Scribd Logo
Upload

Welcome to Scribd!

  • 980 views

    DevSecOps Presentation

    Uploaded by

    cheenu
    DevSecOps seeks to integrate security practices into DevOps processes to enable organizations to deliver secure software at DevOps speeds. It incorporates security principles into the DevOps pipeline through changes to culture, processes, and technologies. On the culture side, it emphasizes communication, transparency, trust, continuous improvement, and shared responsibility for security. Processes are secured through techniques like integrating application security testing into the software development lifecycle. Technologies like static application security testing tools, containerization, and infrastructure as code help automate security practices. The goal is to help organizations innovate faster while maintaining security.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    DevSecOps Presentation

    Uploaded by

    cheenu
    980 views20 pages
    DevSecOps seeks to integrate security practices into DevOps processes to enable organizations to deliver secure software at DevOps speeds. It incorporates security principles into the DevOps pipeline through changes to culture, processes, and technologies. On the culture side, it emphasizes communication, transparency, trust, continuous improvement, and shared responsibility for security. Processes are secured through techniques like integrating application security testing into the software development lifecycle. Technologies like static application security testing tools, containerization, and infrastructure as code help automate security practices. The goal is to help organizations innovate faster while maintaining security.

    Original Description:

    DevSecOps Presentation explaining the concept in detail.

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    DevSecOps seeks to integrate security practices into DevOps processes to enable organizations to deliver secure software at DevOps speeds. It incorporates security principles into the DevOps pipeline through changes to culture, processes, and technologies. On the culture side, it emphasizes communication, transparency, trust, continuous improvement, and shared responsibility for security. Processes are secured through techniques like integrating application security testing into the software development lifecycle. Technologies like static application security testing tools, containerization, and infrastructure as code help automate security practices. The goal is to help organizations innovate faster while maintaining security.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    980 views20 pages

    DevSecOps Presentation

    Uploaded by

    cheenu
    DevSecOps seeks to integrate security practices into DevOps processes to enable organizations to deliver secure software at DevOps speeds. It incorporates security principles into the DevOps pipeline through changes to culture, processes, and technologies. On the culture side, it emphasizes communication, transparency, trust, continuous improvement, and shared responsibility for security. Processes are secured through techniques like integrating application security testing into the software development lifecycle. Technologies like static application security testing tools, containerization, and infrastructure as code help automate security practices. The goal is to help organizations innovate faster while maintaining security.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 20

    DevSecOps

    “Everyone is responsible for security”


    Quick look at DevOps
    DevOps is a set of practices that automates the processes
    between software development and IT teams, in order
    that they can build, test, and release software faster and
    more reliably.

    It's a firm handshake between development and


    operations that emphasizes a shift in mindset, better
    collaboration, and tighter integration. It unites agile,
    continuous delivery, automation, and much more, to help
    development and operations teams be more efficient,
    innovate faster, and deliver higher value to businesses and
    Source: https://en.wikipedia.org/wiki/DevOps
    customers.
    Better, faster, cheaper software with DevOps
    COMPANY DEPLOY DEPLOY RELIABILITY CUSTOMER
    FREQUENCY LEAD TIME RESPONSIVENESS

    AMAZON 23000 / day Minutes High High

    GOOGLE 5500 / day Minutes High High

    NETFLIX 500 /day Minutes High High

    FACEBOOK 1 / day Minutes High High

    TWITTER 3 / week Minutes High High

    TYPICAL Once in every 9 Months or quarters Low / Medium Low / Medium


    ENTERPRISE Months

    but is it secure?
    Meet DevSecOps
    DevSecOps enables organisations to
    deliver the secure software at DevOps
    speed.

    DevSecOps seeks to achieve greater efficiency


    and productivity by incorporating security
    principles within DevOps process.

    Source:
    https://www.checkmarx.com/wp-content/uploads/2016/07/Dev-Software-releases-.png
    DevSecOps in 3 key categories

    Culture Processes Technologies


    Culture
    ● Communication and transparency
    ● High trust environment
    ● Continuous improvement
    ● Everyone is responsible for security
    ● Automate as much as possible
    ● Everything as code
    ○ Infrastructure as code
    ○ Security as code
    ○ Compliance as code
    Processes

    Secure SDLC
    How do we integrate AppSec pipeline in DevOps?
    How do we integrate AppSec pipeline in DevOps?
    git

    Unit Tests

    Integration Tests

    Code Analysis

    Create Docker Image

    Start Docker Image Load Test Server

    Load Tests

    Deploy

    DevOps Pipeline AppSec Pipeline


    Test Production
    Technologies - Incorporate the security principles in DevOps

    SDLC Technologies

    Requirements -

    Code SAST, IDE Plugins

    Test Gauntlt, DAST (Dradis, Scout2, OpenVas,


    ZAP)

    Configure Everything as code

    Maintenance Patch Management (Phoenix)

    Monitor Auditing, Attack, RASP, ELK


    Trainings
    Secure Coding Practices

    It will help organisations to develop the secure code in order to eliminate the risks and threats at
    development stage.

    ● Secure code trainings


    ● Code review
    ● Best coding practices
    Code
    DevSecOps enables developers to write the secure code by integrating the security plugins in
    IDE.

    SAST - Secure code analysis tool, also referred to as Static Application Security Testing tools,
    designed to analyze the source code to help find the security flaws.

    ● Sonarqube
    ● Checkmarx
    ● IBM App Scan
    Test - Automate as much as possible.

    DAST - A dynamic analysis security testing tool, or a DAST test, is an application security solution
    that can help to find certain vulnerabilities in web applications while they are running in
    production

    Gauntlt - Gauntlt provides hooks to a variety of security tools and puts them within reach of
    security, dev and ops teams to collaborate to build rugged software. It is built to facilitate testing
    and communication between groups and create actionable tests that can be hooked into your
    deploy and testing processes.

    ● Curl
    ● nmap
    ● sqlmap
    ● Garmr
    ● sslyze
    Configure
    Everything as code

    ● Infrastructure as code
    ● Security as code

    Platform requirements, server hardening etc. should not be a problem in today’s world. We
    should learn to codify as much as possible. It enables Dev, Sec and Ops team to perform actions
    on a single click.

    ● Docker - Containerized applications


    ● Kubernetes - Automated deployment, scaling and management of containerized
    applications
    Maintenance
    Patch Management

    Phoenix deployment strategies can help organisation to quickly deploy the completely new
    instance of the application that is patched to the production environment and parallely destroy
    the existing instance.

    It would help organisation to eliminate all the configuration drift or even technical issues at
    DevOps speed.
    Monitor
    Ability to monitor the secure SDLC.

    ● Auditing
    ● Attack Visibility
    RASP
    Runtime application self-protection security (RASP)

    It is a security technology that is built into an application and can detect and then prevent
    real-time application attacks. RASP prevents attacks by “self-protecting” or reconfiguring
    automatically without human intervention in response to certain conditions (threats, faults, etc.)
    ChatSecOps
    ChatSecOps enables organisations to make the safe service portals which are being used for
    chatting. For eg: Slack, HipChat etc.

    Ex: Imagine a simple chat command to push the code to QA and it’s done.
    Thank You

    You might also like