Security Loves DevOps: DevOpsDays Austin 2012
•Als PPTX, PDF herunterladen•
4 gefällt mir•2,627 views
Discusses the intersection between security and DevOps and how Security people can leverage DevOps and vice versa.
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (15)
Andere mochten auch
Andere mochten auch (17)
Ähnlich wie Security Loves DevOps: DevOpsDays Austin 2012
Ähnlich wie Security Loves DevOps: DevOpsDays Austin 2012 (20)
Mehr von James Turnbull
Mehr von James Turnbull (18)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
Security Loves DevOps: DevOpsDays Austin 2012
- 1. DevOps & Security James Turnbull Puppet Labs DEVOPSDAYS AUSTIN 2012
- 2. Who me? • Puppet Labs employee • Security boffin • Open source fan • Author • Australian • Expletives DEVOPSDAYS AUSTIN 2012
- 3. More introductions Does anyone here work in Security? DEVOPSDAYS AUSTIN 2012
- 4. Three things I hated about Security 1. Not being liked 2. Not being effective 3. Not being happy DEVOPSDAYS AUSTIN 2012
- 5. Meme theft… DEVOPSDAYS AUSTIN 2012
- 6. What IT think Security do DEVOPSDAYS AUSTIN 2012
- 7. What the business think Security do DEVOPSDAYS AUSTIN 2012
- 8. What Security people think they do DEVOPSDAYS AUSTIN 2012
- 9. What Security Isn’t DEVOPSDAYS AUSTIN 2012
- 10. What Security Is (or Should Be) • Partnership not conflict • Servicing and Protecting all customers • Allowing increased risk appetite • Enabling the business to do business DEVOPSDAYS AUSTIN 2012
- 11. The Intersection DEVOPSDAYS AUSTIN 2012
- 12. Security people are people too DEVOPSDAYS AUSTIN 2012
- 13. Security people are people too • Developer People • Ops People • DBA People • Network People • Storage People DEVOPSDAYS AUSTIN 2012
- 14. DevOps & Security You should care about security too! DEVOPSDAYS AUSTIN 2012
- 15. DevOps & Security Evolution is mutual DEVOPSDAYS AUSTIN 2012
- 16. Getting Security to Listen It’s all about the culture DEVOPSDAYS AUSTIN 2012
- 17. Getting Security to Listen Destroy the blame culture DEVOPSDAYS AUSTIN 2012
- 18. Getting Security to Listen Speak the same language DEVOPSDAYS AUSTIN 2012
- 19. Getting Security to Listen "Risk management is the process of identifying vulnerabilities and threats to the information resources used by an organization in achieving business objectives, and deciding what countermeasures, if any, to take in reducing risk to an acceptable level, based on the value of the information resource to the organization.” DEVOPSDAYS AUSTIN 2012 - CISA
- 20. Getting Security to Listen Let the business do business with the right controls DEVOPSDAYS AUSTIN 2012
- 21. Talking Controls • Provisioning & Deployment: Efficiency • Configuration Management: Inconsistency is the enemy of security • Incident Management: Information is King • Audit: Magic away auditors DEVOPSDAYS AUSTIN 2012
- 22. Ideas for Collaboration DEVOPSDAYS AUSTIN 2012
- 23. DevOps & Security • Get roles and responsibilities right • Security people are (skilled) people too • Risk Register diving DEVOPSDAYS AUSTIN 2012
- 24. Dev & Security • Put Security people into Dev • Gather security requirements early • Designed for security == Deployed sanely & securely DEVOPSDAYS AUSTIN 2012
- 25. Ops & Security • Embed Security into Ops escalation • Invite Security to post-mortems • Expose Security to your metrics & data DEVOPSDAYS AUSTIN 2012
- 26. Thanks James Turnbull james@puppetlabs.com @kartar http://www.kartar.net DEVOPSDAYS AUSTIN 2012
Hinweis der Redaktion
- ----- Meeting Notes (4/1/12 15:14) -----1. Firewall rules faster2. Three things: - Information: What's vuln - Remediation: Fix it once and fast. - Consistency - things stay fixed