Dev Breakfast: Level up to DevSecOps

Preventing Devoops with DevSecOpsKieran JacobsenTechnical Lead – Infrastructure & Security

/ Copyright ©2017 by Readify Limited2Page

2016 was a big year…


2017 is getting of to a bad start…


Before DevOps


DevOps


But Where Is Security?


DevSecOps› Clear Communication Pathways› Streamlined Communication› Security As Code› Training› Integrate security into DevOps cycle


Communication PathwaysDevelopment Operations

Security


Streamlined CommunicationNO:› Excel checklists› Word document reports› Email Attachments


Streamlined CommunicationYES:› Backlogs/boards


Streamlined CommunicationYES:› Backlogs/boards› Support ticketing


Streamlined CommunicationYES:› Backlogs/boards› Support ticketing› Markup and Git


Security As Code› Application Source Code› Azure ARM and AWS Cloud Formation› Server Configuration – Chef, Puppet, DSC


ARM Templates


PowerShell DSC


Training› We can’t be experts in Dev, Sec and Ops› We need cross pollination of skills› Starts at day 0› Hands on training for senior developers


Training: PhishingEmployee Breakdown

Technical Non-Technical

Click Break Down

Technical Victims Non-Technical VictimsPassed


Integrating Security


Plan› Integrate security into sprint planning and reviews

› Consider security user stories early


Code› Training!› Test driven development› Use of the correct tools› Pull Requests


Build› Static code analysis› Dynamic code analysis


Test› Develop security test cases› Fuzzing› Load testing


Release & Deploy› Automated scanning upon deployment


Operate & Monitor› Monitor logs› Rescan for vulnerabilities› Track dependencies

Thank You

Dev Breakfast: Level up to DevSecOps

Technology