Downloaded 160 times
Uploaded byCheckmarx
DevOps & Security: Here & Now
The document outlines the integration of security into the DevOps process, emphasizing the need for a new secure software development lifecycle (SDLC) approach. Key steps include planning for security, engaging developers, automating processes, and using traditional security tools wisely. It concludes that security should not be compromised as DevOps continues to evolve rapidly.
In this document
Powered by AI
Overview of DevOps, emphasis on integrating security into the DevOps lifecycle.
Analysis of traditional web application security controls and their limitations in a DevOps environment.
Outline of a new secure Software Development Life Cycle (SDLC) approach with practical steps.
The importance of automating security processes within continuous deployment methodologies.
Recommendations to leverage traditional security tools wisely alongside modern practices.
Recap of the presentation emphasizing immediate action points for integrating security in DevOps.
Invitation for questions and thank you note from the speaker.
More Related Content
![[ITAS.VN]CxSuite Enterprise Edition](https://cdn.slidesharecdn.com/ss_thumbnails/itascxsuiteenterpriseedition-120130231915-phpapp01-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to DevOps & Security: Here & Now
![Vibe Coding vs. Spec-Driven Development [Free Meetup]](https://cdn.slidesharecdn.com/ss_thumbnails/vibecodingvsspecdrivendevelopment-251209105622-43f455e7-thumbnail.jpg?width=640&height=640&fit=bounds)
DevOps & Security: Here & Now
- 1. DevOps and Security:It’s Happening. Right Now. Helen Bravo Director of Product Management at Checkmarx [email protected]
- 2. Agenda • Intro toDevOps • Integrating security within DevOps – Problems with traditional controls – Steps to DevOps security
- 3. What is DevOpsAbout? An unstoppable deployment process … in small chunks of time
- 4. DevOps is Happening Companiesthat have adopted DevOps
- 5. Can TRADITIONAL web application securitycontrols fit in… … a DevOps environment?!
- 6. Traditional Web ApplicationSecurity Controls • Penetration Testing • WAF (Web Application Firewall) • Code Analysis
- 7.
- 8. Penetration Testing – 300pages report – 3 weeks assessment time – 2 weeks to get it into development
- 9. Web Application Firewall(WAF) Thinking Continuous Deployment? Think Continuous Configuration!
- 10. Code Analysis • Setuptime • Running time • Analysis time … just too slow!
- 12.
- 13. Required: A NewSecure SDLC Approach
- 14.
- 15. Step 1: Planfor Security
- 16. Step 1: Planfor Security • Identify unsecured APIs and frameworks • Map security sensitive code portions. E.g. password changes mechanism, user authentication mechanism. • Anticipate regulatory problems, plan for it.
- 17. Step 2: Engagethe Developers. And Be Engaged
- 18. Step 2: Engagethe Developers. And Be Engaged • Connect developers to security – Going to OWASP? Bring a developer with you! • Is your house on fire? Share the details with your developers. • Have an open door approach • Set up an online collaboration platform E.g. Jive, Confluence etc.
- 19. Step 3: Armthe Developers
- 20. Step 3: Armthe Developer • Secure frameworks: – Use a secure framework such as Spring Security, JAAS, Apache Shiro, Symfony2 – ESAPI is a very useful OWASP security framework • SCA tools that can provide security feedback on pre-commit stage. – Rapid response – Small chunks
- 21. Step 3: Automatethe Process
- 22. Step 3: Automatethe Process • Integrate within your build (Jenkins, Bamboo, TeamCity, etc.) – SAST – DAST • Fail the build if security does not pass the bar.
- 23. Continuous Deployment Unit Tests Develop Code Commit Source Control Build Trigger Deployto Test Env Report & Notify Publish to release repository Deploy to Production
- 24. Security within ContinuousDeployment Tests Develop Code Commit Source Control Build Trigger Deploy to Test Env SCA Test Publish to Automatic Report release security repository & test Notify Deploy to Production
- 25. Step 5: UseOld Tools Wisely
- 26. Step 5: UseOld Tools Wisely • Periodic pen testing • WAF on main functions • Code review for security sensitive code portions.
- 27.
- 28. Summary • DevOps ishappening. Right Now. – During the time of this talk, Amazon has released 75 features and bug fixes. • Security should not be compromised • Don’t be overwhelmed. Start small
- 29. The 3 Takeaways 1.Plan from the ground 2. Engage with your developers 3. Integrate security into automatic build process.
- 30.
- 31.