DevOps
Download as PPTX, PDF0 likes35 views
The document discusses DevSecOps, which combines DevOps and network security. It outlines the stages of a DevSecOps pipeline including continuous integration, delivery, and deployment. It presents a DevSecOps manifesto advocating for open collaboration, security as a service, exploit testing, and compliance as operations. The document also provides examples of integrating security practices at different stages of the software development lifecycle and approaches for legacy versus new applications.
DevOps
- 2. A Well Rounded DevOps Team QA Testing Operatio Develop
- 3. Continuous Integration (CI) ๏Merging the development branches together (master branch) ๏Must successfully pass a series of tests
- 4. Continuous Delivery (CD) ๏Deploying small changes more often ๏Automated delivery of updates
- 5. Deployment Pipeline Stages Build & Automate CI Test Automation Deploy Automation Components Visibility Feedback Continuously Deploy
- 6. DevSecOps Manifesto ๏ Leaning in over Always Saying โNoโ ๏ Data & Security Science over Fear, Uncertainty and Doubt ๏ Open Contribution & Collaboration over Security-Only Requirements ๏ Consumable Security Services with APIs over Mandated Security Controls & Paperwork ๏ Business Driven Security Scores over Rubber Stamp Security ๏ Red & Blue Team Exploit Testing over Relying on Scans & Theoretical Vulnerabilities ๏ 24x7 Proactive Security Monitoring over Reacting after being Informed of an Incident ๏ Shared Threat Intelligence over Keeping Info to Ourselves ๏ Compliance Operations over Clipboards & Checklists
- 7. DevSecOps Integration ๏ 1. Prior to code being committed ๏ SAST that be run locally or integrated into an IDE ๏ 2. During CI ๏ Security checks can be issued via the jobs server ๏ Unit testing, abuse cases, SAST, and software component analysis (supply chain hygiene) ๏ 3. After a successful build ๏ Automatically and securely configure and provision servers ๏ Configuration management, DAST, security smoke tests ๏ 4. Post deployment ๏ Automated runtime asserts and compliance checks ๏ Automated correction ๏ Production monitoring/feedback
- 8. Greenfield vs. Legacy ๏ Greenfield Environment /Applications ๏ Do it right from the start! ๏ Legacy Applications ๏ Start with vulnerability & risk assessment ๏ Apply patches to remediate all vulnerabilities that donโt require major design changes ๏ Integrate automated security testing in future releases when possible ๏ Rebuilding / Sunsetting ๏ Consider breaking out individual components one at a time, where possible, instead of a hard cutover ๏ New system should be following secure architecture principles and integrate security throughout the SDLC