Security is everybody’s job…. Literally! Changing …...Security is everybody’s...

Security is everybody’s job….

Literally!Changing DevOps into DevSecOps

Tanya Janca

Security is everybody’s

job…Literally! Tanya Janca

@SheHacksPurple

What are we going to talk about

today?

@SheHacksPurple

DevOps

@SheHacksPurple

DevSecOpsFrom a dev and ops perspective.

@SheHacksPurple

Security being partof your daily work.

How some security people see DevOps

@SheHacksPurpleSlide Credit: Pete Cheslock

How I see DevOps: DevSecOps@SheHacksPurple

Slide Credit:

DevSecCon

@SheHacksPurple

DevSecOps

I’m Tanya Janca.

@SheHacksPurple

AKA: @SheHacksPurple

This is me.

I’m a Senior Cloud Developer Advocate at:

What does THAT mean?@SheHacksPurple

I work to make security features easier to use.

It means I help developers use our products more securely.

I provide feedback to make our products more secure.

I do security research and share it with the community.

Security research, such as this presentation, OWASP DevSlop, and much more.

This is me.

I’m a Senior Cloud Developer Advocate at:

@SheHacksPurple

This is me. AppSec Evangelist.

@SheHacksPurple

This is me.

Ethical hacker

I want to know how things work.

@SheHacksPurple

This is me.

I LOVE OWASP!

Open Web Application Security Project

An international non-profit that operates chapters, projects and conferences all over the globe, in efforts to

help everyone create more secure software.

@SheHacksPurple

This is me.

OWASP Ottawa Chapter Leader

@SheHacksPurple

This is me.

OWASP DevSlop

Project Leader

@SheHacksPurple

This is me.

Software Developer

(since the late 90’s)

That’s over 20 years!

AHHHHHHHHHHHH!

@SheHacksPurple@SheHacksPurple

This is me.

Goal: to change the way we make software so that the easiest way to do something is also the most secure way.

Photo: Belfast, Ireland, AppSec EU 2017 @SheHacksPurple

Let’s do this.

@SheHacksPurple

Application Security

@SheHacksPurple

Introduction

@SheHacksPurple

Poor AppSec is a Problem!

Poor AppSec Causes 29-40%~ of Breaches!Verizon Data Breach Investigation Report (DBIR) for 2017 and 2016.

@SheHacksPurple

Application Security Missing!

AppSec is not covered in most post-secondary Comp-Sci and Soft-Engprograms

@SheHacksPurple

@SheHacksPurplePhoto: #WOCTechChat

Security is Outnumbered!

Dev / Ops / Sec

@SheHacksPurple

100 / 10 / 1

Security is Outnumbered!

And the accompanying security model was much, much worse.

@SheHacksPurpleImage: Winged Beast

Waterfall Never Worked Well

DevOps

@SheHacksPurple

ConfidentialityIntegrityAvailability

@SheHacksPurple

“DevOps is the best thing to happen to Application Security since OWASP. ”

-Tanya Janca

@SheHacksPurple

DevOps

The Three Ways

Left -> Right = speed

@SheHacksPurple

Requirements Design Code Testing Release

What does this mean for Security?

What does this mean for dev & ops?

Only deploy up-to-date images and containers.

The “Photo” Slide, #1• Helping the AppSec team tune static code analysis

tools • Add security bugs to the defect tracker• Using templates and code samples that a known-

secure (sec code library) • Using freshly scanned images that are up to

date/fully patched• Setup regular, automated scans for VMs and

containers@SheHacksPurple

Help the AppSec Team tune their tools.

For their sake, and yours.

What does this mean for dev & ops?@SheHacksPurplePhoto: #WOCTechChat

Positive testing determines that your application works as expected. If an error is encountered during positive testing, the test fails.

Negative testing ensures that your application can gracefully handle invalid input or unexpected user behavior.

What does this mean for

dev & ops?

The “Photo” Slide, #2• Add negative use cases as unit tests, not just positive

use cases (Morgan Roman, @Hackimedes)• Helping AppSec team tune web proxy scanners (DAST)• If the AppSec team creates a security pipeline for testing

for you, use it!• OWASP Dependency check, Retire.js, Synk, Black Duck,

etc. Tools to remove known vulnerable code/ libraries/ components

@SheHacksPurple

Requirements Design Code Testing Release

@SheHacksPurple

Fixing costs of quality & security issues rises significantly as the development cycle

advances

CODING PRODUCTIONQA & SECURITY

Source: Ponemon Institute Research

$80/defect $240/defect $960/defect $7,600/defect

DevOps and the “Shift Left” principal

@SheHacksPurple

What does this mean for Security?

@SheHacksPurplePhoto: #WOCTechChatFaster Feedback = Shifting Left

Telling the security team what you are concerned about.

Feedback goes both ways.

@SheHacksPurple

Side Tangent: The SecDevOpronomicon

Participating in Security Activities

• Incidents

• Threat Modelling

• Security Sprints

• Etc.

The “Photo” Slide, #3• Faster feedback loops = fixing bugs sooner • Breaking the build if you introduce security issues• Adding security sprints to your project timeline• Participating in Threat modelling activities • Participating in incident response, if need be• Learning to use security tools• Security becomes part of the definition of quality

@SheHacksPurple

What does this meanfor Security?

What does this mean for dev &

The “Photo” Slide, #4• Accept security training if offered• Train yourself • Share information widely when you fix security issues• Participate in Security Simulations• Ask for and analyze metrics from security testing,

look for patterns or systemic issues• Ensure you perform blameless introspection

@SheHacksPurple

Security is Everybody’s Job

Culture Change

@SheHacksPurple

Photo: #WOCTechChat

Celebrate Security

Reinforce Culture Change

@SheHacksPurple

Photo: #WOCTechChat @SheHacksPurple

Work More Closely:

Security + Dev + Ops

Photo: #WOCTechChat @SheHacksPurple

No More Blaming

Photo: #WOCTechChat

@SheHacksPurple

Be a Security Champion

@SheHacksPurple

Call To Action

@SheHacksPurple

Call To Action

Conclusion

@SheHacksPurple

Resources

@SheHacksPurple

The Microsoft DevOps Journey

https://stories.visualstudio.com/

OWASP DevSlop Has Your Back

@SheHacksPurplehttps://www.owasp.org/index.php/OWASP_DevSlop_Project

DevSlop.co

@SheHacksPurple

Links for Getting Started in Application

Security

https://aka.ms/GettingStartedWithAppSec

Resources

@SheHacksPurple

Security LearnsTo Sprint

@SheHacksPurple

Follow me?Twitter: @SheHacksPurple

https://medium.com/@shehackspurple

https://DevSlop.co

Resources

@SheHacksPurple

Security is now a partof your daily work.

Resources

Subject divider

Tanya Janca

job…Literally!

Thank You

Tanya.Janca@Microsoft.com

Tanya.Janca@owasp.org @SheHacksPurple

http://aka.ms/AppSecEU

Security is everybody’s job…. Literally! Changing …...Security is everybody’s...

Documents

Transcript of Security is everybody’s job…. Literally! Changing …...Security is everybody’s...

‘Ending child poverty everybody’s business’ The Child Poverty Strategy: setting the national context NAVCA Newcastle Event – Child Poverty: everybody’s.

Indigenous Education - Everybody’s Business: … Education - Everybody’s Business: Implications for teacher education Report of the Working Party on Indigenous Studies in Teacher

Everybody’s a Teacher

Better Education Is Everybody’s Business!

Regulatory and Statutory Compliance: It’s Everybody’s Business!

Earlier intervention in psychosis - everybody’s business

Today everybody’s the media

Safeguarding is Everybody’s Business for HCPA 2018

Tuberculosis is Everybody’s Business - League of Cities ... · Tuberculosis is Everybody’s Business Multisectoral Stakeholder Alliances (MSA) for Tuberculosis Control Dino A.E.

The New Normal: Everybody’s a Leader!

Everybody’s talking about transfer students…

Addiction treatment is everybody’s business - NCATncat.org.nz/wp-content/uploads/addiction-treatment... · Addiction treatment is everybody’s business Where to from here? Contact

Tuberculosis is Everybody’s Business - League of … · Tuberculosis is Everybody’s Business ... • Collect , analyze, & use TB data for local TB program management ... barangay

It’s Everybody’s Business · It’s Everybody’s Business: Engaging the Private Sector in Solutions to Youth Homelessness ... Education Homelessness is Everybody’s Business.

Making Mental Health Everybody’s Business · 2020. 8. 26. · Making Mental Health Everybody’s Business Mental health is everybody’s business but often it can be difficult to

Opioid Crisis Next Door: It’s Everybody’s Business

Everybody’s Doing It

Cyber security: everybody’s imperative...experience in IT and cyber risks, and cyber security is left to those within IT to resolve F Oversight of cyber security and assessment of

Everybody’s fool (music video analysis)

If Trauma is everybody’s - NHS Health ScotlandQuality Education for a Healthier Scotland If Trauma is everybody’s business where does Routine ... Trauma is everybody’s business