Domenico Maracci, Stefano Sali - Secure Continuous Delivery - Sicurezza e DevOps a supporto della Digital Transformation
0 likes378 views
Oggi le aziende si trovano ad affrontare un percorso di Digital Transformation che richiede un’evoluzione dell'approccio classico alla gestione del ciclo di vita del software. L’Application Economy instaura un collegamento diretto tra l’IT di un’azienda ed il cliente finale: è per questo che le organizzazioni devono dotarsi degli strumenti e delle metodologie adatte a rispondere reattivamente ed in massima sicurezza agli input provenienti dal mondo esterno, garantendo massima compliance con le vigenti normative in ambito di sicurezza digitale.
Ad
More Related Content
What's hot (20)
Viewers also liked (20)
![[Keynote] Birgitta Boeckeler - Track Motivational - A programmer is...](https://cdn.slidesharecdn.com/ss_thumbnails/programmeriscodemotion-151124163409-lva1-app6891-thumbnail.jpg?width=560&fit=bounds)
![[Keynote] Joe Nash - The Operating System of Payments: UX and Security in Mod...](https://cdn.slidesharecdn.com/ss_thumbnails/joenashoperatingsystemofpayments-151124171931-lva1-app6891-thumbnail.jpg?width=560&fit=bounds)
Ad
Similar to Domenico Maracci, Stefano Sali - Secure Continuous Delivery - Sicurezza e DevOps a supporto della Digital Transformation (20)
Ad
More from Codemotion (20)
Recently uploaded (20)
Domenico Maracci, Stefano Sali - Secure Continuous Delivery - Sicurezza e DevOps a supporto della Digital Transformation
- 1. MILAN 20/21.11.2015 Talk title: Secure Continuous Delivery - Sicurezza e DevOps a supporto della Digital Transformation Domenico Maracci, Stefano Sali - CA Technologies
- 2. © 2015 CA. ALL RIGHTS RESERVED. $177BPublic cloud services market expected to grow 16% in 2015 to $177 billion1 50%By 2018, more than 50% of B2B collaboration will take place through Web APIs3 268BBy 2017, mobile apps will be downloaded more than 268 billion times2 “Software is eating the world” - Marc Andreeson Wall Street Journal, Why Software is Eating the World, August 2011 1 Gartner Forecast: Public Cloud Services, Worldwide, 2012-2018, 4Q14 Update, Ed Anderson, et al, 10 April 2015 2 Gartner Hype Cycle for Application Development, 2014, Thomas E. Murphy, et al, 29 July 2014 3 Gartner Press Release, “Gartner Says by 2017, Mobile Users Will Provide Personalized Data Streams to More Than 100 Apps and Services Every Day” January 22, 2014 http://www.gartner.com/newsroom/id/2654115
- 3. © 2015 CA. ALL RIGHTS RESERVED. Applications Are Changing the World of Business SO WHAT’SSO WHAT’S THE PROBLEM? 84%Video – US internet traffic by 2018 $13BAirBNB Market valuation $142BVolume of US Mobile-based payments by 2019 140MNumber of Uber rides last year
- 4. © 2015 CA. ALL RIGHTS RESERVED. Expectations Are Changing UNPRECEDENTED SPEED EXCEPTIONAL CUSTOMER EXPERIENCE 2015 Vanson Bourne study commissioned by CA Source: Reaching the Top of the Web Performance Mountain 94% of executives face increased pressure to release apps more quickly 25% of users will abandon a web application after just three seconds of delay
- 5. © 2015 CA. ALL RIGHTS RESERVED. Expectations Are Changing UNPRECEDENTED SPEED EXCEPTIONAL CUSTOMER EXPERIENCE 2015 Vanson Bourne study commissioned by CA Source: Reaching the Top of the Web Performance Mountain 94% of executives face increased pressure to release apps more quickly 25% of users will abandon a web application after just three seconds of delay
- 6. © 2015 CA. ALL RIGHTS RESERVED. …………………………………………………………………………………………………………………………......... 30XMore code deploym ents1 106%Higher revenue growth2 68%Higher profit growth2 High Performing Application Economy Leaders’ Competitive Advantage High Performing Application Economy Leaders’ Competitive Advantage 1 Puppet Labs “State of DevOps” 2 ”CA Application Economy Market Study” commissioned by CA, conducted by Vanson Bourne, 2014 DELIVERED RAPIDLY RESILIENT HIGH- QUALITY SECURE
- 7. © 2015 CA. ALL RIGHTS RESERVED. Eliminate constraints and critical dependencies Rapidly deliver high-quality applications and services Create and deliver exceptional customer value CONTINUOUSCONTINUOUS DELIVERYDELIVERY DIGITAL TRANSFORMATION Every Company is Becoming a Technology Company, Every Business a Digital Business Re-thinking how the business operates to find new ways to create and deliver customer value
- 8. © 2015 CA. ALL RIGHTS RESERVED. Agile, LeanAgile, Lean ITIL, process, SLA’sITIL, process, SLA’s Bring features/products to market fasterBring features/products to market faster Cloud, secure, open source, infrastructure-as-codeCloud, secure, open source, infrastructure-as-code Ensure availability and securityEnsure availability and security Legacy and proprietary apps/infrastructureLegacy and proprietary apps/infrastructure What are Challenges that Companies are Experiencing? SPEEDSPEED STABILITYSTABILITY Customer Experience DEVELOPMENTDEVELOPMENT OPERATIONOPERATION Customer Experience
- 9. © 2015 CA. ALL RIGHTS RESERVED. Communication and shared metrics and goals - driving business value Collaboration and Continuous Feedback Technology toolset enabling DevOps DevOps Transforms People, Process AND Technology SPEED & STABILITY DEVELOPMENTDEVELOPMENT OPERATIONOPERATION Customer Experience
- 10. © 2015 CA. ALL RIGHTS RESERVED. QA/TESTDEV PRODUCTIONPRE-PROD Traditional “software factory” DELAYS Customer Experience IDLE TIME Code | Integrate | Build IDE SCM CI CONFIGTESTCONTAINER CLOUD Functional & UA Testing Performance Testing Deploy to Productiondefectdefectdefect DELAYS DELAYS RE-WORK RE-WORK RE-WORK SLOW AND INEFFICIENT - EXCESSIVE IDLE TIME, DELAYS AND RE-WORK PROVISION Manual Testing Manual Scripting Developers Deadlocked Too little testing, too late in the cycle Too many disparate tools Poor customer experience Security Constrained Environments
- 11. © 2015 CA. ALL RIGHTS RESERVED. Traditional “unsecure software factory”
- 12. © 2015 CA. ALL RIGHTS RESERVED. Traditional “unsecure software factory” Inconsistent data segregation between environments Provide access for the right env to the right persons Security rules not applied across environments: Segregation of duties Least Privileges Access Control, Authentication, and Accounting
- 13. © 2015 CA. ALL RIGHTS RESERVED. Traditional “unsecure software factory” DEV env Difficult to have MOC for Authentication/Authorization Difficult to managed Identities like other environments Difficult to have APIs/WSs ready to use (with sec layer enabled)
- 14. © 2015 CA. ALL RIGHTS RESERVED. Traditional “unsecure software factory” QA/TEST env No availability of test data Giving the right access to RDBMS / data (JDBC accounts??) Accessing O.S. as Root or other privileged accounts
- 15. © 2015 CA. ALL RIGHTS RESERVED. Traditional “unsecure software factory” PRE-PROD and PROD envs Deployment scripts are application focused, forgetting security topics Management of critical technical accounts Compliance with security regulations and privacy laws
- 16. © 2015 CA. ALL RIGHTS RESERVED. DELAYSDELAYS DELAYSIDLE TIME QA/TESTDEV PRODUCTIONPRE-PROD Manual Testing Manual Scripting Developers Deadlocked Too little testing, too late in the cycle Too many disparate tools Poor customer experience TOOLING FOR HIGHLY AUTOMATED, SECURE, END-TO-END SOFTWARE PIPELINE PROVISIONIDE SCM CI TESTCONTAINER CONFIG CLOUD Code | Integrate | Build Functional & UA Testing Performance Testing Deploy to Productiondefectdefectdefect Code | Integrate | Build Functional & UA Testing Performance Testing Deploy to Production Continuous Delivery Parallel Work Streams Quality Acceleration End-to-end Automation RE-WORK RE-WORK RE-WORK Customer Experience CA Service Virtualization CA API Management CA Privileged Access Mgmt CA Release Automation CA API Management CA Privileged Access Mgmt CA Identity Governance CA Advanced Authentication CA Application Test CA Test Case Optimizer CA Test Data Management CA API Management CA Privileged Access Mgmt CA Privileged Access Mgmt CA Identity Governance CA Application Insight CA API Management CA Privileged Access Mgmt CA Identity Governance Constrained Environments Security Secure Dev
- 17. © 2015 CA. ALL RIGHTS RESERVED. QA/TESTDEV PRODUCTIONPRE-PROD Customer Experience Virtualize APIs andVirtualize APIs and manage secure accessmanage secure access Quickly create, edit andQuickly create, edit and deploy virtual servicesdeploy virtual services Parallel Work Streams ELIMINATE DEPENDENCIES AND CONSTRAINTS TO ENABLE PARALLEL WORK STREAMS API Management Release Plan CI/Build Functional testing UATIntegration testing Performance testing Deploy to pre-prod Deploy to production Code commit SCM Accurately simulateAccurately simulate constrained systemsconstrained systems VIRTUAL SERVICE Design Spec Requirements Set up dev environment Set up test environments Set up pre-prod Set up prod
- 18. © 2015 CA. ALL RIGHTS RESERVED. Virtualize APIs andVirtualize APIs and manage securemanage secure accessaccess Quickly create, edit andQuickly create, edit and deploy virtual servicesdeploy virtual services Accurately simulateAccurately simulate constrained systemsconstrained systems APIM APIM APIM APIM CA Secure API Management Automatic switch from virtual to real API API for complex backend orchestration Controlled DB requests as API API security and threat protection API for authentication and authorization API for Identity and Access Management Parallel Work Streams Virtual API API AutH / ZAPI DBAPI IAM
- 19. © 2015 CA. ALL RIGHTS RESERVED. Virtualize APIs andVirtualize APIs and manage securemanage secure accessaccess Quickly create, edit andQuickly create, edit and deploy virtual servicesdeploy virtual services Parallel Work Streams Accurately simulateAccurately simulate constrained systemsconstrained systems APIM APIM
- 20. © 2015 CA. ALL RIGHTS RESERVED. Virtualize APIs andVirtualize APIs and manage securemanage secure accessaccess Quickly create, edit andQuickly create, edit and deploy virtual servicesdeploy virtual services Parallel Work Streams Accurately simulateAccurately simulate constrained systemsconstrained systems APIM APIM APIM
- 21. © 2015 CA. ALL RIGHTS RESERVED. Virtualize APIs andVirtualize APIs and manage securemanage secure accessaccess Quickly create, edit andQuickly create, edit and deploy virtual servicesdeploy virtual services Parallel Work Streams Accurately simulateAccurately simulate constrained systemsconstrained systems APIM APIM APIM APIM
- 22. © 2015 CA. ALL RIGHTS RESERVED. Virtualize APIs andVirtualize APIs and manage securemanage secure accessaccess Quickly create, edit andQuickly create, edit and deploy virtual servicesdeploy virtual services Parallel Work Streams Accurately simulateAccurately simulate constrained systemsconstrained systems APIM APIM CA Privileged Access Management Agents Security and Compliance across environments Technical account segregation o Applicative account can surrogate to root without need root password, in a centralized, transparent and controlled way o Applicative account, even if root for the O.S., works only in his controlled environment, with secure, accountable audit logs o No behavior changes for applications and users A2A authentication with low or no impact on applications o Native integrations or ready to use SDKs
- 23. © 2015 CA. ALL RIGHTS RESERVED. QA/TESTDEV PRODUCTIONPRE-PROD CI/Build Functional testing UATIntegration testing Performance testing Deploy to pre-prod Deploy to production Code commit SCM TEST CASE TEST CASE TEST CASE TEST CASE TEST CASE TEST CASE Test on anyTest on any device or platformdevice or platform mobile-to-mainframemobile-to-mainframe Automatically generateAutomatically generate test cases and secure,test cases and secure, virtual servicesvirtual services Find defects here …instead of here Capture, create, storeCapture, create, store and manage test dataand manage test data to re-use and shareto re-use and share Quality Acceleration SHIFT LEFT Release Plan Design Spec Requirements TEST CASE TEST CASE TEST CASE TEST CASE Test data warehouse VIRTUAL SERVICE AUTOMATE TESTING ACROSS EVERY PHASE OF THE SDLC Customer Experience
- 24. © 2015 CA. ALL RIGHTS RESERVED. release alert & details QA/TESTDEV PRODUCTIONPRE-PROD Create continuousCreate continuous feedback loopsfeedback loops Automate applicationAutomate application deployment & promotiondeployment & promotion PROVISIONREP MGR SCM CI TESTCONTAINER CONFIG CLOUD Code commit SCM CI/Build Functional testing UATIntegration testing Performance testing Deploy to pre-prod Deploy to production Integrate 100+ open sourceIntegrate 100+ open source and 3rd party toolsand 3rd party tools End-to-end Automation APM performance snapshots STREAMLINE AND ACCELERATE THE ENTIRE RELEASE PROCESS, REDUCE MANUAL EFFORT AND ERRORS Customer ExperienceRelease Plan Design Spec Requirements
- 25. © 2015 CA. ALL RIGHTS RESERVED. release alert & details QA/TESTDEV PRODUCTIONPRE-PROD Create continuousCreate continuous feedback loopsfeedback loops Automate applicationAutomate application deployment & promotiondeployment & promotion PROVISIONREP MGR SCM CI TESTCONTAINER CONFIG CLOUD Code commit SCM CI/Build Functional testing UATIntegration testing Performance testing Deploy to pre-prod Deploy to production Integrate 100+ open sourceIntegrate 100+ open source and 3rd party toolsand 3rd party tools End-to-end Automation APM performance snapshots Release Automation integrated with CA SSO for a comprehensive SSO experience Additional automation for: •CA PIM Agent installation - transparent and secure privileged access •Security policies deployment - warning mode, no impacts on apps and users •Identity Management through developers ready APIs •VMWare integration for automatic privileged accounts management Customer ExperienceRelease Plan Design Spec Requirements
- 26. © 2015 CA. ALL RIGHTS RESERVED. Customer Experience Secure Continuous Delivery REDEFINED Application Pipeline Parallel Work Streams Quality Acceleration End-to-end Automation Secure Dev
- 27. © 2015 CA. ALL RIGHTS RESERVED. Real Companies. Real Results. In infrastructure costs and 3rd party service fees Lloyds •Before … Took 5 people days to do 20 tests •AFTER … Takes 1 person one minute to do 20 tests Sources: CA Service implementation scorecard results Large US bank and US airline Save $MMs Reduction in application dev/test cycle Up to 50% More defects detected at least 1-step earlier in SDLC Up to 90% AutoTrader •96% reduction in time required for one cycle of integration testing •25% reduction in software defects •$300,000 savings on environments http://bcove.me/gsornyww ING •Before … 150 deployments per month •AFTER … 30,000 deployments per month going too 50,000 by 2015
- 28. MILAN 20/21.11.2015 Domenico Maracci, Principal Presales Consultant, DevOps - CA Technologies @dmaracci Stefano Sali, Senior Principal Consultant Security - CA Technologies @stefanosali ca.com/it @CA_Italy
- 29. MILAN 20/21.11.2015 - Domenico Maracci, Stefano Sali Leave your feedback on Joind.in! https://m.joind.in/event/codemotion-milan-2015