Performing continuous security testing in a DevOps environment with short release cycles and a continuous delivery pipeline is a big challenge and the traditional secure SDLC model fails to deliver the desired results. DevOps understand the process of built, test and deploy. They have largely automated this process in a delivery pipeline, they deploy to production multiple times per day but the big challenge is how can they do this securely?
This session will focus on a strategy to build an application security pipeline in Jenkins, challenges and possible solutions, also how existing application security solutions (SAST, DAST, IAST, OpenSource Libraries Analysis) are playing a key role in growing the relationship between security and DevOps.
Implementing an Application Security Pipeline in Jenkins
Implementation an Application Security
Pipeline in Jenkins
• Continuous Integration
• Application Security Pipelines
• Approaches in Jenkins
Software Security Professional having 10+ years of
Specialize in Secure SDLC implementation
Threat Modeling/Secure Code Review/Penetration
Continuous Security Testing
Secure Coding Trainer, SecurityQA Testing Trainer
DevSecOps Singapore & Null Singapore
What next for me ?
Compile Test Publish Deploy
GitHub Jenkins Dev Deploy
Open Source Libraries
Application Security Pipeline
DEVELOPMENT BUILD AND
What we need ?
• Traditional Training
• Shorter training duration
• Rugged Software
“Rugged” describes software development organizations which have a culture of rapidly evolving
their ability to create available, survivable, defensible, secure, and resilient software.
The Building Security In Maturity Model (BSIMM, pronounced “bee simm”) is a study of existing
software security initiatives. By quantifying the practices of many different organizations, we can
describe the common ground shared by many as well as the variation that makes each unique.
• OWASP SAMM
Evaluate an organization’s existing software security practices
Build a balanced software security assurance program in well-defined iterations
Demonstrate concrete improvements to a security assurance program
Define and measure security-related activities throughout an organization
Software security centric process, standards &
Choose the right tools
• CI/CD Supports
• Scan time
• Incremental Report
• False Positives
• Custom Rules Set
• Language Supports
• API Calls
• Scan Policies
• Less False Positives
• Monitor Traffic
• Along with QA testing
• Immediate Feedback • Threat