The document discusses security processes in DevSecOps. It outlines how security can be automated and shifted left through the development pipeline. Key stages discussed are the precommit stage, acceptance stage, and production stage. At the precommit stage, tools like static application security testing, software composition analysis, and container scanning are used. The acceptance stage utilizes dynamic testing like penetration testing and vulnerability assessments. For production, automation security baselines, runtime protections, and monitoring are recommended. Automating security helps focus on agility while still maintaining security.

1. Security Process
in
Jirayut Nimsaeng (Dear)
CEO & Founder, Opsta (Thailand) Co.,Ltd.
TechTalkThai Conference: Enterprise Cybersecurity 2021
October 5, 2021 https://bit.ly/opsta-ttt-sec-in-devops

2. Security Process in DevSecOps
#whoami
Jirayut Nimsaeng (Dear)
Jirayut has been involved in DevSecOps, Container, Cloud
Technology and Open Source for over 10 years. He has experienced
and succeeded in transforming several companies to deliver greater
values and be more agile.
● He is Founder and CEO of Opsta (Thailand) Co.,Ltd.
● He is Cloud/DevSecOps Transformation Consultant and
Solution Architecture
● He is the first Certified Kubernetes Security Specialist
(CKS) and Certified Kubernetes Administrator (CKA) in
Thailand

3. Security Process in DevSecOps
Agenda
● Automation Security
● Precommit Stage
● Acceptance Stage
● Production Stage
● Wrap Up

4. Security Process in DevSecOps
Security
Process in
Automation Security

5. Security Process in DevSecOps
DevOps Flow
Infrastructure
Support
Tools
VCS
Artifacts
CI CD
Dev
Test
Prod
Monitoring
Load Testing
Automation &
Infrastructure as Code
Developer
Operation
& SRE
Communication
Security
Security

6. Security Process in DevSecOps
DevSecOps Flow
Infrastructure
Support
Tools
VCS
Artifacts
CI CD
Dev
Test
Prod
Monitoring
Load Testing
Automation &
Infrastructure as Code
Developer
Operation
& SRE
Security
Communication
Security Shift Left with Automation

7. Security Process in DevSecOps
Automation Security
Infrastructure
Support
Tools
VCS
Artifacts
CI CD
Dev
Test
Prod
Monitoring
Load Testing
Automation &
Infrastructure as Code
Developer
Operation
& SRE
Security
Automation Security
Communication

8. Security Process in DevSecOps
Security Automation in every steps
Secure Coding
SAST
SCA
Vulnerability Assessment
Penetration Testing
IAST
Compliance
Validation
Threat
Intelligence
Secret Manager
DAST
Binary Analysis
Threat
Modelling
SOC
SOAR

9. Security Process in DevSecOps
Automation Security Tools
Code Build Secret
Test Release Runtime Monitor
Multi-purpose Commercial

10. Security Process in DevSecOps
Security Stages on DevOps Flow
Code Build Secret
Test Release Runtime Monitor
Precommit Stage Acceptance Stage Production Stage

11. Security Process in DevSecOps
Security
Process in
Automation Security:
Precommit Stage

12. Security Process in DevSecOps
Secure Coding
Secure coding is the practice of writing software that's protected
from vulnerabilities. Some examples below refer from OWASP Secure
Coding Practices
● Input Validation
● Authentication and Password Management
● Session Management
● Access Control
● Cryptographic Practices
● Error Handling and Logging
● Communication Security
● and much more...

13. Security Process in DevSecOps
SAST (Static Application Security Testing)
SAST is a testing methodology that analyzes source code to find
security vulnerabilities. SAST scans an application before the code is
compiled. It’s also known as white box testing.

14. Security Process in DevSecOps
SAST (Static Application Security Testing)

15. Security Process in DevSecOps
SCA (Software Composition Analysis)
SCA scans source code to inventory all open-source components to
eliminate vulnerabilities those listed in the National Vulnerability Database
(NVD) and compatibility issues with open-source licenses.

16. Security Process in DevSecOps
SCA (Software Composition Analysis)

17. Security Process in DevSecOps
Security
Process in
Automation Security:
Acceptance Stage

18. Security Process in DevSecOps
Software Security Testing (1)
Software security testing is the process of assessing and testing a system to
discover security risks and vulnerabilities of the system and its data.
● Penetration Testing - The system undergoes analysis and attack from
simulated malicious attackers.
● Fuzz Testing - is a brute-force reliability testing technique wherein you
create and inject random data into a file or API in order to intentionally
cause errors and then see what happens

19. Security Process in DevSecOps
Software Security Testing (2)
● Vulnerability Assessment - The system is scanned and analyzed for
security issues.
● DAST (Dynamic Application Security Testing) tools automate security
tests for a variety of real-world threats. DAST is a black-box testing method
to identify vulnerabilities in their applications from an external
perspective to better simulate threats most easily accessed by hackers
outside their organization

20. Security Process in DevSecOps
VA Scan and DAST

21. Security Process in DevSecOps
IAST (Interactive Application Security Testing)
IAST instruments applications by deploying agents and sensors in
running applications and continuously analyzing all application
interactions initiated by manual tests, automated tests, or a combination of
both to identify vulnerabilities in real time

22. Security Process in DevSecOps
IAST (Interactive Application Security Testing)

23. Security Process in DevSecOps
Infrastructure as Code (IaC) Security
IaC Security test and monitor your infrastructure as code such as
Ansible, Terraform modules and Kubernetes YAML, JSON, and Helm charts
to detect configuration issues that could open your deployments to attack
and malicious behavior.

24. Security Process in DevSecOps
Kubernetes Security
● Kubernetes Certificates
● Secret
● Network Policy
● Namespace
● Quota
● TLS Ingress Endpoint
● Secure Node Metadata
● CIS Benchmark
● Verify Platform Binary
● Harden Docker Image
● Image Policy Webhook
● Immutability
● RBAC
● Secure Service Account
● Secure API Endpoint
● Admission Controller
● Node Restriction
● Runtime Sandbox
● Non-Root Container
● Security Context
● Pod Security Policy
● Open Policy Agent
● Auditing

25. Security Process in DevSecOps
Container Image Security
Container security software is used to secure multiple components
of containerized applications or files, along with their infrastructure and
connected networks. Testing capabilities will assist in developing security
policies, discover zero-day vulnerabilities, and simulate attacks from
common threat sources.

26. Security Process in DevSecOps
Container Image Security

27. Security Process in DevSecOps
Signed Container Image

28. Security Process in DevSecOps
Secrets Management
Secrets management refers to the tools and methods for managing
digital authentication credentials (secrets), including passwords, keys, APIs,
and tokens for use in applications, services, privileged accounts and other
sensitive parts of the IT ecosystem.

29. Security Process in DevSecOps
Privileged Access Management (PAM)
PAM software allows companies to secure their privileged credentials
in a centralized, secure vault (a password safe). Additionally, these
solutions control who has access to, and therefore who can use, the
privileged credentials based on access policies (including user permissions
and specific timeframes), often recording or logging user activity while
using the credentials.

30. Security Process in DevSecOps
Privileged Access Management (PAM)

31. Security Process in DevSecOps
Security
Process in
Automation Security:
Production Stage

32. Security Process in DevSecOps
Automation Security Baseline
Automation Security Baseline build standard hardening steps into
your recipes instead of using scripts or manual checklists. This includes
minimizing the attack surface by removing all packages that aren’t needed
and that have known problems; and changing default configurations to be
safe.

33. Security Process in DevSecOps
Automation Security Baseline Tools

34. Security Process in DevSecOps
Cloud Security Automation
● Monitoring - it is necessary that you monitor the workflow of all the
tasks in your infrastructure.
● Evaluation - give you insights into which tasks can be automated like
repetitive tasks, resource provisioning, deployments, creating security
rules, etc.
● In-depth analysis - analyze the collected information in depth by
differentiating it on the basis of severity as high, medium or low risk.
● Reporting - The automation processes should be configured to
generate the reports to present the overview of the changes before or
after.
● Remediations - implement remediation and improve overall security
posture.

35. Security Process in DevSecOps
RASP (Run-time Application Security Protection)
RASP works inside the application. It’s plugged into an application or
its runtime environment and can control application execution. RASP lets
an app run continuous security checks on itself and respond to live
attacks by terminating an attacker’s session and alerting defenders to the
attack.

36. Security Process in DevSecOps
WAF (Web Application Firewall)
WAF or Web Application Firewall helps protect web applications by
filtering and monitoring HTTP traffic between a web application and the
Internet. It typically protects web applications from attacks such as
cross-site forgery, cross-site-scripting (XSS), file inclusion, and SQL injection,
among others. A WAF is a protocol layer 7 defense (in the OSI model)

37. Security Process in DevSecOps
Security monitoring, sometimes referred to as "security information
monitoring (SIM)" or "security event monitoring (SEM)," involves
collecting and analysing information to detect suspicious behavior or
unauthorised system changes on your network, defining which types of
behavior should trigger alerts, and taking action on alerts as needed.
Security Monitoring

38. Security Process in DevSecOps
Security
Process in
Wrap Up

39. Security Process in DevSecOps
Automation Security
Agile
Focus
DevOps
Focus on Automation
Security in every steps
with Automation
Code Build Integrate Test Release Configure Monitor
Plan Deploy

40. Security Process in DevSecOps
More questions?
jirayut@opsta.co.th
Jirayut Nimsaeng
CEO & Founder
Opsta (Thailand)
086-069-4042
Facebook