DevSecOps Is Not Just DevOps Lipstick On A traditional Security Pig

LinkedIn.com/in/LarryMaccherone
DevSecOps is not just
DevOps lipstick on a
traditional security pig
Larry Maccherone

Larry Maccherone
Larry_Maccherone@Comcast.com
Larry Maccherone

DevOps is fertile ground for the concepts
driving the DHS-sponsored Build-Security-In portal
that Noopur Davis, Gary McGraw, and I launched a decade ago
DevOps = opportunity for security

As DevOps exponentially speeds
up the pace of development
Bolt-on security by security
specialists won’t scale
… so security MUST be a primary
concern of the development team

What is DevOps?

What is DevOps?
• A new role?
• Partnership/communication/empathy between Dev and Ops?
• CI/CD tools?
• Automation?
• Self-service?
• Techniques like feature flags or traffic shaping?
• “Move fast and break things”?
• Culture change (systems thinking, continuous improvement, etc.)?

DevOps is…
empowered engineering teams
taking ownership
of how their product
performs in production

DevOps  different decisions

“I don’t always test
but when I do, it’s
in production”
Mature DevOps practices
1. Develop in trunk
• No long-lived branches
• Short branches for code review, build-
checking, time-intensive test suites,
security scanning, etc.
• Dead-end release branches OK
2. Partial/unvalidated features
behind toggles/flags and/or
traffic shaping
3. Automated validation 
automated push to prod

Feature toggles & traffic shaping
• Run-time switchable
• Database backed
• Also for safe-to-fail feature experiments
• Build/deploy time
• Common for micro-services & APIs
• Traffic shaping
• Rules engine + database backed
XRE Guide’s
Application Discovery Service (ADS)
XRE Guide’s
Redirector Traffic Shaping Router

What is Dev[Sec]Ops?

Security

Dev[Sec]Ops is…
empowered engineering teams
taking ownership
of how their product
performs in production
[including security]

Dev[Sec]Ops Results
• Dramatically faster time to market 
happier customers  more revenue
• 5x lower rate of failures caused by changes1
• 96x faster recovery from downtime failures1
It’s scary to QA and Security, but “moving fast and breaking
things” leads to dramatically lower rates of customer
experienced defects and vulnerabilities
1Puppet’s 2017 State of DevOps Report

Build security in
more than bolt it on
Rely on empowered engineering teams
more than security specialists
Implement features securely
more than security features
Rely on continuous learning
more than end-of-phase gates
Build on culture change
more than policy enforcement
DevSecOpsManifesto

We, the Security Team…
Recognize that Engineering Teams…
• Want to do the right thing
• Are closer to the business context and will
make smart trade-off decisions between
security and other risks
• Want information and assistance so they
can improve our security posture
Pledge to…
• Lower the cost/effort side
of any investment in
developer security tools or
practices
• Assist 2x as much with
preventative initiatives as
we beg for your assistance
reacting to security
incidents
Understand that…
• We are no longer gate keepers but rather tool-smiths and advisors

Credibility + Reliability + Empathy
Trust = ————————————————
Apparent self-interest
https://www.devsecopsdays.com/articles/trust-algorithm-applied-to-devsecops

Manysupposed
DevSecOpstoolsare
justlipstickonapig

Think of security testing tools
as just another testing suite
like those for
unit, acceptance, etc.

Dev[Sec]Ops Tool Landscape
Static Analysis (aka SAST)
• Looks at source code
• Data/control flow analysis
• Prone to false positives
• Rapid feedback for developers
• Code fix suggestions
Dynamic
• Exercises app via UI/API
• Senses vulnerability by response to input
• Zero? false positives. Report is an exploit
• High false negatives
• Difficult to implement especially w/ auth
• Sometimes hard to find code to remediate
Runtime Application
Security Protection
(RASP)
• Often uses same engine
as IAST
• Reports on “bad”
behavior
• Can abort transaction or
kill process to protect
Fuzzing (black box)
• Instruments system (to varying degrees)
• Sends unexpected input at API
• Looks at response and instrumentation output
• Great for testing protocols like SIP
• Good for REST APIs
• Potentially long run times
• Hard to find code to remediate
Software Composition
Analysis (SCA)
for code imported
• Identifies dependency and
version
• Checks CVE/NVD + … for
reported vulnerabilities
• Proposes version/patch to
remediate
• Checks license vs policy
• Runs fast
• Easy to implement
• Best bang for buck!
IAST
• Runtime code analysis
• Combine dynamic/static
• Low false positives
• Depends on test coverage
• Immature but getting there

Criteria for DevSecOps tools
• Integrated and runs fast in pipeline for current dev cycle:
• Parallelized with other test suites, or…
• In-series, or…
• Incremental parallelized/in-series from asynchronous baseline, or…
• Asynchronous out of pipeline for baseline/feedback for next dev cycle
• Notifications the way the team wants: Slack, email, report,
dashboard, etc.
• Interrupt the pipeline the way the team wants: break the build,
turn the merge button red, etc.
• Environment-specific (dev, staging, prod, etc.) ”policy”

DevSecOps Tool recommendations
• SCA (aka dependency checkers, open source security scanners) are
the best bang for the buck/effort. START HERE
• Next implement IAST or SAST (together, we created a category
grouping these two called Primary Code Analysis). FAVOR IAST
• Embed in pipeline and treat like an additional test suite.
• For greenfield turn on all checkers and interrupt pipeline unless
automated security tests come up clean.
• For legacy, “stop the bleeding” by interrupting pipeline for NEW
issues and slowly turn up the interrupt policy until all legacy issues
are resolved. Plan to address all critical/high issues within 120 days.

What will happen to
security specialists?

… similar to what happened to QA
Engineers with the Agile movement
… they will join a
development team
… or they will become
tool-smiths and advisors

What’s
next?
• Questions?
• Read about the Trust Algorithm
https://www.devsecopsdays.com/articles/
trust-algorithm-applied-to-devsecops
• Connect with me

DevSecOps Is Not Just DevOps Lipstick On A traditional Security Pig

Recommended

Recommended

More Related Content

More from VMware Tanzu

More from VMware Tanzu (20)

Recently uploaded

Recently uploaded (20)

DevSecOps Is Not Just DevOps Lipstick On A traditional Security Pig