DevSecOps: Security With DevOps
Download as PPTX, PDF1 like415 views
DevSecOps integrates security practices within the DevOps process, promoting a 'security as code' culture and collaboration between release engineers and security teams to ensure rapid, safe code delivery. The approach addresses the growing security threats and the skills gap in cloud security by implementing security measures throughout the development lifecycle, leading to cost reduction and enhanced recovery speed. Benefits include increased product sales due to better security and improved monitoring and management of security auditing systems.
DevSecOps: Security With DevOps
- 1. Presented By: Sudeep James Tirkey DevSecOps: Security with DevOps
- 2. Our Agenda 01 What is DevSecOps 02 Why DevSecOps 03 Benefits of DevSecOps 04 DevSecOps Lifecycle 05 Demo
- 3. ● DevSecOps is the philosophy of integrating security practices within the DevOps process. ● DevSecOps involves creating a ‘Security as Code’ culture with ongoing, flexible collaboration between release engineers and security teams. ● DevSecOps movement, like DevOps itself, is focused on creating new solutions for complex software development processes within an agile framework. ● The goal is to bridge traditional gaps between IT Operations and security while ensuring fast, safe delivery of code. What is DevSecOps
- 4. ● The enterprise IT paradox: Go faster and innovate – but always stay secure. ● Security threats are multiplying exponentially. Too often, until a breach occurs, security is an afterthought in the Software Development Cycle. ● In its “State of Cloud Security” report, the Cloud Security Alliance (CSA) acknowledged a significant skills gap in cloud security. ● DevSecOps can reduce the costs associated with fixing security flaws, by building security into every stage of the development process, from the requirement stage onwards. Why DevSecOps?
- 5. Difference between DevOps and DevSecOps
- 6. ● Cost reduction is achieved by detecting and fixing security issues during the development phases which also increases the speed of delivery. ● Threat hunting can avoid bad publicity, and therefore can potentially increase sales. It is obviously easier to sell a secure product. ● Speed of recovery is enhanced in the case of a security incident by utilising templates and pet/cattle methodology. ● Security auditing, monitoring, and notification systems are managed and deployed so that they can be continuously enhanced, to keep in step with the frantic innovation intrinsic to cybercrime. Benefits of DevSecOps
- 7. ● We develop software with Spark. ● Your data becomes SQL. ● Spark SQL allows you to query structured data from many sources. Examples
- 8. ● Hardcoding credentials into your source code. ● Hardcoding credentials into your Dockerfile. ● Using environment variables as a crutch for passing secrets. ○ Environment variables are available to each process in the container. ○ You also risk leaking passwords via logs and various dashboards. Examples
- 9. ● Think of scenarios such as using a shared message queue between services ○ Who can publish to topics? ○ Who can publish to specific partitions (ie- Kafka) ○ Who else can consume your data? ● Who administers the topics? Who approves access? ● Producer: kafka-console-producer.sh --broker-list localhost:9092 --topic creditcard-stuff This is a credit card # xxxxxxxxxxxxxxx This is a credit card # yyyyyyyyyyyyyyy ● Consumer: kafka-console-consumer.sh --bootstrap-server localhost:9092 --topic creditcard- stuff --from-beginning Examples
- 11. References ● https://cloudsecurityalliance.org/ ● https://www.devsecops.org/ ● https://www.redhat.com/en/topics/devops/what-is-devsecops
- 12. Thank You !