Ad
More Related Content
What's hot (17)
Similar to The Teams Behind DevSecOps (20)
Ad
Recently uploaded (20)
Ad
The Teams Behind DevSecOps
- 2. About us Is a platform that helps you scale application security by fully automating and orchestrating your preferred security tools in CI/CD. Gary Robinson Founder & Chief Security Officer Been a dev, a sec, and an ops.
- 4. ‘DevSecOps’ Personas � Who are ‘The Dev’? � Who are ‘The Ops’? � Who are ‘The Sec’? � Challenges, insights, and observations
- 5. The ‘Dev’
- 6. Generic Developer (Team) Job Identifying code solutions for stakeholder or customer problems. Work with architecture, QA, support, UI/UX, Ops, Security on wider solution implementation. Skills Software development in target languages and frameworks. Deploying solution on cloud / infrastructure. Debugging, fixing bugs. Agile. Compilation. DevOps. Culture Impress / Maturity Getting better skills at the specifics of code / language / frameworks. Learning Design Patterns. Cloud / infrastructure work for running solutions. Faster delivery. Look to lead coders as top. Job Progression Moving up the ranks to senior, lead, becoming an architect (technical) or management. Can get technically specific (security?) , but tends to be sideways move, not upwards.
- 7. Relationships With Operations Operations has moved much more to a realm that devs understand. Cloud, IaC, etc means dev can naturally fit ops in. Many advances created by developers (open source & commercial). With Security Know the basics of the technicality, but processes / logistics typically seen as a blocker. Some companies will push security a lot more than others. Doesn’t work with how dev works. Tooling Experience ‘one tool for one job’. GitHub, Atlassian, and many others have focused on quick time to use and incorporating the ‘whole solution’. Security breaks this mould with lots of tools. Drives / Pressures Getting shit done. Always a large backlog of features / fixes. Plenty of other devs competing for promotions. Focus issues to work on - clarity and prioritization. Security communication.
- 8. Discuss: Dev -> Ops Was Natural Progression ● Developers already knew ops (cloud, OSs, builds) to get solution working. ● Cloud and CI/CD systems built for developers (techies), security tools not. ● Unless developer wants to ‘move into security’ they are not rewarded for learning it. So many other skills they can learn with more job prospects.
- 9. The ‘Ops’
- 10. Generic Operations (Team) Job Setup Cloud and infrastructure, as well as DevOps environments. Experts on Cloud, OS, infrastructure, CI/CD, which means lots of vendor knowledge. Skills Generic network and OS skills, then mostly focused on vendor environments (e.g. AWS expert, CircleCI, etc). Some scripting skills, but not full programmers. Culture Impress / Maturity Badges and skills in vendor products, e.g. AWS routes of learning. Solutions that save time, make tech easier to use, support, maintain. Look to large cool enterprises as the leaders. Job Progression Junior to Senior to Lead. More use they are to the company, more job security. Potentially Release Manager (technical) or Head of DevOps, or into management.
- 11. Relationships With Development Have seen development interact more with technical operations. Growing ops code in codelines with blurred ownership. With Security Know the basics of the technicality, but processes / logistics typically seen as a blocker. Lots of patching (never-ending). Don’t like large security blocks in CI/CD. Tooling Usually vendor / tech driven. Vendor architecture comes first, then ‘getting it working’ with scripts, skills, and knowledge. Would like to create from scratch, but under time pressures. Drives / Pressures Business wants software out faster, ops are the grease that makes that happen for real. Speed, speed, speed.
- 12. Discuss: DevSecOps Requires Coding Glue ● Security tech and processes need to be ‘fitted in’ for seamless interaction, without constant changes ● Serious lack of consistency among security tools. ● Devs and Operations can do it, but don’t have security skills to know what to do
- 13. The ‘Sec’
- 14. Generic Security (Team) Job Tends to be operations security or development security. Tasked with providing technical assurance in various ways. Outnumbered 100 to 1 by dev (ops unknown). Skills Knowledgeable on types of technical hack. Know how to use tools in their area. Able to triage security issues. Likely zero to little programming skills. Culture Impress / Maturity Finding issues, learning hacks, using tools. Talking about latest breaches. Job Progression Junior to Senior to Lead. More move into management quicker due to shortage. Developing skills and serving time conducting pen tests, testing, thread modeling, etc, moves up ranks.
- 15. Relationships With Development Out of loop and tend to add work instead of solutions. Devs want priorities, not scattergun. Though usually one dev team ‘into security’. Issues outside of dev skills (e.g. linters). With Operations Security personnel may have ops knowledge, but not always. Want to be invited to the ‘devops’ party (90% of ‘DevSecOps’ jobs from sec), but may not know how CI/CD works (tech and culture). Tooling Usually scattered, sometimes tied to large vendor products, but also open source / kali / OWASP tools as well. Don’t know dev or ops tools well. Drives / Pressures To find issues, that’s currency. Maybe pressure to scale, given so many projects, but that’s likely managements’ pain. Insights, metrics, & continuous improvements.
- 16. Discuss: Sec & Dev Skills Very Different ● Security folks are not software developers. Unlikely to find security bugs in a pure code review. ● Developers don’t know all the different types of security issues / controls there can be. ● Depending on company / vertical, developers may not be driven on security at all (majority?). High rate of mix across industries with devs and operations moving.
- 17. Discuss: Shift Left breaks Separation of Duties ● Shift-left puts developers in more control of security execution (scale) ● This confuses the separation of duties most regulations demand. ● If fully shifted left security may not have visibility which causes its own problems.
- 18. Discuss: DevSecOps Can’t Scale Today ● Nearly always DevOps in place before security - engine already running ● 100 to 1 doesn’t work, especially since that 1 generally doesn’t have all the necessary skills. Not enough security champions. ● Ironman vs Terminator
- 19. Discuss: Security Tools Needs To Change ● Security tools pride on skills to use, instead of ease of use ● Nature of security is scattered, reflected in tools, which adds confusion and complexity ● Little standardization: prioritization, taxonomy, outputs, inputs (DAST)