Shannon Lietz

The Journey to DevSecOps^RUGGED

@devsecops

Always an Early Adopter

Google Trends• DevOps.com was bought in

2004• Google searches for “DevOps”

started to rise in 2010• Major influences:

– Saving your Infrastructure from DevOps / Chicago Tribune

– DevOps: A Culture Shift, Not a Technology / Information Week

– DevOps: A Sharder’s Tale from Etsy

– DevOps.com articles

• RuggedSoftware.org was bought in 2010

https://www.google.com/trends/

Chasing Innovation…

Which means, spending most of your career doing this…

BangHead Here

This is the End of Security as We Know It…

Say what?!??!

6+ years later, it’s hard to believe we’re still shocked by this quote!

This talk will provide you with a path forward…

And a survival kit...

-Josh Corman

An Ugly Little Secret

• DevOps teams make security decisions… several times, everyday!

• Hackers find security issues and exploit them... several times, everday!

• Security teams hardly ever make security decisions... and really only when risks need to be officially authorized!

https://www.flickr.com/photos/denise_rowlands

In a Deming World…• Most decisions are made within the

software supply chain by engineering teams

• Security decisions are usually made as a result of attempting to balance design constraints

• Gating processes are not Deming-like; but

it is hard to avoid business catastrophes by applying measure ahead strategies for security

• Most security defects are identified during a major event triggering the equivalent of a security “recall”

design build deploy operate

How do I secure my

app?

What component is

secure enough?

How do I secure

secrets for the app?

Is my app getting

attacked? How?

Typical gates for security checks & balances

Mistakes and drift often happen after design and build phases

Most costly mistakesHappen during design

Missing and much-needed feedback loop

Hackers have lots of opportunities…

People

• Susceptible to phishing and email scams• Can be social engineered

Process

• Humans make mistakes, because they are human (6 Sigma)• Process gaps provide room for fraud

Technology

• Software complexity increases with reusable components• Technology providers have to do their part, or everyone fails!

Get Grounded in Reality• Secure business is the new black! KTLO!• Everyone must be responsible for security!• Perfection is over-rated… Mistakes are

inevitable.• Reacting can be costly… build security in.• Compliance is important but it’s not security!• A blaming culture is dangerous, avoid it!• Continuously test, detect, measure and

incrementally improve.7

PRINCIPLES

Keep The Lights On!

• Keeping the Lights on includes Security…

• 66% of companies adopting DevOps

• DevOps teams need guardrails and guidelines to move fast

• Security decisions that haven’t been made before likely require escalation

https://www.flickr.com/photos/darwinbell

http://www.rightscale.com/blog/cloud-industry-insights/cloud-computing-trends-2015-state-cloud-survey

Enlist Everyone!

• Common ratio for Dev, Ops and Sec => 100, 10, 1

• Numbers matter against attackers!

• Skills help, but anyone can identify an anomaly.

• Everyone needs to help with security; everyone has a role to play. And this is hard to find...

Mistakes happen…

• DevOps utilize customer-driven development processes with incremental changes…Mistakes just happen.

• But because of frequent changes, teams have more opportunities to correct defects, on average 30x more

• Teams need help deciphering how to self-correct

https://www.flickr.com/photos/doobybrain

Protection is ideal; Detection is a must!

• The faster a defect is discovered, the faster it can be dealt with.

• DevOps has 50% faster MTTR• Transforming security events

into incidents and problems helps with resolution rates

https://www.flickr.com/photos/daoro

Compliance Programs won’t stop a breach

• Point in time assessments don’t go far enough

• 0 companies (in 10 years) have been found compliant after a breach

• Compliance needs to be paired with rugged security

http://www.slideshare.net/VerizonEnterpriseSolutions/webinar-new-insights-to-simplify-pci-compliance-and-manage-risk

High Performing is where it’s at!

• High performing teams that focus on a blameless culture improve on average 50% better

• Blaming cultures create less engagement, 30% less efficient

• MTTR is 5x faster in blameless teams that focus on opportunities first

#1

Continuous Improvement• Continuous improvement has been a

goal for an endless amount of years• Teams that focus on testing, early

detection, and measuring progress have 30% fewer defects in production

• Tests are often added to continuous delivery to achieve better results throughout the continuous delivery pipeline

https://www.flickr.com/photos/deniscollette

Great! What does this look like in practice for a security professional?

Leaning in over Always Saying “No”Data & Security Science over Fear, Uncertainty and Doubt

Open Contribution & Collaboration over Security-Only RequirementsConsumable Security Services with APIs over Mandated Security Controls & Paperwork

Business Driven Security Scores over Rubber Stamp SecurityRed & Blue Team Exploit Testing over Relying on Scans & Theoretical Vulnerabilities

24x7 Proactive Security Monitoring over Reacting after being Informed of an IncidentShared Threat Intelligence over Keeping Info to Ourselves

Compliance Operations over Clipboards & Checklists

Use Security Skills to Build Tools

Migrate to Security as Code

Get Involved and Join the Community

• devsecops.org• @devsecops on Twitter• DevSecOps on LinkedIn• DevSecOps on Github• RuggedSoftware.org• Compliance at Velocity• Join Us !!!• Spread the word!!!

#RuggedDevOps

If you see something cool…

Thank You to Our Sponsors

Get today’s Rugged DevOps presentations in your inbox

mmiller@sonatype.com