Continuous security improvements in the DevOps process
3 likes1,795 views
This document discusses continuous security improvement in the DevOps process. It describes how a DevOps company called VSHN integrates security practices like application security, DevSecOps, and security operations into the software development lifecycle. These include implementing security best practices and tools for activities like code analysis, dependency management, container scanning, testing, deployment, operations, identity and access management, logging, and metrics collection. The goal is to automate security across build, test, deploy, and operations phases to deliver secure software through a DevSecOps approach.
More Related Content
What's hot (20)
Similar to Continuous security improvements in the DevOps process (20)
![[muCon2017]DevSecOps: How to Continuously Integrate Security into DevOps](https://cdn.slidesharecdn.com/ss_thumbnails/mucon2017devsecopshowtocontinuouslyintegratesecurityintodevops-171106193735-thumbnail.jpg?width=560&fit=bounds)
More from Aarno Aukia (18)
Recently uploaded (20)
![[gbgcpp] Let's get comfortable with concepts](https://cdn.slidesharecdn.com/ss_thumbnails/dimitris-platis-gbgcpp-concepts-250508080200-9d7e1e91-thumbnail.jpg?width=560&fit=bounds)
Continuous security improvements in the DevOps process
- 1. VSHN - The DevOps Company Continuous Security improvement in the DevOps process Aarno Aukia, CTO @ VSHN - The DevOps Company
- 2. VSHN - The DevOps Company ● About Aarno & VSHN.ch ● From Ops to DevOps ● DevOps/DevSecOps/SecOps? ● Automating Operations to include security ○ Build ○ Test ○ Deployment ○ Ops 22 Agenda
- 3. VSHN - The DevOps Company @aarnoaukia http://about.me/aarno [email protected] ETH → Google → Atrila → VSHN VSHN - The DevOps Company Since 2014, currently 30 VSHNeers in Zürich, Switzerland We help developers run web applications 24/7 in any cloud making both visitors happy with stability and developers happy with agility 33 About Aarno & VSHN.ch
- 4. VSHN - The DevOps Company 4 OPS = Firefighting-as-a-Service ? 4
- 5. VSHN - The DevOps Company DevOps: People, Processes & Tools 55
- 6. VSHN - The DevOps Company Memberships 77
- 7. VSHN - The DevOps Company ● Developer education, requirements engineering, design review -> AppSec ● Software Build/Deployment/Operations -> DevSecOps ● Incident detection & management -> SecOps 88 Areas of security improvement
- 8. VSHN - The DevOps Company ● Developer education, requirements engineering, design review -> AppSec ● Software Build/Deployment/Operations -> DevSecOps ● Incident detection & management -> SecOps 99 Areas of security improvement
- 9. VSHN - The DevOps Company DevSecOps principles 1010
- 10. VSHN - The DevOps Company ● static code analysis automatically for each commit ● Dependency Management ● (base) container image scanning 1111 Build
- 11. VSHN - The DevOps Company Code analysis: sonarqube 1212
- 12. VSHN - The DevOps Company 1313 Dependency updates: https://dependabot.com
- 13. VSHN - The DevOps Company Container scanning: aquasec 1414
- 14. VSHN - The DevOps Company ● smoke tests ● test envs “à discretion” 1515 Test
- 15. VSHN - The DevOps Company ● atomic container deployment ● every deployment (and rollback) is a “normal deployment” ● deployment automation removes need for (all) devs root prod access and/or waiting for ops to deploy new dev version 1616 Deployment
- 16. VSHN - The DevOps Company ● standardization on (minimal, hardened) OS and container orchestrator ● immutable (application) infrastructure using containers ● process/storage/network separation of applications/environments ● detect/prevent configuration drift between dev/test/stage/prod envs ● documentation & automatic backup of all volumes ● documentation & monitoring of routes/loadbalancers/ingresspoints with enforcing SSL/TLS ● AAI for admin & application ● key & secrets management ● audit logging of control & application planes 1717 Ops
- 17. VSHN - The DevOps Company Container isolation 1818 ● Kernel namespacing (process & network) ● Control groups (resource quota to prevent DoS) ● SELinux (additional syscall filter) ● prevent running as root inside container, no user-provided privileged containers (enforce best practice) ● readonly container filesystem (harder to persist exploit at runtime)
- 18. VSHN - The DevOps Company AAI: Keycloak 1919 ● Identity & Access Management ● Single sign in/out ● Identity brokering: ○ OpenID Connect (OAuth2, FB/Twitter/Github etc.) ○ SAML2.0 ○ Kerberos ● User federation: LDAP, AD, etc ● 2FA: TOTP/HOTP ● Managing the Authorization groups
- 19. VSHN - The DevOps Company Logs: ELK/EFK/Greylog 2020 ● Logging all access and changes through the control plane ● Logging all access to the application and correlate with application logs ● Index, view, filter, aggregate KPI → monitoring ● Store outside of application scope
- 20. VSHN - The DevOps Company ● Prometheus ○ time series database ○ open source / CNCF-project ○ well-integrated in docker/kubernetes stats ● NewRelic APM ○ application-level profiling ○ performance tracking ○ exception tracking (backend & frontend) ○ available as SaaS 2121 Metrics: Prometheus / NewRelic
- 21. VSHN - The DevOps Company Kubernetes Distribution Architecture 2222
- 22. VSHN - The DevOps Company ● OpenShift, Kubernetes, Docker ● Logging: EFK ● Metrics: Prometheus ● SSL-Certificates: letsencrypt.org ● Source-to-image builder, Dockerfile builder, Docker-Image-Registry: OpenShift ● Load-balancing, horizontal (auto) scaling, rolling deployments: Kubernetes ● MySQL/MariaDB, PostgreSQL, Redis, Solr, Elasticsearch, RabbitMQ, MongoDB: either single-container for dev or DBaaS for prod ● 24/7 Support and SLA, cloud or on-premises 2323 Auxiliary Services we use at APPUiO.ch
- 23. VSHN - The DevOps Company 2424 APPUiO.ch in 14 countries & on-premises
- 24. VSHN - The DevOps Company ● Please do get in touch with feedback ● Twitter: @aarnoaukia ● Linkedin: https://www.linkedin.com/in/aukia/ ● Email: [email protected] 2525 Thank you
- 25. Come visit us for a coffee! VSHN AG - Neugasse 10 - CH-8005 Zürich - +41 44 545 53 00 - https://vshn.ch/ - [email protected] https://vshn.ch/kontakt/ Follow us on Twitter! @vshn_ch 26
- 26. VSHN - The DevOps Company The CNCF Landscape 2727
- 27. VSHN - The DevOps Company Next Event February 21, 2019 from 6.30pm https://www.meetup.com/Cloud-Native-Computing-Switzerland Please volunteer for Sponsoring & Talks https://cnc-meetup.ch 2828 Cloud Native Computing