Dev secops for real

Mohamed Radwan
Principal DevOps Consultant
Blog: www.mohamedradwan.com
DevSecOps for Real!

Twitter: @mradwan06

Mohamed Radwan www.mohamedradwan.com
Activity Links
http://mohamedradwan.com/
https://social.msdn.microsoft.com/profile/mohamed.radwan-mvp
https://www.youtube.com/user/MRadwanMSF
https://github.com/DevOpsFounder
http://goo.gl/j8pD7U
https://goo.gl/C48iey
https://stackoverflow.com/users/386323/mohamed-radwan-mvp

Outline
• Traditional Security Vs. DevSecOps (Rugged DevOps)
• Security as a continuously varying state
• Evolving DevOps
• Continuous Practices & Shift Left
• Security and Compliance within DevOps
• Vulnerabilities overview
• Overview about OWASP
• High Overview Of Secure DevOps Kit for Azure
• How to run different types of security scan ?
• Azure Policy

Outline (P2)
• Azure Policy and Release Management
• Azure Blueprints
• Microsoft Azure Security Centre
• Automate Governance and Compliance
• Continuous security validation within CI/CD pipeline
• Passive penetration test VS. Active penetration test
• Infrastructure validation
• Track vulnerabilities
• Demo

Traditional Security Vs. DevSecOps (Rugged DevOps)

Security as a continuously varying state
• Continuous Integration (CI)
• Continuous Deployment (CD)
• Continuous Delivery (CD)
• Continuous Testing (CT)
• Continuous Assurance (CA)

Develop Build Test Deploy Operate
Continuous Practices & Shift Left
SecuritySecurity Security Security Security

Verizon 2016 Data Breach Investigations Report
In 2016, the distribution is
very similar to last
year, with the top 10
vulnerabilities accounting
for 85% while they are
very known due the lack of
awareness and practices.
The risk of OSS vulnerabilities

Overview about OWASP
Top 10
• Injection
• Never trust any user input
• Broken authentication
• Sensitive data exposure
• Broken access control
• More…..
hub

18
Subscription
Security
(Policy,RBAC
Config, etc.)
Continuous
Assurance
Runbooks
CICD
Build/Release
Extensions
Log Analytics
for Alerting
&
Monitoring
Security
IntelliSense.
Security
Verification
Tests
(SVTs)
Cloud Risk
Governance
Provision security in subscription❶
Develop securely, spot check
security via scripts
❷
Deploy securely from Azure DevOps
Using Azure Pipelines build/release
❸
Periodically scan in production
to watch for drift
❹Single security dashboard
across DevOps stages
❺
Manage data-driven
improvement to security
❻
High Overview Of Secure DevOps Kit for Azure

Security
IntelliSense

SVTs Ad-hoc
scan

SVTs
Continuous
Assurance scan

SVTs
build/deployment
scan using
AzSK pipeline
extension

Install AzSK

Commands of AzSK

Scan Subscription using AzSK

Scan result .CSV

Auto fix script

Run Continuous Assurance scan for subscription
using AzSK

Check Security in CICD pipelines
Code
Complete
Dev Envmt Test Envmt Prod Envmt

Azure Policy
Enforce and Audit

Create and assign Azure Policy

Dev
1:n Developer
environments
ReleaseManagerse
Production
Environment
ReleaseManagerse
For Pre-Prod
Like Usage With
Real Data
QA
For Functionality
Test (End-To-
End)
QA
1:n QA For
Feature Test
Quick review about deployemnt to enviroments
Enviroments
Approvers

ReleaseManagerse
For Pre-Prod
Like Usage With
Real Data
QA
For Functionality
Test (End-To-
End)
QA
1:n QA For
Feature Test
Sing-in and Sing-off process and automation
Enviroments
Approvers
• Accept release to be deployed here
• Accepted that this release has all
prerequisites DoD
• Accept to start working on this release
• Approved this release is completed and
ready for next stage
• Next stage is ready and secure
Sign-in Sign-off

Release Gate using Azure Policy

Policy violation failed release

AzSK pipeline extension (Release)

Azure Blueprints
Deploy and update cloud environments in a repeatable manner using composable artifacts
Role Based Access Controls
Policy Definitions
ARM Templates
Azure Blueprints
Subscription 1
Subscription 2
Subscription 3
Subscription N
compose manage scale

Azure Blueprints Getting started

Centralized policy
management
Continuous security
assessment
Actionable
recommendations
Advanced cloud
defenses.
Prioritized alerts and
incidents
Integrated security
solutions

Automate Governance and Compliance
Azure Policy
Azure Blueprint
Azure Automation Azure Pipelines
AzSK
Continuous
Assurance

Continuous security validation within CI/CD pipeline
Application
CI /CD
Nightly Test
Runs
CI Dev
Static Code Analysis
Code Review
Work Item Linking
Static Code Analysis
OSS Vulnerability Scan
Unit Tests
Code Metrics
Passive Pen Test
SSL Scanner
Infrastructure Scan
Passive Pen Test
SSL Scanner
Infrastructure Scan
Load and Performance Testing
Automated Regression Testing
Infrastructure Scan
Active Pen Test
Load and Performance Testing
Automated Regression Testing
Infrastructure Scan
Feedback
OSS Vulnerability Scan
OSS License Violations
Failed Unit Tests
Static Code Rule Warnings
Pen Test Issues
SSL Issues
Performance Issues
Regression Bugs
Infrastructure Issues
Code Review Comments
Static Code Rule Warnings
Pen Test Issues
SSL Issues
Performance Issues
Regression Bugs
Infrastructure Issue
Test
IDE/Pull
Request

Passive penetration test VS. Active penetration test
Build
Static Security
Scan
Deploy
Package
Passive Pentest
Pull OWASP Zap
Weekly
Start Container
Report Results
Run Baseline
(1 to 2 min)
High Alerts – Fail
Release
All Alerts – Create Bugs
Nightly Schedule
Application Full
Active Scan
Pull OWASP Zap
Weekly
Start Container
Spider Site
High Alerts – Fail
Release
All Alerts – Create Bugs
Run Active Scan
Report Results
Application CI/CD Pipeline Nightly OWASP ZAP Pipeline

Infrastructure validation
Continuous
Assurance
Azure Scanner
Whitelisted
Endpoints and
Ports
Any non-whitelisted public endpoint/port
detected will create a bug

Track vulnerabilities

SonarCloud

SonarCloud result

WhiteSource Bolt extension

WhiteSource Bolt result

Mohamed Radwan
Principal DevOps Consultant
Thank you!

Dev secops for real

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Dev secops for real

Similar to Dev secops for real (20)

Recently uploaded

Recently uploaded (20)

Dev secops for real