Silver Lining for Miles: DevOps for Building Security Solutions
- 1. Silver Linings for Miles: DevOps for Building Secure Solutions zane@signalsciences.com @zanelackey apb@datadoghq.com @andrewbecherer
- 2. Who are these guys anyway? • Zane built and led the Etsy Security Team (spoiler alert: much of what this presentation is about) and co-founded Signal Sciences • Andrew ran a large application security consulting practice for iSEC/NCC Group and is now leading the Datadog Security Team (spoiler alert: also much of what this presentation is about)
- 3. This talk is about lessons learned being at the forefront of the shift to agile/continuous deployment/DevOps
- 4. For security teams, the world has changed in three fundamental ways: – Agility means code deployment is trending to near-instantaneous – Security is no longer the gatekeeper to deployment – If security is a blocker, it will be routed around
- 6. A simulation of deploying code in the waterfall model
- 7. What is this shifting to?
- 8. An agility example: Etsy pushes to production 50 times a day on average
- 9. Constant iteration in production via feature flags, ramp ups, A/B testing
- 10. But doesn’t the rapid rate of change mean things are less secure?!
- 11. Actually, the opposite is true
- 12. They key to realize is vulnerabilities occur in all development methodologies …But there’s no such thing as an out-of- band patch in continuous deployment
- 13. They key to realize is vulnerabilities occur in all development methodologies …But there’s no such thing as an out-of- band patch in continuous deployment
- 14. Compared to: “We’ll rush that security fix. It will go out … in about 6 weeks.” - Former vendor at Etsy
- 15. What makes continuous deployment safe?
- 16. What makes continuous deployment safe? Visibility
- 19. The same hard lessons are slowly shifting to security
- 20. Ex: Which of these is a quicker way to spot an attack?
- 23. Increase agility by surfacing security visibility for everyone, not just the security team
- 24. Having to talk to security to get security awareness causes delays
- 25. Having to talk to security to get security awareness causes delays Delays get routed around
- 26. To embrace agility, security has to decentralize
- 27. Without strong gating we never get security eyes on code
- 28. Did you ever really, I mean really, have security eyes on code?
- 29. Let’s do better. …But there’s no such thing as an out-of- band patch in continuous deployment
- 30. “Communities of practice are groups of people who share a concern, a set of problems, or a passion about a topic, and who deepen their knowledge and expertise in this area by interacting on an ongoing basis.“ …But there’s no such thing as an out-of-band patch in continuous deployment
- 32. Challenge: Maintain informality while building trust across time-zones.
- 33. Can we measure it? …But there’s no such thing as an out-of- band patch in continuous deployment
- 34. Pro-move: Link your local practices to global practices to build Extended Knowledge Systems.
- 37. Lessons Learned: – Embracing DevOps/Agile/Continuous Deployment helps not harms security – Visibility is the key to moving quickly and safely – You (in the general case) are never going to be able to hire enough staff, so steal everyone else’s
- 38. Thank you! zane@signalsciences.com @zanelackey apb@datadoghq.com @andrewbecherer