Continuous Security / DevSecOps- Why How and What
1 like283 views
This presentation explains what Continuous Security / DevSecOps is, Why it is important, How it works and What you can do to realized a well-engineered DevSecOps solution in your own organization or enterprise.
![[2022 DevOpsDays Taipei] 走過 DevOps 風雨的下一步](https://cdn.slidesharecdn.com/ss_thumbnails/devopslite-220919142820-a07e7eca-thumbnail.jpg?width=560&fit=bounds)
Ad
More Related Content
What's hot (20)
Similar to Continuous Security / DevSecOps- Why How and What (20)
Ad
More from Marc Hornbeek (20)
Ad
Recently uploaded (20)
Continuous Security / DevSecOps- Why How and What
- 1. Marc Hornbeek a.k.a. DevOps_the_Gray esq. CEO and Principal Consultant Engineering DevOps Consulting Author – Engineering DevOps [email protected] Continuous Security / DevSecOps Evolving from Security-as-an-audit strategies to Lifecycle Security-as-code strategies mybook.to/engineeringdevops https://devops.com/9-pillars-of-continuous-security-best-practices/
- 2. Enterprise, Manufacturers, Service Providers and Institutions DevOps / QA / DevSecOps / SRE www.engineeringdevops.com [email protected] Training and Certifications DevOps, DevSecOps QA, SRE Assessments DevOps, DevSecOps, QA, SRE Strategic Planning Agile plans for 26 topics Speaking Engagements Conferences, Events, Onsite or Online Advisory Services Workshops, mentoring Content Writing Blogs, White papers, eBooks Webinars Content and delivery Engineering DevOps Consulting
- 3. www.engineeringdevops.com What You Will Learn • What is Continuous Security / DevSecOps? • Why is continuous security important to DevOps? • How is security integrated into Continuous DevOps environments? • What do you need to integrate continuous security? • Typical Q&A
- 4. What is Continuous Security / DevSecOps? Leadership Culture Design Integration Testing Infrastructure Monitoring Deployment
- 5. What is Continuous Security / DevSecOps? Continuous Security as an integral part of continuous delivery cultures, processes and value streams. Integrating security practices into DevOps, such as Security as Code, is a way for security practitioners to operate and contribute value with less friction. Security practices must adapt dynamically to ensure data security and privacy issues are not left behind in the fast-paced world of DevOps.
- 6. Why is continuous security important to DevOps? DevOps without DevSecOps generates security risks.
- 7. Why is continuous security important to DevOps? DevOps without DevSecOps generates security risks. DevOps without DevSecOps is dangerous! Like Fusion energy: powerful but dangerous if not controlled Acceleration of dev and deployment without DevSecOps practices can result in unintended security risks (E.g. OWASP Top 10) - Designs without security considerations - New Attack surfaces: IOT, Mobile, home offices - Vulnerabilities embedded in code - Credentials embedded in dev artifacts - Additional Infrastructure attack surfaces - Poor Database from SQL injections - Exposing sensitive data - 3rd party code – Open source - Software supply chain (E.g., SolarWinds) - Inadequate login and monitoring capabilities.
- 8. Why is continuous security important to DevOps? DevSecOps is an opportunity to integrate security into the DevOps value stream.
- 9. Why is continuous security important to DevOps? DevSecOps is an opportunity to integrate security into the DevOps value stream. • DevSecOps is a Holy Grail for cybersecurity • Like fusion power – sophisticated controls are needed • Change security structure from “expert governance role” to “educated workforce supported by integrated technologies and practices”: - Education and training - Design with Security practices - Automated security scanning - Automated testing - End-to-end monitoring - Immutable Infrastructure as code practices - Security monkey.
- 10. How is security integrated into Continuous DevOps environments? 9 Pillars of DevSecOps practices https://devops.com/9- pillars-of-continuous- security-best-practices/
- 11. How is security integrated into Continuous DevOps environments? Foundations • Orchestration and automation of security tools and processes • Governance through monitoring and “as-code” controls 9 Pillars • Leadership: Evangelist, sponsor, budget, behavior reinforcement • Culture: Education, Empowerment, Communication, collaboration • Design: Security design standards and practices • Integration: Security Scanning dependency tracking, source and image control • Testing: security tests • Monitoring: security logs and analysis • Security as a pillar: security center of excellence • Infrastructure: Immutable infra as code • Delivery/Deployment: Deployment strategies, quick detection and recovery Arches • Value Streams make security visible end to end. • Planning and operations based on continuous leaning • Releases gated with security metrics • CI/CD Security tools orchestration and automation DevSecOps Practices
- 12. Continuous Security / DevSecOps Engineering Blueprint DevSecOps provides an opportunity to reduce security risks if security is integrated into the continuous delivery pipeline according to good engineering practices.
- 13. How is security integrated into Continuous DevOps environments? Security instrumentation, automation and observability
- 14. How is security integrated into Continuous DevOps environments? Security instrumentation, automation and observability SHIFT VERY LEFT IS THE KEY TO DEVSECOPS • Top DevSecOps organizations focus on embedding security in the design and build stage of agile development. • Revamp the security operation model • Organization structure: from focus on security domains to Product focus • Communication: from formal governance to embedded culture • Roles and responsibilities: from Expert Assessor to Coaches and practitioners • Continuous Improvement: from Unconstructive KPIs to observable SLO/SLIs Center of Security Excellence Approach 1. Educate and empower others rather than policing compliance. 2. Automate security to help IT and the business achieve their agility goal 3. Monitor exceptions rather than police non-compliance. Employ Observability and SLO/SLO concepts.
- 15. Seven-Step Transformation Blueprint 1. Visioning 2. Alignment 3. Assessment 4. Solution 5. Realize 6. Operationalize 7. Expansion What do you need to integrate continuous security? Kickoff Meeting Discovery Surveys Solution Mapping Workshops & Interviews Recommended Solution Follow-up Typical duration 21 days Rapid Strategic DevSecOps Assessment
- 16. DevOps Adoption Blueprint Leadership / Culture Initiative Model Application m Application m + 1 • Adoption goals • Leaders training • Organization preparation • Model project selection • Investment (team & tools) • Architecture team • Monitoring and incentives • Team and organization • Training (CI/CD practices) • Goals, Assessment, Value Stream • Tool chain with ARA backbone • Automate CI and QA automation • Automate CD , containers, G/B, A/B • DevSecOps, SRE practices • KPIs, SLOs and monitoring tools • Site Reliability Engineering • Optimize (Kaizen) • App Selection • Self contained product teams (squads, tribes, SREs) • Proactive sharing or practices (Yokoten) • Info sharing (Chapters and Guilds) SCALE ! Systematic, measured, adoption progression POC MVP 2nd Way 1st Way 3rd Way Application m + 2 Application m + n . . . Scaling DevSecOps – Progressive Adoption Blueprint
- 17. DevOps Adoption Blueprint Scaling DevSecOps – Progressive Adoption Blueprint The DevOps Progressive Adoption blueprint ensures all applications targeted for DevOps transformation progress towards continuous improvement instead of stalling out. Scaling DevOps to other applications across the enterprise will typically occur nearly in parallel with the development of DevOps for the Model application. Success patterns learned from the model application are communicated across the enterprise and applied to other applications proactively in a way referred to as “Yokoten”. The priorities for applications follow the same application selection criterion as the model. As DevOps scales to more and more applications across the enterprise, more of the organization is restructured into tightly coupled product teams while maintaining a culture of proactive cross-team sharing of DevOps practices. Establishing cross-team Chapters and Guilds is a good approach to facilitate sharing and communication.
- 18. Summary / Takeaways Continuous security/DevSecOps is at once a transformation challenge to an opportunity for dramatic security improvement. There is no “standard” DevSecOps approach in the industry. The Continuous Security approach based on the Continuous Security Blueprint, 9 Pillars Assessment, Seven-Step Transformation Blueprint and Progressive Adoption Blueprint is proven, progressive and adaptable approach. Refer to www.engineeringdevops.com for more information regarding the Continuous Security/ DevSecOps approach.
- 19. Discussion Questions What % of organizations are embracing continuous security? QA (10%) – DevOps (70%) – DevSecOps (?)- SRE/Security (?) World Software Quality 2020 Upskilling Report – DevOps Institute 42% project level 23% enterprise level 16% planning 81% overall Of those 52% state SECURITY SKILLS ARE MUST-HAVE
- 20. What are some myths and realities for continuous security? Myth: tools and automation alone are the answer Reality: leadership, culture, training, automaton, observability Myth: Adopting DevSecOps means giving up control. Reality: SAC improves governance and compliance to security standards through automation.
- 21. What are impediments to implementing continuous security? Need to establish a Center of Security Excellence Approach 1.Strategy Alignment 2.Culture - Educate and empower others rather than policing compliance. 3.Tools and Automation – strategy selection and work 4.Monitor exceptions rather than police non-compliance. Employ Observability and SLO/SLO concepts.
- 22. How can you determine a roadmap to continuous security? There no one way or standard. What has proven to work: • Seven-Step Transformation Blueprint, starting with strategy alignment • Strategic Progressive Adoption Blueprint
- 23. How will emerging technologies affect continuous security? • New attack surfaces – Work from home, IOT,5G Access networks • Supply chain – open source and 3rd part • DevSecOps embedded into applications, pipelines and infrastructure • Cloud-native, containers, microservices • DevSecOps as a service • AI/ML to help improve scans, observability and determine best actions
- 24. DevOps / DevSecOps / SRE Tools Blueprints, Scorecards, Engineering Practices, Assessment tool, calculators, templates DevOps / DevSecOps / SRE Services Assessments, Strategic Planning, Training, Content www.EngineeringDevOps.com DevOps / DevSecOps / SRE White Papers & Book