The big picture. Culture, Processes and Technologies on a high level

Transcription

1 The big picture Culture, Processes and Technologies on a high level

2 Stefan Streichsbier Company: Vantage Point Why?

3

4 A Brief History of DevOps

5 In the beginning there was Source:

6 Waterfall Long release cycles A lot of WIP Functional silos Incredibly rigid

7 then there was Agile Source:

8 Agile Shorter release cycles Smaller batch sizes Cross-functional teams Incredibly agile

9 Suddenly Ops was the bottleneck

10 Agile Ops Anyone? 2 major related trends: 1. Agile Operations/Infrastructure 2. Collaboration between dev and ops Ultimately led to the first DevOpsDays in 2009

11 So, what is DevOps? Set of principles and practices for efficient communication and collaboration. (Culture) Automated deployment pipeline. (Processes) Supporting tool chain (Technologies)

12 [ ]it seems as though the problems are just between dev and ops, but test is in there, and you have security objectives. These are top-level concerns of Management [ ] and have become part of the DevOps picture. In other words, when you hear "DevOps" today, you should probably be thinking DevOpsQATestInfoSec." - Gene Kim

13 DevSecOps

14 Target State DevSecOps enables organisations to deliver inherently secure software at DevOps speed.

15 Security challenges in DevOps It is clear why companies are moving to DevOps Source: but how can security keep up with this?

16 3 key categories of DevSecOps 1. Culture 2. Processes 3. Technologies

17 Culture

18 Culture Communication and transparency High-trust environment blameless postmortem Continuous improvement Everyone is responsible for security Automate as much as possible Everything as code

19 Culture: Open Space Ideas How did your org switch to Dev(Sec)Ops? Continuous Improvement (Kaizen) What are you automating at the moment?

20 Processes

21 Processes 1. Secure SDLC 2. Security Pipelines

22 Processes: Secure SDLC 1. Training 2. Requirements 3. Architecture & Design 4. Coding 5. Testing 6. Deployment 7. Post Deployment

23 Processes: Sec Pipelines Opt. critical resource Reduce friction Increase visibility Each step repeatable Drive up consistency

24 Security Pipelines

25 Processes: Open Space Ideas How are you managing security requirements? How are you building security into the SDLC? AppSec Pipelines in the wild ChatSecOps

26 Technologies DevOps is not supposed to be about tools

27 DevSecOps Technologies 1. Requirements 2. Code: IDE Plugins, SAST 3. Test: Gauntlt, *AST 4. Configure: Sec as Code 5. Maintenance: Patch Management 6. Monitor: Auditing, Attack visibility, RASP Warning about *AST

28 Technologies: Open Space Ideas Scaling security requirements TDD and security in testing Which *AST technologies have you been using? Experience with IDE Plugins Environment management (Dev/Prod parity) Configuration management (configuration drift) Patch Management and deployment strategies (e.g. Phoenix)

29 Summary DevSecOps enable organisations to deliver inherently secure software at DevOps speed.

30 Questions?

31 Inspirations