SlideShare a Scribd company logo

Integrate Security into DevOps

T
TechWell

The document outlines the integration of security within DevOps practices, emphasizing a collaborative approach among stakeholders throughout the software development lifecycle. It presents the challenges and strategies for ensuring secure software development, including establishing a secure environment, automated processes, and continuous communication. The focus is on cultivating a culture of security awareness, along with managing third-party software vulnerabilities and dependencies effectively.

Software
1 of 82
Downloaded 22 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
DW4 DevOps Design & Architecture 6/7/2017 1:30:00 PM DW4 Integrate Security into DevOps Presented by: Hasan Yasar Software Engineering Institute Brought to you by: 350 Corporate Way, Suite 400, Orange Park, FL 32073 888-­‐268-­‐8770 ·∙ 904-­‐278-­‐0524 - info@techwell.com - https://www.techwell.com/
Hasan Yasar Software Engineering Institute Hasan Yasar is the technical manager of the secure lifecycle solutions group at the Software Engineering Institute (SEI). Hasan leads an engineering group tasked with developing prototype solutions with associated DevOps processes while providing expertise and guidance to SEI's clients. He has more than twenty-five years' experience as senior security engineer, software architect, and manager in all phases of secure software development. Hasan specializes in secure software solutions design and development in the cyber security domain including data- driven investigation and collaborative incident management, network security assessment, and automated large-scale malware analysis. He is an adjunct faculty member at CMU Heinz College and Institute of Software Research.
1 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 Integrate Security into DevOps Hasan Yasar Technical Manager CERT | Secure Lifecycle Solutions Group 2017
2 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Notices Copyright 2017 Carnegie Mellon University. All Rights Reserved. This material is based upon work funded and supported by the Department of Defense under Contract No. FA8702-15-D-0002 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center. NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT. [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution. Please see Copyright notice for non-US Government use and distribution. This material may be reproduced in its entirety, without modification, and freely distributed in written or electronic form without requesting formal permission. Permission is required for any other use. Requests for permission should be directed to the Software Engineering Institute at permission@sei.cmu.edu. Carnegie Mellon® and CERT® are registered in the U.S. Patent and Trademark Office by Carnegie Mellon University. DM17-0273
3 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Agenda - Content • DevOps p3 • DevOps and Security • Platform Security • AppSec - Secure DevOps • DevOps Anti-Patterns
4 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Last Minute Security.. https://dzone.com/articles/last-minute-security-comic
5 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps p3 Integrate Security into DevOps
6 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. People Heavy collaboration between all stakeholders • Secure Design / Architecture decisions • Secure Environment / Network configuration • Secure Deployment planning • Secure Code Review Constantly available open communication channels: • Dev and OpSec together in all project decision meeting • Chat/e-mail/Wiki services available to all team members
7 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Process Establish a process to enable people to succeed using the platform to develop secure application Such that; • Constant communication and visible to all • Ensures that tasks are testable and repeatable • Frees up human experts to do challenging, creative work • Allows tasks to be performed with minimal effort or cost • Creates confidence in task success, after past repetitions • Faster deployment , frequent quality release
8 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Platform Where people use process to build secure software • Automated environment creation and provisioning • Automated infrastructure testing • Parity between Development, QA, Staging, and Production environments • Sharing and versioning of environmental configurations • Collaborative environment between all stakeholders
9 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. • Release configuration and release software (e.g., Puppet, Chef) • Scripts and code used to release software (e.g., Python scripts) • Servers, network or other infrastructure that support release tools • Software and tools to support developer self-service operations • External test frameworks (e.g., Jersey Test Framework) • External operational monitoring and log mining tools (e.g., Splunk) • Source code repositories (e.g., Git) • Issue tracking systems (e.g., JIRA) • Container driven tools (e.g., Docker) • Rqmts mgmt. (Doors, Blueprint) • Infrastructure and cloud providers • IDEs integrated DevOps process DevOps Pipeline Tool Landscape Complexity (~180 tools) Traceability(issuetracking) Infrastructure Version Control Continous Integration Testing and Metrics RapidDeployment Operations Supports
10 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Engineering the Deployment Pipeline is a challenge • If pipeline is not engineered, it may require extensive effort integrate tools and share data across the pipeline • Key questions related to designing the integrated pipeline include: - Who owns the integrated deployment pipeline? - How/what to measure/monitor to assess pipeline health? - What are the key qualities attributes teams should look for as they select tools for pipeline integration? • Whether designing or buying it is important to understand the end-to-end requirements (e.g., workflow visibility)
11 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Integrated Pipeline Key Quality Attributes Discussion Question: Which of these qualities do you think might be important when selecting tools for the continuous delivery pipeline? • Integrate-ability • Interoperability • Usability • Portability • Resilience • Security/Permissions • Availability (Error handling) • Scalability • Performance • Modifiability • Configurability • “Automate-ability” (of manual tasks) • “Approvability” (allows for manual approval) • Measurability? • Other?
12 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Integrated Pipeline - General
13 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Integrated Pipeline – With Tooling
14 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution.
15 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Human actions/inputs to the software development process
16 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Actions performed by autonomous systems
17 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps and Security Secure DevOps Process & Implementation
18 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps and Security
19 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps and Security
20 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Rugged{Secure}Dev{Sec}Ops • DevOps is a Risk Mitigation strategy, built on Situational Awareness, Automation, and Repetition • But security is where a lot of DevOps implementations fall down • Goal: • Protecting private user data • Restricting access to data / systems • Protecting company data / IP • Standards compliance • Safeguarding disposition / transition
21 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. The Rugged Manifesto I am rugged and, more importantly, my code is rugged. I recognize that software has become a foundation of our modern world. I recognize the awesome responsibility that comes with this foundational role. I recognize that my code will be used in ways I cannot anticipate, in ways it was not designed, and for longer than it was ever intended. I recognize that my code will be attacked by talented and persistent adversaries who threaten our physical, economic and national security. I recognize these things – and I choose to be rugged. I am rugged because I refuse to be a source of vulnerability or weakness. I am rugged because I assure my code will support its mission. I am rugged because my code can face these challenges and persist in spite of them. I am rugged, not because it is easy, but because it is necessary and I am up for the challenge.
22 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Rugged Continued … Culture – NOT a tool, SDLC, or org structure Rugged != Secure - secure is only an instant in time Proactive security is better than reactive – Reactive will fail eventually
23 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Team Composition Developers • Features • Quality Attributes • Efficiency • Performance • Users • Authentication • Authorization IT Ops • Deployment • Maintenance • Updates • Change policy • Failure • Data loss • Risk prevention QA • Testable • Issue tracking • Bug Reports • Usability • Help Desk Security Team • Data Privacy • Intrusion detection • Threat vectors • CVEs • Package security • Authentication • Authorization • Security Standards Compliance
24 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps: Multiple Team Integrations
25 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps: Multiple Team Integrations + With Security Team
26 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps: Multiple Team Integrations + With Security Team
27 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Platform Security in DevOps Integrate Security into DevOps
28 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Deployment Pipeline & Dependencies • Deployment Pipeline • Development Environment • Scripting/ Automation • Integration and configuration • Build Servers • Monitoring • Code Repositories • Container Security • Supply Chain/Dependencies • 3rd party libraries • Vulnerability analysis • Trusted sources • Open source software • Code Snippets • Application ready frameworks
29 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Evolution of software development Custom development – context: • Software was limited  Size  Function  Audience • Each organization employed developers • Each organization created their own software Shared development – ISVs (COTS) – context: • Function largely understood  Automating existing processes • Grown beyond ability for using organization to develop economically • Outside of core competitiveness by acquirers Supply chain: practically none Supply chain: software supplier
30 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Development is now assembly General Ledger SQL Server WebSphere HTTP server XML Parser Oracle DB SIP servlet container GIF library Note: hypothetical application composition Collective development – context: • Too large for single organization • Too much specialization • Too little value in individual components Supply chain: long
31 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Software supply chain for assembled software Expanding the scope and complexity of acquisition and deployment Visibility and direct controls are limited (only in shaded area) Source: “Scope of Supplier Expansion and Foreign Involvement” graphic in DACS www.softwaretechnews.com Secure Software Engineering, July 2005 article “Software Development Security: A Risk Management Perspective” synopsis of May 2004 GAO-04-678 report “Defense Acquisition: Knowledge of Software Suppliers Needed to Manage Risks”
32 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Substantial open source and 3rd party apps contained in supply chain • 90% of modern applications are assembled from 3rd party components • At least 75% of organizations rely on open source as the foundation of their applications • Most applications are now assembled from hundreds of open source components, often reflecting as much as 90% of an application Distributed development – context: • Amortize expense • Outsource non-differential features • Lower acquisition (CapEx) expense Sources: Geer and Corman, “Almost Too Big To Fail,” ;login: (Usenix), Aug 2014; Sonatype, 2014 open source development and application security survey Supply chain: opaque
33 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Reducing the Supply Chain Risk • Open source software usage policy • Supplier resource management • Apply policy and management through DevOps pipeline • Automate and monitor dependencies management • Track build and deploy decencies list • Apply discovered(new) vulnerabilities and deployment process • Continues training and monitoring developers activities
34 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Supply Chain Hygiene: Recommendations • Supplier security commitment evidence • Supplier employees are educated as to security engineering practices • Supplier follows suitable security design practices • Evaluate a product’s threat resistance • What product characteristics minimize opportunities to enter and change the product’s security characteristics? • Create a centralized private repositories of vetted 3rd party components for all developers • Establish good product distribution practices • Recognize that supply chain risks are accumulated • Monitor for new vulnerabilities and know where they are in the enterprise to fix • Minimize variation of components to make things easier (multiple versions, duplicated utility)
35 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. AppSec and DevOps Integrate Security into DevOps
36 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution.
37 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Microsoft Secure Development Lifecycle (SDL)
38 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Development Lifecycle
39 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Dev Lifecycle + Business Enhancing the SDLC
40 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Lifecycle Enhancing the SDLC
41 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Where are opportunities for security processes?
42 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Lifecycle Threat Modeling, Security as a quality attribute Enhancing SDLC Security
43 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Lifecycle Secure / hardened environments Enhancing SDLC Security
44 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Lifecycle Security-focused code review Enhancing SDLC Security
45 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Lifecycle Automated Security Testing (Static analysis, etc) Enhancing SDLC Security
46 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Lifecycle More Security Testing (Pen Testing, Fuzz Testing) Enhancing SDLC Security
47 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Lifecycle Security review / acceptance testing Enhancing SDLC Security
48 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Enhancing SDLC Security Secure DevOps Lifecycle
49 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Security must be addressed without breaking the rapid delivery, continuous feedback model
50 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Secure DevOps Lifecycle Devs Enhancing SDLC Security
51 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Secure DevOps Lifecycle Devs Enhancing SDLC Security
52 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Secure DevOps Lifecycle Devs Enhancing SDLC Security
53 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Secure DevOps Lifecycle Devs Enhancing SDLC Security
54 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Secure DevOps Lifecycle Devs Enhancing SDLC Security
55 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Secure DevOps Lifecycle Devs Enhancing SDLC Security
56 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Secure DevOps Lifecycle Devs Constant Feedback to Dev Enhancing SDLC Security
57 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Secure DevOps Lifecycle Enhancing SDLC Security
58 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Secure DevOps Lifecycle • Pausing for manual steps is typical • Optimize the manual work! • Persist the output of any tools / work Enhancing SDLC Security
59 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Post-Production Monitoring • Monitor audit logs produced by CI/CD for anomalies • Monitor production applications to assure nothing changes outside of the normal change process • Monitor for new vulnerabilities / threats (a catalog of running components helps!)
60 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Automation (CI/CD) and Security Not everything can be, needs to be, or should be, automated • Draw perimeters around things you trust and let that guide where human interaction and verification is needed Keep track of security assessments Regimented code management • Know what source code contributed to a build that’s in production so patches are fast and confident Perform static analysis where possible
61 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Security Overview Development, operations, teams engineer infrastructure and application Operations maintains continuous delivery process Developers write and push code Continuous integration server internally deploys code • Docker run / VM provision • Build • Test QA team evaluates the application for correctness Continuous delivery process deploys code to production servers Operations maintains production servers
62 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Security Overview with Security Highlights Development, operations, and security teams engineer infrastructure and application Operations maintains continuous delivery process Developers write and push code Continuous integration server internally deploys code • Docker run / VM provision • Build • Test QA team evaluates the application for correctness Continuous delivery process deploys code to production servers Operations maintains production servers
63 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Security Overview with Security Highlights Development, operations, and security teams engineer infrastructure and application Operations maintains continuous delivery process Developers write and push code Code push triggers security analysis via security controller Continuous integration server internally deploys code • Docker run / VM provision • Build • Test QA team evaluates the application for correctness Continuous delivery process deploys code to production servers Operations maintains production servers
64 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Security Overview with Security Highlights Development, operations, and security teams engineer infrastructure and application Operations maintains continuous delivery process Developers write and push code Code push triggers security analysis via security controller Continuous integration server internally deploys code • Docker run / VM provision • Build • Test • Automated security scan QA team evaluates the application for correctness Continuous delivery process deploys code to production servers Operations maintains production servers
65 Secure DevOps Process & Implementation © 2017 Carnegie Mellon University [Distribution Statement A] This material has been approved for public release and unlimited distribution. Please see Copyright notice for non-US Government use and distribution. Secure DevOps Anti-Patterns Integrate Security into DevOps
66 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Security Anti-Pattern: TheException-1 You automate… …builds …functional tests …deployment …reporting …the coffee machine
67 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Security Anti-Pattern: TheException-2 But security testing is still manual pen testing, done only on release. Recommendations: • Don’t leave security automation out of your DevOps automation strategy - Automated security testing removes human error, infrequent, execution, and excuses • Don’t try to avoid open source with policies, it is coming whether you like it or not! • InfoSec must maintain awareness of open source vulnerabilities and continuously check for them
68 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Security Anti-Pattern: TheException-3 OWASP ZAP https://www.owasp.org/index.php/OWAS P_Zed_Attack_Proxy_Project http://gauntlt.org/ GAUNTLT BE MEAN TO YOUR CODE AND LIKE IT There are great projects out there…
69 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Security Anti-Pattern: Multiverse When environments are not the same, your app may never behave predictably. Environment parity (between dev, test, prod) is critical for controlling opportunity for security gaps
70 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Security Anti-Pattern: Multiverse Recommendations: • Automate manual steps to the extent possible • Make development environment parity a priority • Get Ops involved in creating all environments, including Dev • Focus on providing fast easy-to-use automation tools for developers everyone to keep environments in synch
71 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Security Anti-Pattern: Configurator • Uncontrolled configuration changes will lead to an unmanageable, unpredictable, and unrepeatable solution • Easy for info security to get out of synch; For example, change in DNS and you have security hole. Recommendations: • Avoid the manual quick fix particularly for configuration changes • Put configuration files under configuration controls
72 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Security Anti-Pattern: Infiltrator He sneaks in… …and alters production …but he works for you! Recommendations: • Set up roles and revoke administrative access to manually edit production • Configure prod environment to alert the entire team when manually accessed. Transparency is key.
73 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Security Anti-Pattern: Survivor We have all been there… Intrusions overnight… …cascading system failures… …it’s all crashing… …help…me..…
74 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Security Anti-Pattern: Survivor-2 But you survive… Glad its over. Going to go sleep for 18 hours…and then back to the normal cycle. When do we analyze what went wrong? How do we prevent similar failures in the future? All failures must result in codified change to DevOps process Recommendations: • Understand exactly what went wrong • Never let the same failure happen twice • Propagate fixes across the enterprise • Ensure that you teach the next generation
75 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Security Anti-Pattern: College Party 99% of Global 2000 companies will be using open source code in mission-critical apps by 2016 Do you know what’s in your app? Code we wrote Code someone else wrote
76 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Security Anti-Pattern: College Party-2 Recommendations: • Infosec must enable constant (read: automated) checking for open source vulnerabilities Ways to fail: • Place infosec outside of the dev workflow • When UI/UX, infosec and accessibility requirements conflict and never get resolved • Dictate policy to not use open source • Document-driven checking is not going catch Prepare for what is coming….
77 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Security Anti-Pattern: Skydiver Once you jump, you can’t return to the plane. You are committed. Permanently. This is not how we should model our deployments Recommendations: • Rollback is essential; Never be left without an escape route to completely working software • Strive for approaches that support “one button” rollback (e.g, feature flags or A/B)
78 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. SLS team GitHub Projects • Once Click DevOps deployment https://github.com/SLS-ALL/devops-voltron • Sample app with DevOps Process https://github.com/SLS-ALL/flask_api_sample • Tagged checkpoints • v0.1.0: base Flask project • v0.2.0: Vagrant development configuration • v0.3.0: Test environment and Fabric deployment • v0.4.0: Upstart services, external configuration files • v0.5.0: Production environment • On YouTube: https://www.youtube.com/watch?v=5nQlJ-FWA5A
79 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. For more information… SEI DevOps Blog https://insights.sei.cmu.edu/devops
80 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Contact Information Hasan Yasar Technical Manager, Secure Lifecycle Solutions hyasar@sei.cmu.edu @securelifecycle Web Resources (CERT/SEI) http://www.cert.org/ http://www.sei.cmu.edu/

More Related Content

PPTX
How to get the best out of DevSecOps - a security perspective
Colin Domoney
 
PDF
The New Security Playbook: DevSecOps
James Wickett
 
PDF
Scale DevSecOps with your Continuous Integration Pipeline
DevOps.com
 
PDF
DevOps or DevSecOps
Michelangelo van Dam
 
PDF
Webinar – Risk-based adaptive DevSecOps
Synopsys Software Integrity Group
 
PDF
Dos and Don'ts of DevSecOps
Priyanka Aash
 
PPTX
Secure DevOPS Implementation Guidance
Tej Luthra
 
PDF
DevOps & DevSecOps in Swiss Banking
Aarno Aukia
 
How to get the best out of DevSecOps - a security perspective
Colin Domoney
 
The New Security Playbook: DevSecOps
James Wickett
 
Scale DevSecOps with your Continuous Integration Pipeline
DevOps.com
 
DevOps or DevSecOps
Michelangelo van Dam
 
Webinar – Risk-based adaptive DevSecOps
Synopsys Software Integrity Group
 
Dos and Don'ts of DevSecOps
Priyanka Aash
 
Secure DevOPS Implementation Guidance
Tej Luthra
 
DevOps & DevSecOps in Swiss Banking
Aarno Aukia
 

What's hot (20)

PDF
Zero to Ninety in Securing DevOps
DevSecOps Days
 
PDF
The DevSecOps Builder’s Guide to the CI/CD Pipeline
James Wickett
 
PPTX
Benefits of DevSecOps
Finto Thomas , CISSP, TOGAF, CCSP, ITIL. JNCIS
 
PDF
The Emergent Cloud Security Toolchain for CI/CD
James Wickett
 
PDF
Introduction to DevSecOps
Setu Parimi
 
PPTX
ABN AMRO DevSecOps Journey
Derek E. Weeks
 
PPTX
DevSecOps reference architectures 2018
Sonatype
 
PPTX
DevSecOps without DevOps is Just Security
Kevin Fealey
 
PDF
DevSecOps at the GSA
Chris Downey
 
PPT
DevSecOps Singapore introduction
Stefan Streichsbier
 
PDF
DevSecOps: essential tooling to enable continuous security 2019-09-16
Rich Mills
 
PDF
DevSecOps and the CI/CD Pipeline
James Wickett
 
PPTX
Overcoming the old ways of working with DevSecOps - Culture, Data, Graph, and...
Erkang Zheng
 
DOCX
10 things to get right for successful dev secops
Mohammed Ahmed
 
PDF
Shift Risk Left: Security Considerations When Migrating Apps to the Cloud
Black Duck by Synopsys
 
PDF
Bridging the Security Testing Gap in Your CI/CD Pipeline
DevOps.com
 
PPTX
DevSecops: Defined, tools, characteristics, tools, frameworks, benefits and c...
Mohamed Nizzad
 
PDF
Real Cost of Software Remediation
Denim Group
 
PDF
Top 10 Practices of Highly Successful DevOps Incident Management Teams
Deborah Schalm
 
PDF
Microsoft DevOps Forum 2021 – DevOps & Security
Nico Meisenzahl
 
Zero to Ninety in Securing DevOps
DevSecOps Days
 
The DevSecOps Builder’s Guide to the CI/CD Pipeline
James Wickett
 
Benefits of DevSecOps
Finto Thomas , CISSP, TOGAF, CCSP, ITIL. JNCIS
 
The Emergent Cloud Security Toolchain for CI/CD
James Wickett
 
Introduction to DevSecOps
Setu Parimi
 
ABN AMRO DevSecOps Journey
Derek E. Weeks
 
DevSecOps reference architectures 2018
Sonatype
 
DevSecOps without DevOps is Just Security
Kevin Fealey
 
DevSecOps at the GSA
Chris Downey
 
DevSecOps Singapore introduction
Stefan Streichsbier
 
DevSecOps: essential tooling to enable continuous security 2019-09-16
Rich Mills
 
DevSecOps and the CI/CD Pipeline
James Wickett
 
Overcoming the old ways of working with DevSecOps - Culture, Data, Graph, and...
Erkang Zheng
 
10 things to get right for successful dev secops
Mohammed Ahmed
 
Shift Risk Left: Security Considerations When Migrating Apps to the Cloud
Black Duck by Synopsys
 
Bridging the Security Testing Gap in Your CI/CD Pipeline
DevOps.com
 
DevSecops: Defined, tools, characteristics, tools, frameworks, benefits and c...
Mohamed Nizzad
 
Real Cost of Software Remediation
Denim Group
 
Top 10 Practices of Highly Successful DevOps Incident Management Teams
Deborah Schalm
 
Microsoft DevOps Forum 2021 – DevOps & Security
Nico Meisenzahl
 
Ad

Similar to Integrate Security into DevOps (20)

PPTX
Applying DevOps Principles to Address Dynamic Changes in Cyber Security
SeniorStoryteller
 
PDF
Integrating DevOps and Security
Stijn Muylle
 
PDF
DevSecOps: The Open Source Way
Black Duck by Synopsys
 
PPTX
BsidesMCR_2016-what-can-infosec-learn-from-devops
James '​-- Mckinlay
 
PDF
DevSecOps: The Open Source Way
Gordon Haff
 
PDF
4 approaches to integrate dev secops in development cycle
Enov8
 
PDF
Building Security Into Your Cloud IT Practices
Mighty Guides, Inc.
 
PPTX
Achieving Secure DevOps: Overcoming the Risks of Modern Service Delivery
Perforce
 
PPTX
How to Get Started with DevSecOps
CYBRIC
 
PDF
Pragmatic Pipeline Security
James Wickett
 
PDF
You Build It, You Secure It: Higher Velocity and Better Security with DevSecOps
DevOps.com
 
PPTX
Engineering DevOps and Cloud
Marc Hornbeek
 
PPTX
DevOps to DevSecOps: Enhancing Software Security Throughout The Development L...
Anowar Hossain
 
PDF
Security's DevOps Transformation
Michele Chubirka
 
PPTX
The Journey to DevSecOps
SeniorStoryteller
 
PPTX
The Journey to DevSecOps
Shannon Lietz
 
PDF
The What, Why, and How of DevSecOps
Cprime
 
PDF
5 principles-securing-devops-veracode-whitepaper
wardell henley
 
PDF
From DevOps to DevSecOps: Evolution of Secure Software Development
ScalaCode
 
PPTX
OWASP Bay Area Meetup - DevSecOps the Kubernetes Way
Jimmy Mesta
 
Applying DevOps Principles to Address Dynamic Changes in Cyber Security
SeniorStoryteller
 
Integrating DevOps and Security
Stijn Muylle
 
DevSecOps: The Open Source Way
Black Duck by Synopsys
 
BsidesMCR_2016-what-can-infosec-learn-from-devops
James '​-- Mckinlay
 
DevSecOps: The Open Source Way
Gordon Haff
 
4 approaches to integrate dev secops in development cycle
Enov8
 
Building Security Into Your Cloud IT Practices
Mighty Guides, Inc.
 
Achieving Secure DevOps: Overcoming the Risks of Modern Service Delivery
Perforce
 
How to Get Started with DevSecOps
CYBRIC
 
Pragmatic Pipeline Security
James Wickett
 
You Build It, You Secure It: Higher Velocity and Better Security with DevSecOps
DevOps.com
 
Engineering DevOps and Cloud
Marc Hornbeek
 
DevOps to DevSecOps: Enhancing Software Security Throughout The Development L...
Anowar Hossain
 
Security's DevOps Transformation
Michele Chubirka
 
The Journey to DevSecOps
SeniorStoryteller
 
The Journey to DevSecOps
Shannon Lietz
 
The What, Why, and How of DevSecOps
Cprime
 
5 principles-securing-devops-veracode-whitepaper
wardell henley
 
From DevOps to DevSecOps: Evolution of Secure Software Development
ScalaCode
 
OWASP Bay Area Meetup - DevSecOps the Kubernetes Way
Jimmy Mesta
 
Ad

More from TechWell (20)

PDF
Failing and Recovering
TechWell
 
PDF
Instill a DevOps Testing Culture in Your Team and Organization
TechWell
 
PDF
Test Design for Fully Automated Build Architecture
TechWell
 
PDF
System-Level Test Automation: Ensuring a Good Start
TechWell
 
PDF
Build Your Mobile App Quality and Test Strategy
TechWell
 
PDF
Testing Transformation: The Art and Science for Success
TechWell
 
PDF
Implement BDD with Cucumber and SpecFlow
TechWell
 
PDF
Develop WebDriver Automated Tests—and Keep Your Sanity
TechWell
 
PDF
Ma 15
TechWell
 
PDF
Eliminate Cloud Waste with a Holistic DevOps Strategy
TechWell
 
PDF
Transform Test Organizations for the New World of DevOps
TechWell
 
PDF
The Fourth Constraint in Project Delivery—Leadership
TechWell
 
PDF
Resolve the Contradiction of Specialists within Agile Teams
TechWell
 
PDF
Pin the Tail on the Metric: A Field-Tested Agile Game
TechWell
 
PDF
Agile Performance Holarchy (APH)—A Model for Scaling Agile Teams
TechWell
 
PDF
A Business-First Approach to DevOps Implementation
TechWell
 
PDF
Databases in a Continuous Integration/Delivery Process
TechWell
 
PDF
Mobile Testing: What—and What Not—to Automate
TechWell
 
PDF
Cultural Intelligence: A Key Skill for Success
TechWell
 
PDF
Turn the Lights On: A Power Utility Company's Agile Transformation
TechWell
 
Failing and Recovering
TechWell
 
Instill a DevOps Testing Culture in Your Team and Organization
TechWell
 
Test Design for Fully Automated Build Architecture
TechWell
 
System-Level Test Automation: Ensuring a Good Start
TechWell
 
Build Your Mobile App Quality and Test Strategy
TechWell
 
Testing Transformation: The Art and Science for Success
TechWell
 
Implement BDD with Cucumber and SpecFlow
TechWell
 
Develop WebDriver Automated Tests—and Keep Your Sanity
TechWell
 
Ma 15
TechWell
 
Eliminate Cloud Waste with a Holistic DevOps Strategy
TechWell
 
Transform Test Organizations for the New World of DevOps
TechWell
 
The Fourth Constraint in Project Delivery—Leadership
TechWell
 
Resolve the Contradiction of Specialists within Agile Teams
TechWell
 
Pin the Tail on the Metric: A Field-Tested Agile Game
TechWell
 
Agile Performance Holarchy (APH)—A Model for Scaling Agile Teams
TechWell
 
A Business-First Approach to DevOps Implementation
TechWell
 
Databases in a Continuous Integration/Delivery Process
TechWell
 
Mobile Testing: What—and What Not—to Automate
TechWell
 
Cultural Intelligence: A Key Skill for Success
TechWell
 
Turn the Lights On: A Power Utility Company's Agile Transformation
TechWell
 

Recently uploaded (20)

PDF
Navsoft: AI-Powered Business Solutions & Custom Software Development
Navsoft
 
PPTX
Reimagine Home Health with the Power of Agentic AI​
AutomationEdge Technologies
 
PPTX
Agentic AI Use Case- Contract Lifecycle Management (CLM).pptx
mhxyzzp
 
PDF
Softaken Excel to vCard Converter Software.pdf
markwillsonmw004
 
PDF
System and Network Administraation Chapter 3
jaramharo
 
PDF
medical staffing services at VALiNTRY
Tiyan Grayson
 
PDF
T3DD25 TYPO3 Content Blocks - Deep Dive by André Kraus
Andre Kraus
 
PDF
Designing Intelligence for the Shop Floor.pdf
nikglvk
 
PPTX
Lecture 3: Operating Systems Introduction to Computer Hardware Systems
hci7se
 
PPTX
Introduction to Artificial Intelligence
lohedi9363
 
PPTX
Computer Software and OS of computer science of grade 11.pptx
GauravDahal9
 
PDF
wealthsignaloriginal-com-DS-text-... (1).pdf
skmiani786
 
PDF
How to Migrate SBCGlobal Email to Yahoo Easily
raymondjones7273
 
PDF
Internet Downloader Manager (IDM) Crack 6.42 Build 41
ghrom2211g
 
PDF
Internet Downloader Manager (IDM) Crack 6.42 Build 42 Updates Latest 2025
itskinga12
 
PPTX
ai tools demonstartion for schools and inter college
harshavardhanreddyka11
 
PPTX
Embracing Complexity in Serverless! GOTO Serverless Bengaluru
SheenBrisals
 
PDF
Why TechBuilder is the Future of Pickup and Delivery App Development (1).pdf
TechBuilder
 
PDF
Design an Analysis of Algorithms II-SECS-1021-03
DilanEscobar1
 
PDF
Adobe Illustrator 28.6 Crack My Vision of Vector Design
ghrom2211g
 
Navsoft: AI-Powered Business Solutions & Custom Software Development
Navsoft
 
Reimagine Home Health with the Power of Agentic AI​
AutomationEdge Technologies
 
Agentic AI Use Case- Contract Lifecycle Management (CLM).pptx
mhxyzzp
 
Softaken Excel to vCard Converter Software.pdf
markwillsonmw004
 
System and Network Administraation Chapter 3
jaramharo
 
medical staffing services at VALiNTRY
Tiyan Grayson
 
T3DD25 TYPO3 Content Blocks - Deep Dive by André Kraus
Andre Kraus
 
Designing Intelligence for the Shop Floor.pdf
nikglvk
 
Lecture 3: Operating Systems Introduction to Computer Hardware Systems
hci7se
 
Introduction to Artificial Intelligence
lohedi9363
 
Computer Software and OS of computer science of grade 11.pptx
GauravDahal9
 
wealthsignaloriginal-com-DS-text-... (1).pdf
skmiani786
 
How to Migrate SBCGlobal Email to Yahoo Easily
raymondjones7273
 
Internet Downloader Manager (IDM) Crack 6.42 Build 41
ghrom2211g
 
Internet Downloader Manager (IDM) Crack 6.42 Build 42 Updates Latest 2025
itskinga12
 
ai tools demonstartion for schools and inter college
harshavardhanreddyka11
 
Embracing Complexity in Serverless! GOTO Serverless Bengaluru
SheenBrisals
 
Why TechBuilder is the Future of Pickup and Delivery App Development (1).pdf
TechBuilder
 
Design an Analysis of Algorithms II-SECS-1021-03
DilanEscobar1
 
Adobe Illustrator 28.6 Crack My Vision of Vector Design
ghrom2211g
 

Integrate Security into DevOps

  • 1. DW4 DevOps Design & Architecture 6/7/2017 1:30:00 PM DW4 Integrate Security into DevOps Presented by: Hasan Yasar Software Engineering Institute Brought to you by: 350 Corporate Way, Suite 400, Orange Park, FL 32073 888-­‐268-­‐8770 ·∙ 904-­‐278-­‐0524 - info@techwell.com - https://www.techwell.com/
  • 2. Hasan Yasar Software Engineering Institute Hasan Yasar is the technical manager of the secure lifecycle solutions group at the Software Engineering Institute (SEI). Hasan leads an engineering group tasked with developing prototype solutions with associated DevOps processes while providing expertise and guidance to SEI's clients. He has more than twenty-five years' experience as senior security engineer, software architect, and manager in all phases of secure software development. Hasan specializes in secure software solutions design and development in the cyber security domain including data- driven investigation and collaborative incident management, network security assessment, and automated large-scale malware analysis. He is an adjunct faculty member at CMU Heinz College and Institute of Software Research.
  • 3. 1 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 Integrate Security into DevOps Hasan Yasar Technical Manager CERT | Secure Lifecycle Solutions Group 2017
  • 4. 2 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Notices Copyright 2017 Carnegie Mellon University. All Rights Reserved. This material is based upon work funded and supported by the Department of Defense under Contract No. FA8702-15-D-0002 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center. NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT. [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution. Please see Copyright notice for non-US Government use and distribution. This material may be reproduced in its entirety, without modification, and freely distributed in written or electronic form without requesting formal permission. Permission is required for any other use. Requests for permission should be directed to the Software Engineering Institute at permission@sei.cmu.edu. Carnegie Mellon® and CERT® are registered in the U.S. Patent and Trademark Office by Carnegie Mellon University. DM17-0273
  • 5. 3 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Agenda - Content • DevOps p3 • DevOps and Security • Platform Security • AppSec - Secure DevOps • DevOps Anti-Patterns
  • 6. 4 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Last Minute Security.. https://dzone.com/articles/last-minute-security-comic
  • 7. 5 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps p3 Integrate Security into DevOps
  • 8. 6 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. People Heavy collaboration between all stakeholders • Secure Design / Architecture decisions • Secure Environment / Network configuration • Secure Deployment planning • Secure Code Review Constantly available open communication channels: • Dev and OpSec together in all project decision meeting • Chat/e-mail/Wiki services available to all team members
  • 9. 7 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Process Establish a process to enable people to succeed using the platform to develop secure application Such that; • Constant communication and visible to all • Ensures that tasks are testable and repeatable • Frees up human experts to do challenging, creative work • Allows tasks to be performed with minimal effort or cost • Creates confidence in task success, after past repetitions • Faster deployment , frequent quality release
  • 10. 8 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Platform Where people use process to build secure software • Automated environment creation and provisioning • Automated infrastructure testing • Parity between Development, QA, Staging, and Production environments • Sharing and versioning of environmental configurations • Collaborative environment between all stakeholders
  • 11. 9 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. • Release configuration and release software (e.g., Puppet, Chef) • Scripts and code used to release software (e.g., Python scripts) • Servers, network or other infrastructure that support release tools • Software and tools to support developer self-service operations • External test frameworks (e.g., Jersey Test Framework) • External operational monitoring and log mining tools (e.g., Splunk) • Source code repositories (e.g., Git) • Issue tracking systems (e.g., JIRA) • Container driven tools (e.g., Docker) • Rqmts mgmt. (Doors, Blueprint) • Infrastructure and cloud providers • IDEs integrated DevOps process DevOps Pipeline Tool Landscape Complexity (~180 tools) Traceability(issuetracking) Infrastructure Version Control Continous Integration Testing and Metrics RapidDeployment Operations Supports
  • 12. 10 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Engineering the Deployment Pipeline is a challenge • If pipeline is not engineered, it may require extensive effort integrate tools and share data across the pipeline • Key questions related to designing the integrated pipeline include: - Who owns the integrated deployment pipeline? - How/what to measure/monitor to assess pipeline health? - What are the key qualities attributes teams should look for as they select tools for pipeline integration? • Whether designing or buying it is important to understand the end-to-end requirements (e.g., workflow visibility)
  • 13. 11 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Integrated Pipeline Key Quality Attributes Discussion Question: Which of these qualities do you think might be important when selecting tools for the continuous delivery pipeline? • Integrate-ability • Interoperability • Usability • Portability • Resilience • Security/Permissions • Availability (Error handling) • Scalability • Performance • Modifiability • Configurability • “Automate-ability” (of manual tasks) • “Approvability” (allows for manual approval) • Measurability? • Other?
  • 14. 12 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Integrated Pipeline - General
  • 15. 13 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Integrated Pipeline – With Tooling
  • 16. 14 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution.
  • 17. 15 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Human actions/inputs to the software development process
  • 18. 16 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Actions performed by autonomous systems
  • 19. 17 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps and Security Secure DevOps Process & Implementation
  • 20. 18 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps and Security
  • 21. 19 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps and Security
  • 22. 20 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Rugged{Secure}Dev{Sec}Ops • DevOps is a Risk Mitigation strategy, built on Situational Awareness, Automation, and Repetition • But security is where a lot of DevOps implementations fall down • Goal: • Protecting private user data • Restricting access to data / systems • Protecting company data / IP • Standards compliance • Safeguarding disposition / transition
  • 23. 21 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. The Rugged Manifesto I am rugged and, more importantly, my code is rugged. I recognize that software has become a foundation of our modern world. I recognize the awesome responsibility that comes with this foundational role. I recognize that my code will be used in ways I cannot anticipate, in ways it was not designed, and for longer than it was ever intended. I recognize that my code will be attacked by talented and persistent adversaries who threaten our physical, economic and national security. I recognize these things – and I choose to be rugged. I am rugged because I refuse to be a source of vulnerability or weakness. I am rugged because I assure my code will support its mission. I am rugged because my code can face these challenges and persist in spite of them. I am rugged, not because it is easy, but because it is necessary and I am up for the challenge.
  • 24. 22 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Rugged Continued … Culture – NOT a tool, SDLC, or org structure Rugged != Secure - secure is only an instant in time Proactive security is better than reactive – Reactive will fail eventually
  • 25. 23 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Team Composition Developers • Features • Quality Attributes • Efficiency • Performance • Users • Authentication • Authorization IT Ops • Deployment • Maintenance • Updates • Change policy • Failure • Data loss • Risk prevention QA • Testable • Issue tracking • Bug Reports • Usability • Help Desk Security Team • Data Privacy • Intrusion detection • Threat vectors • CVEs • Package security • Authentication • Authorization • Security Standards Compliance
  • 26. 24 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps: Multiple Team Integrations
  • 27. 25 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps: Multiple Team Integrations + With Security Team
  • 28. 26 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps: Multiple Team Integrations + With Security Team
  • 29. 27 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Platform Security in DevOps Integrate Security into DevOps
  • 30. 28 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Deployment Pipeline & Dependencies • Deployment Pipeline • Development Environment • Scripting/ Automation • Integration and configuration • Build Servers • Monitoring • Code Repositories • Container Security • Supply Chain/Dependencies • 3rd party libraries • Vulnerability analysis • Trusted sources • Open source software • Code Snippets • Application ready frameworks
  • 31. 29 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Evolution of software development Custom development – context: • Software was limited  Size  Function  Audience • Each organization employed developers • Each organization created their own software Shared development – ISVs (COTS) – context: • Function largely understood  Automating existing processes • Grown beyond ability for using organization to develop economically • Outside of core competitiveness by acquirers Supply chain: practically none Supply chain: software supplier
  • 32. 30 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Development is now assembly General Ledger SQL Server WebSphere HTTP server XML Parser Oracle DB SIP servlet container GIF library Note: hypothetical application composition Collective development – context: • Too large for single organization • Too much specialization • Too little value in individual components Supply chain: long
  • 33. 31 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Software supply chain for assembled software Expanding the scope and complexity of acquisition and deployment Visibility and direct controls are limited (only in shaded area) Source: “Scope of Supplier Expansion and Foreign Involvement” graphic in DACS www.softwaretechnews.com Secure Software Engineering, July 2005 article “Software Development Security: A Risk Management Perspective” synopsis of May 2004 GAO-04-678 report “Defense Acquisition: Knowledge of Software Suppliers Needed to Manage Risks”
  • 34. 32 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Substantial open source and 3rd party apps contained in supply chain • 90% of modern applications are assembled from 3rd party components • At least 75% of organizations rely on open source as the foundation of their applications • Most applications are now assembled from hundreds of open source components, often reflecting as much as 90% of an application Distributed development – context: • Amortize expense • Outsource non-differential features • Lower acquisition (CapEx) expense Sources: Geer and Corman, “Almost Too Big To Fail,” ;login: (Usenix), Aug 2014; Sonatype, 2014 open source development and application security survey Supply chain: opaque
  • 35. 33 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Reducing the Supply Chain Risk • Open source software usage policy • Supplier resource management • Apply policy and management through DevOps pipeline • Automate and monitor dependencies management • Track build and deploy decencies list • Apply discovered(new) vulnerabilities and deployment process • Continues training and monitoring developers activities
  • 36. 34 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Supply Chain Hygiene: Recommendations • Supplier security commitment evidence • Supplier employees are educated as to security engineering practices • Supplier follows suitable security design practices • Evaluate a product’s threat resistance • What product characteristics minimize opportunities to enter and change the product’s security characteristics? • Create a centralized private repositories of vetted 3rd party components for all developers • Establish good product distribution practices • Recognize that supply chain risks are accumulated • Monitor for new vulnerabilities and know where they are in the enterprise to fix • Minimize variation of components to make things easier (multiple versions, duplicated utility)
  • 37. 35 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. AppSec and DevOps Integrate Security into DevOps
  • 38. 36 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution.
  • 39. 37 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Microsoft Secure Development Lifecycle (SDL)
  • 40. 38 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Development Lifecycle
  • 41. 39 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Dev Lifecycle + Business Enhancing the SDLC
  • 42. 40 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Lifecycle Enhancing the SDLC
  • 43. 41 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Where are opportunities for security processes?
  • 44. 42 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Lifecycle Threat Modeling, Security as a quality attribute Enhancing SDLC Security
  • 45. 43 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Lifecycle Secure / hardened environments Enhancing SDLC Security
  • 46. 44 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Lifecycle Security-focused code review Enhancing SDLC Security
  • 47. 45 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Lifecycle Automated Security Testing (Static analysis, etc) Enhancing SDLC Security
  • 48. 46 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Lifecycle More Security Testing (Pen Testing, Fuzz Testing) Enhancing SDLC Security
  • 49. 47 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Lifecycle Security review / acceptance testing Enhancing SDLC Security
  • 50. 48 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Enhancing SDLC Security Secure DevOps Lifecycle
  • 51. 49 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Security must be addressed without breaking the rapid delivery, continuous feedback model
  • 52. 50 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Secure DevOps Lifecycle Devs Enhancing SDLC Security
  • 53. 51 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Secure DevOps Lifecycle Devs Enhancing SDLC Security
  • 54. 52 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Secure DevOps Lifecycle Devs Enhancing SDLC Security
  • 55. 53 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Secure DevOps Lifecycle Devs Enhancing SDLC Security
  • 56. 54 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Secure DevOps Lifecycle Devs Enhancing SDLC Security
  • 57. 55 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Secure DevOps Lifecycle Devs Enhancing SDLC Security
  • 58. 56 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Secure DevOps Lifecycle Devs Constant Feedback to Dev Enhancing SDLC Security
  • 59. 57 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Secure DevOps Lifecycle Enhancing SDLC Security
  • 60. 58 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Secure DevOps Lifecycle • Pausing for manual steps is typical • Optimize the manual work! • Persist the output of any tools / work Enhancing SDLC Security
  • 61. 59 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Post-Production Monitoring • Monitor audit logs produced by CI/CD for anomalies • Monitor production applications to assure nothing changes outside of the normal change process • Monitor for new vulnerabilities / threats (a catalog of running components helps!)
  • 62. 60 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Automation (CI/CD) and Security Not everything can be, needs to be, or should be, automated • Draw perimeters around things you trust and let that guide where human interaction and verification is needed Keep track of security assessments Regimented code management • Know what source code contributed to a build that’s in production so patches are fast and confident Perform static analysis where possible
  • 63. 61 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Security Overview Development, operations, teams engineer infrastructure and application Operations maintains continuous delivery process Developers write and push code Continuous integration server internally deploys code • Docker run / VM provision • Build • Test QA team evaluates the application for correctness Continuous delivery process deploys code to production servers Operations maintains production servers
  • 64. 62 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Security Overview with Security Highlights Development, operations, and security teams engineer infrastructure and application Operations maintains continuous delivery process Developers write and push code Continuous integration server internally deploys code • Docker run / VM provision • Build • Test QA team evaluates the application for correctness Continuous delivery process deploys code to production servers Operations maintains production servers
  • 65. 63 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Security Overview with Security Highlights Development, operations, and security teams engineer infrastructure and application Operations maintains continuous delivery process Developers write and push code Code push triggers security analysis via security controller Continuous integration server internally deploys code • Docker run / VM provision • Build • Test QA team evaluates the application for correctness Continuous delivery process deploys code to production servers Operations maintains production servers
  • 66. 64 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Security Overview with Security Highlights Development, operations, and security teams engineer infrastructure and application Operations maintains continuous delivery process Developers write and push code Code push triggers security analysis via security controller Continuous integration server internally deploys code • Docker run / VM provision • Build • Test • Automated security scan QA team evaluates the application for correctness Continuous delivery process deploys code to production servers Operations maintains production servers
  • 67. 65 Secure DevOps Process & Implementation © 2017 Carnegie Mellon University [Distribution Statement A] This material has been approved for public release and unlimited distribution. Please see Copyright notice for non-US Government use and distribution. Secure DevOps Anti-Patterns Integrate Security into DevOps
  • 68. 66 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Security Anti-Pattern: TheException-1 You automate… …builds …functional tests …deployment …reporting …the coffee machine
  • 69. 67 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Security Anti-Pattern: TheException-2 But security testing is still manual pen testing, done only on release. Recommendations: • Don’t leave security automation out of your DevOps automation strategy - Automated security testing removes human error, infrequent, execution, and excuses • Don’t try to avoid open source with policies, it is coming whether you like it or not! • InfoSec must maintain awareness of open source vulnerabilities and continuously check for them
  • 70. 68 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Security Anti-Pattern: TheException-3 OWASP ZAP https://www.owasp.org/index.php/OWAS P_Zed_Attack_Proxy_Project http://gauntlt.org/ GAUNTLT BE MEAN TO YOUR CODE AND LIKE IT There are great projects out there…
  • 71. 69 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Security Anti-Pattern: Multiverse When environments are not the same, your app may never behave predictably. Environment parity (between dev, test, prod) is critical for controlling opportunity for security gaps
  • 72. 70 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Security Anti-Pattern: Multiverse Recommendations: • Automate manual steps to the extent possible • Make development environment parity a priority • Get Ops involved in creating all environments, including Dev • Focus on providing fast easy-to-use automation tools for developers everyone to keep environments in synch
  • 73. 71 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Security Anti-Pattern: Configurator • Uncontrolled configuration changes will lead to an unmanageable, unpredictable, and unrepeatable solution • Easy for info security to get out of synch; For example, change in DNS and you have security hole. Recommendations: • Avoid the manual quick fix particularly for configuration changes • Put configuration files under configuration controls
  • 74. 72 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Security Anti-Pattern: Infiltrator He sneaks in… …and alters production …but he works for you! Recommendations: • Set up roles and revoke administrative access to manually edit production • Configure prod environment to alert the entire team when manually accessed. Transparency is key.
  • 75. 73 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Security Anti-Pattern: Survivor We have all been there… Intrusions overnight… …cascading system failures… …it’s all crashing… …help…me..…
  • 76. 74 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Security Anti-Pattern: Survivor-2 But you survive… Glad its over. Going to go sleep for 18 hours…and then back to the normal cycle. When do we analyze what went wrong? How do we prevent similar failures in the future? All failures must result in codified change to DevOps process Recommendations: • Understand exactly what went wrong • Never let the same failure happen twice • Propagate fixes across the enterprise • Ensure that you teach the next generation
  • 77. 75 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Security Anti-Pattern: College Party 99% of Global 2000 companies will be using open source code in mission-critical apps by 2016 Do you know what’s in your app? Code we wrote Code someone else wrote
  • 78. 76 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Security Anti-Pattern: College Party-2 Recommendations: • Infosec must enable constant (read: automated) checking for open source vulnerabilities Ways to fail: • Place infosec outside of the dev workflow • When UI/UX, infosec and accessibility requirements conflict and never get resolved • Dictate policy to not use open source • Document-driven checking is not going catch Prepare for what is coming….
  • 79. 77 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. DevOps Security Anti-Pattern: Skydiver Once you jump, you can’t return to the plane. You are committed. Permanently. This is not how we should model our deployments Recommendations: • Rollback is essential; Never be left without an escape route to completely working software • Strive for approaches that support “one button” rollback (e.g, feature flags or A/B)
  • 80. 78 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. SLS team GitHub Projects • Once Click DevOps deployment https://github.com/SLS-ALL/devops-voltron • Sample app with DevOps Process https://github.com/SLS-ALL/flask_api_sample • Tagged checkpoints • v0.1.0: base Flask project • v0.2.0: Vagrant development configuration • v0.3.0: Test environment and Fabric deployment • v0.4.0: Upstart services, external configuration files • v0.5.0: Production environment • On YouTube: https://www.youtube.com/watch?v=5nQlJ-FWA5A
  • 81. 79 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. For more information… SEI DevOps Blog https://insights.sei.cmu.edu/devops
  • 82. 80 Integrate Security into DevOps June 7th 2017 © 2017 Carnegie Mellon University [DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimiteddistribution. Please see Copyright notice for non-US Governmentuse and distribution. Contact Information Hasan Yasar Technical Manager, Secure Lifecycle Solutions hyasar@sei.cmu.edu @securelifecycle Web Resources (CERT/SEI) http://www.cert.org/ http://www.sei.cmu.edu/