack of learning
9. Lack of inspiration
10. Management and political interference (approvals, exceptions)
...
So what hinders “secure” innovation @ speed & scale?

7. 7 7

8. 8
Traditional
Security
Security is
Everyone’s
Responsibility
DEVSECOPS
It’s time to Culture Hack…

9. 9
OPS
SEC
DEV
AppSec
How do we get started?

10. 10
Secure Software Supply Chain
1. Gating processes are not Deming-like
2. Security is a design constraint
3. Decisions made by engineering teams
4. It’s hard to avoid business catastrophes by
applying one-size-fits-all strategies
5. Security defects is more like a security
“recall”
design build deploy operate
How do I secure
my app?
What component
is secure
enough?
How do I
secure secrets
for the app?
Is my app getting
attacked? How?
Typical gates for
security
checks & balances
Mistakes and drift often happen
after design and build phases that
result in weaknesses and potentially exploits
Most costly mistakes
Happen during design
Faster security feedback loop

11. 11
Staffing Models
Typical Traditional Supply Chain Ratio DevOps Staffing

12. 12
• Everyone knows Maslow…
• If you can remember 5 things,
remember these ->
“Apps & data are as safe as
where you put it, what’s in it, how
you inspect it, who talks to it, and
how its protected…”
Simplifying Security for the Masses

13. 13
Reasonable Security was recently defined for California within the
2016 California Data Breach Report.
“The 20 controls in the Center for Internet Security’s Critical Security
Controls identify a minimum level of information security that all
organizations that collect or maintain personal information should
meet. The failure to implement all the Controls that apply to an
organization’s environment constitutes a lack of reasonable
security.”
Why Governance?

14. 14
Migrating Security to the Left…
design build deploy operate
How do I secure
my app?
What component
is secure
enough?
How do I
secure secrets
for the app?
Is my app getting
attacked? How?
Typical gates for
security
checks & balances
Mistakes and drift often happen
after design and build phases that
result in weaknesses and potentially exploits
Most costly mistakes
Happen during design
Faster security feedback loop
Security is a Design Constraint

15. 15
Monitor & Inspect Everything
insights
security
sciencesecurity
tools & data
Cloud
accounts
S3
Glacier
EC2
CloudTrail
ingestion
threat intel
security feedback loop continuous response
operate

16. 16
deploy
Safe Continuous Deployment
CloudProviderNetwork
Backbone
Backbone
Cloud Platform (Orchestration)
Network Compute Storage
Internet
CloudAccount(s)
Load
Balancers
Compute
Instances
VPCs
Block
Storage
Object
Storage
Relational
Databases
NoSQL
Databases
Containers
Content
Acceleration
Messaging Email
Utilities
Key
Management
API/Templates
Certificate
Management
Partner
Platform
Deployment
Bundles
In S3
Artifacts
In S3
safe deployment process secured accounts & services

17. 17
build
Fanatical Security Testing
dynamic run-timestatic
UX &
Interfaces
Micro
Services
Web Services
Code
CFn
Templates
Build
Artifacts
Deployment
Packages
Resources
Patterns &
Baselines
Security
Groups
Account
Configuration
Real-Time
Updates
Patterns &
Baselines

18. 18
design
Secure Baselines & Patterns
templates resourcespatterns services
AMI
Amazon Elastic
MapReduce
AWS Import/
Export
Security
Monitoring
Egress Proxy
CFn Template
Bastion CFn
Template
Secure VPC
CFn Template
CloudTrail
CFn Template
Secrets
Bundle
MarketPlace

19. 19
What’s this look like in practice?

20. 20
Red Team, Security Operations & Science
API KEY EXPOSURE ->
8 HRS
DEFAULT CONFIGS ->
24 HRS
SECURITY GROUPS ->
24 HRS
ESCALATION OF PRIVS ->
5 D
KNOWN VULN ->
8 HRS

21. 21
Compliance Operations as Continuous Improvement
https://www.kpmg.com/BE/en/IssuesAndInsights/ArticlesPublications/Documents/Transforming-Internal-Audit.pdf

22. 22
Security Decision Support

23. 23
This could be your MTTR…
MTTR
Days… 6 months

24. 24
Get Involved and Join the Community
• devsecops.org
• @devsecops on Twitter
• DevSecOps on LinkedIn
• DevSecOps on Github
• RuggedSoftware.org
• Compliance at Velocity