The Seven Habits of the Highly Effective DevSecOp
•
13 gefällt mir•2,298 views
DevOps and the subsequent move bring security in under the umbrella of DevSecOps has created a new ethos for security. This is good, however moving security and devops closer together in many organizations leaves us with questions of how this merge works in practice. What happens to security? To developers? And really, what makes a good DevSecOp? This talk highlights the seven habits that the high-performing DevSecOp of today (and tomorrow) should develop. Topics range from empathy to lean to system safety with the hope to uncover a new playbook for devs, ops, and security to work together.
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Ähnlich wie The Seven Habits of the Highly Effective DevSecOp
Ähnlich wie The Seven Habits of the Highly Effective DevSecOp (20)
Mehr von James Wickett
Mehr von James Wickett (8)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
The Seven Habits of the Highly Effective DevSecOp
- 1. THE SEVEN HABITS OF THE HIGHLY EFFECTIVE DevSecOp @WICKETT
- 2. JAMES WICKETT Sr. Sec Eng & Dev Advocate @ Verica Former Head of Research @ Signal Sciences Author, LinkedIn Learning Organizer, DevOps Days Austin, Serverless Days ATX, DevSecOps Days Austin Author, DevSecOps Handbook @wickett
- 5. VERICA.IO An enterprise platform for Continuous Verification, using Chaos Engineering principles, to take a proactive and measured approach to preventing availability and security incidents. @wickett
- 7. credit to Josh Zimmerman, the original DevOps Jack Handy
- 10. FIRST, UNDERSTAND DEVOPS AND HOW WE GOT HERE @wickett
- 13. DATASo Big Right Now @wickett
- 16. YASSS! OPS (and security) FOR FREE!@wickett
- 17. DevOps grew hand-in-hand with cloud @wickett
- 19. DevOps is the inevitable result of needing to do efficient operations in a distributed computing and cloud environment. Tom Limoncelli @wickett
- 20. DevOps is an epistemological breakthrough joining disparate people around a common problem @wickett
- 21. DevOps was needed to fix the inequitable distribution of labor @wickett
- 23. DevOps is not a technological problem. DevOps is a business problem. - Damon Edwards @wickett
- 24. DevOps is just another waypoint on Agile's journey across the business @wickett
- 25. DevOps is the application of Agile methodology to system administration — The Practice of Cloud System Administration Book @wickett
- 26. Ok DevOps, that's fine. But why DevSecOps? @wickett
- 27. I ASKED MYSELF THIS SAME QUESTION @wickett
- 28. @wickett
- 29. Security finds itself in the same position that operations did in the movement of DevOps @wickett
- 32. Security, like ops struggles to provide value in most organizations @wickett
- 33. Companies are spending a great deal on security, but we read of massive computer-related attacks. Clearly something is wrong. The root of the problem is twofold: we’re protecting the wrong things, and we’re hurting productivity in the process. @wickett
- 34. [Security by risk assessment] introduces a dangerous fallacy: that structured inadequacy is almost as good as adequacy and that underfunded security efforts plus risk management are about as good as properly funded security work @wickett
- 35. While engineering teams are busy deploying leading-edge technologies, security teams are still focused on fighting yesterday’s battles. SANS 2018 DevSecOps Survey @wickett
- 36. 95%OF SECURITY PROFESSIONALS SPEND THEIR TIME PROTECTING LEGACY APPLICATIONS @wickett
- 37. TECH BURDEN CAN ONLY BE TRANSFERRED @wickett
- 38. SECURITY BURDEN IS NOT CREATED OR DESTROYED, MERELY TRANSFERRED @wickett
- 39. "MANY SECURITY TEAMS WORK WITH A WORLDVIEW WHERE THEIR GOAL IS TO inhibit change AS MUCH AS POSSIBLE" @wickett
- 40. New technology (cloud, k8s, serverless, ...) and increased organization focus on software delivery is why we need DevSecOps. @wickett
- 41. A Highly Desireable New Breed: THE DEVSECOP @wickett
- 42. ...not a tool …not a CI/CD pipeline with security in it ...can’t be bought on an expo floor @wickett
- 43. An inclusive person participating in the movement of security into devops. @wickett
- 46. MEASURE DEVSECOPS Maker Driven Experimenting Automating Safety Aware Unrestrained Sharing Ruggedizing Empathy First
- 47. MEASURE@wickett
- 49. We are software engineers who specialize in a specific discipline: security @wickett
- 50. SECURITY MUST BE ABLE TO WRITE CODE@wickett
- 51. Why is this considered a hot take in our industry? @wickett
- 52. With all the resources available today... @wickett
- 55. SECURITY ALREADY USES DSLS @wickett
- 57. The Entire Security Team Must Write Code Shannon Lietz, Intuit Aaron Rinehart, United Health Group @wickett
- 58. WHY IS THIS IMPORTANT? ▸ Empathy building ▸ Familiarity with tools ▸ Able to move up the pipeline @wickett
- 59. A BUG IS A BUG IS A BUG @wickett
- 60. Defect Density studies range from .5 to 10 defects per KLOC @wickett
- 61. DEFECT DENSITY IS NEVER ZERO @wickett
- 62. But my application is just a few lines of code @wickett
- 63. 222 Lines of Code 5 Direct Dependencies 54 total deps (including indirect) (example from snyk.io) @wickett
- 67. You cannot train developers to write secure code @wickett
- 68. INSTEAD, FOCUS ON METHODS DEVELOPERS USE ▸ TDD/BDD/ATDD ▸ Meaningful comments/commits ▸ Code Smells, Refactoring ▸ Instrumentation @wickett
- 69. The goal should be to come up with a set of automated tests that probe and check security configurations and runtime system behavior for security features that will execute every time the system is built and every time it is deployed.
- 70. Security is connected with quality @wickett
- 73. MAKER DRIVEN means ▸ See security as part of engineering ▸ View quality as a way to bring security in ▸ Use code, not vendors to solve problems @wickett
- 74. MEASURE@wickett
- 76. BENEFITS TO EXPERIMENTATION ▸ Measured, Repeatable ▸ Results based on your needs @wickett
- 77. @wickett
- 78. DETECT WHAT MATTERS ▸ Account takeover attempts ▸ Areas of the site under attack ▸ Most likely vectors of attack ▸ Business logic flows ▸ Abuse and Misuse @wickett
- 79. We can't cede home field advantage — Zane Lackey @wickett
- 80. EXPERIMENTING NECESSITATES UNDERSTANDING STEADY STATE @wickett
- 81. RESOURCES ▸ Shannon Lietz (@devsecops) ▸ DOES 2018 Talk: youtu.be/ yuOuVC8xljw @wickett
- 82. MEASURE@wickett
- 85. @wickett
- 86. @wickett
- 87. AUTOMATION PROVIDES FEEDBACK ▸ Pre-commit ▸ At build ▸ Deploy ▸ Runtime @wickett
- 88. @wickett
- 89. Continuous Delivery is how little you can deploy at one time — Jez Humble & David Farley @wickett
- 90. At Signal Sciences, we optimized total cycle time--from code commit to running in prod @wickett
- 91. 15,000 DEPLOYS IN 3.5 YEARS @wickett
- 92. SECURITY IN THE PIPELINE ▸ Software composition analysis ▸ Lang linters, git-hound, ... ▸ Scanners, gauntlt ▸ Monitoring and telemetry @wickett
- 93. [Deploys] can be treated as standard or routine changes that have been pre-approved by management, and that don’t require a heavyweight change review meeting.
- 97. MEASURE@wickett
- 99. Two Stories of Failure @wickett
- 101. @wickett
- 102. 5 Why's and Linear Questioning is Flawed @wickett
- 103. WE ABSTRACT COMPLEXITY ▸ Human beings ▸ Societial issues ▸ Psychological issues ▸ Cognitive load @wickett
- 104. SOFTWARE DEALS WITH COMPLEXITY THROUGH ABSTRACTION @wickett
- 105. ROOT CAUSE IS A MYTH ▸ Lacks full picture ▸ Blame culture ▸ Forgets organizational decisions ▸ Puts the focus on the event over situation ▸ Complex systems are not linear @wickett
- 106. Drifting into failure is a gradual, incremental decline into disaster driven by environmental pressure, unruly technology and social proccesses that normalize growing risk. No organization is exempt from drifting into failure
- 107. BOEING 737MAX ▸ Maneuvering Characteristics Augmentation System (MCAS) keeps the bigger plane from stalling ▸ The MCAS is automation software ▸ In certain situations, MCAS commands the trim in this condition without notifying the pilots @wickett
- 108. These events unfolded in minutes, at low altitudes right after takeoff, asking pilots to realize, understand, and respond to why their aircraft was silently fighting their inputs
- 109. in a context of being told that the “system” they were operating was pretty much like every other 737 they’d been likely to operate in their careers, ever. @jpaulreed
- 110. This new safety automation is capable of overriding operator input in silence and in ways that were poorly documented by designers, unclear to operators, and promised by developers
- 111. that nobody had to get new training on — a selling point — and this safety automation proved to cause the system to become critically unrecoverable in, at least, one case. -- @jpaulreed
- 112. HIGH-SPEED DECISIONS ABOUT SYSTEMS, SOUND FAMILIAR? @wickett
- 113. SOFTWARE IS EATING THE WORLD @wickett
- 114. The growth of complexity in society has got ahead of our understainding of how complex systems work and fail
- 115. @wickett
- 116. @wickett
- 117. Operations and Security's burden to rationalize system models @wickett
- 118. Failures are a systems problem because there is not enough safety margin. — @adrianco
- 119. Failure is an inevitable by- product of a complex system's normal functioning
- 120. WHERE SECURITY FITS ▸ Add safety margin ▸ Telemetry and instrumentation ▸ Blameless retros ▸ ...more to explore in this area @wickett
- 121. RESOURCES ▸ Drift into Failure by Dekker ▸ Understanding Human Error Video Series youtu.be/Fw3SwEXc3PU ▸ @jpaulreed coverage of Boeing medium.com/@jpaulreed ▸ Richard Cook paper bit.ly/2ydDQS2 @wickett
- 122. MEASURE@wickett
- 124. Culture is the most important aspect to devops succeeding in the enterprise — Patrick DeBois
- 125. DevSecOps is the extension of the DevOps culture for the inclusion of Security @wickett
- 126. A security team who embraces openness about what it does and why, spreads understanding. — Rich Smith
- 128. Unrestrained Sharing goes against security's standard operating procedure @wickett
- 131. FOUR KEYS TO CULTURE ▸ Mutual Understanding ▸ Shared Language ▸ Shared Views ▸ Collaborative Tooling @wickett
- 132. @wickett
- 133. SECURITY SHARES THROUGH ▸ Making invisible as visible ▸ Security Observability ▸ APIs, webhooks, dev tooling @wickett
- 134. Security Observability gives applications the ability to expose the attacks that are happening below the surface with feedback to devs, ops, and security. @wickett
- 135. A PAVED ROAD APPROACH ▸ Security as normal ▸ Security is "free" @wickett
- 138. RESOURCES ▸ Phoenix Project ▸ Agile Application Security ▸ dearauditor.org @wickett
- 139. MEASURE@wickett
- 142. SOFTWARE BILL OF MATERIALS KNOW WHAT YOU HAVE @wickett
- 143. FAVOR SHORT LIVED SYSTEMS CATTLE NOT PETS @wickett
- 144. DIE FRAMEWORK ▸ Distributed ▸ Immutable ▸ Ephemeral ▸ source: @sounilyu @wickett
- 145. RUGGEDIZATION IN 2020 ▸ Deception ▸ Chaos Engineering @wickett
- 146. DECEPTION ▸ Honeypots, Tarpits, Mantraps ▸ Simple to get started (http headers) ▸ HoneyPy, DeceptionLogic @wickett
- 147. We’re moving from disaster recovery to chaos engineering to resiliency — @adrianco @wickett
- 148. [Chaos Engineering is] empirical rather than formal. We don’t use models to understand what the system should do. We run experiments to learn what it does. — Michael Nygard, Release It 2nd Ed. @wickett
- 149. CHAOS ENGINEERING ▸ Experiments that span eng and security ▸ Manual opt-out ▸ Valuable Learning ▸ ChaosSlingr, CHAP, ChaosMonkey @wickett
- 150. RESOURCES ▸ Aaron Rinehart's talk at RSA youtu.be/wLlME4Ve1go ▸ Release It! 2nd ed., Nygard ▸ Phillip Maddux's talk: youtu.be/k81xKjCEeqE ▸ Herb Todd's talk: youtu.be/Cf_XXmRLnRQ @wickett
- 151. MEASURE@wickett
- 155. "you want a machine powered off and unplugged" — Developer @wickett
- 157. DON’T BE A BLOCKER BE AN ENABLER @wickett
- 158. MEASURE DEVSECOPS Maker Driven Experimenting Automating Safety Aware Unrestrained Sharing Ruggedizing Empathy First