Presentation from #OWASP's #AppSecUSA Oct 14 2016

1. DevOps to DevSecOps: Two Dimensions
of Security in a DevOps Enterprise
Sanjeev Sharma
CTO, DevOps Technical Sales and Adoption
IBM Distinguished Engineer
@sd_architect

2. #WhoAmI
• 20+ Years in Software
Development and Delivery
• IBM’s Client-facing CTO for
DevOps
• Author: DevOps For
Dummies -
http://ibm.co/devopsfordum
mies
• Write DevOps and Cloud
Adoption Blog:
http://bit.ly/sdarchitect

3. DevOps Overview

4. DevOps: Origins

5. DevOps approach: Apply Lean
principles accelerate feedback and
improve time to value
5
People
Process
Line-of-
business
Customer
1
3
2
1. Get ideas into production fast
2. Get people to use it
3. Get feedback
Continuously Improve:
I. Application Delivered
II. Environment Deployed
III. Application and Environment Delivery Process

6. Delivering a Business Capability:
Multi-Speed IT
Development SCM Build Package
Repo
Deploy
Development SCM Build Package
Repo
Deploy
Development SCM Build Package
Repo
Deploy
Development SCM Build Package
Repo
Deploy Test Stage Production
Application N
Application C
Application B
Application A
Enterprise
Release
Agile/Innovation Edge
Rapid Delivery for Innovation • Agile • Antifragile • Experimentation • New and Innovative • Hybrid Cloud • PaaS
Industrialized Core
Deliver at regular cadence • Waterfall -> Agile • Stability • Predictability • Lean Delivery pipeline • Core and Legacy
Hybrid Infrastructure – Physical, Cloud • IaaS/PaaS
Business
Capability

7. Security and the
Application Delivery
Pipeline

8. Three (Two) Dimensions of
Security
8
1. Secure the Perimeter
2. Secure the Delivery Pipeline
3. Secure the Deliverable
http://www.ibm.com/developerworks/library/d-security-
considerations-devops-adoption/

9. 1. Secure the Perimeter
9
Out of Scope for this session

10. 2. Secure the Delivery Pipeline
10
Secure Engineering Patch ManagementSecure Build and Deploy
Availability and Business ContinuitySeparation of Duties
Security Evaluation and Learning
Development SCM Build
Package
Repo Deploy Testing Staging Production FeedbackPlanning Manage

11. 3. Secure the Deliverable
11
Application
Middleware Config
Middleware
OS Config
Hardware
FullStack
Blueprint
Policies
Secure:
• Code
• Scripts
• Packages
• Components
• Configurations
• Content
• Policies
• Roles
Development SCM Build
Package
Repo Deploy Testing Staging Production FeedbackPlanning Manage

12. Risks and Vulnerabilities - Delivery
Pipeline and Deliverables
12
1. Vulnerabilities related to the supply chain
2. Insider attacks
3. Errors and mistakes in the development project
4. Weaknesses in the design, code, and integration
5. API Economy and Security
http://www.ibm.com/developerworks/library/d-security-
considerations-devops-adoption/

13. Vulnerabilities related to the
supply chain
13
External Supplier A
External Supplier B
Internal Supplier A
Internal Supplier B
Development SCM Build
Package
Repo Deploy Testing Staging Production FeedbackPlanning Manage

14. Insider attacks
14

15. Errors and mistakes in the
development project
15
1 per min 1 per min
4 per min 1 per min
4 per min 4 per min
• Reduced Batch size
• Continuous Validation:
– Continuous Security Testing
– Testing small batches in
every Sprint
• Antifragile Systems
– Servers are ‘cattle’ not
‘pets’
– MTBF vs MTTR

16. Weaknesses in the design,
code, and integration
16
http://www-03.ibm.com/security/secure-engineering/

17. The API economy and security
17https://developer.ibm.com/architecture/gallery/APImanagement

18. The API economy and security:
Implementation
18https://developer.ibm.com/architecture/gallery/APImanagement
1. API Key management
2. API provider/consumer Identity Management
3. API Access control
4. API Usage management/throttling
5. API Security Incident Monitoring
6. API Logging and audit trail

19. DevOps Reference
Architecture

20. Adopting a (Secure) DevOps
Architecture
https://developer.ibm.com/architecture/devOps

21. Solution Architecture : DevOps
Multi-Speed IT
https://developer.ibm.com/architecture/gallery/devOpsMultiSpeed

22. Start Here:
Value Stream Mapping
for Identifying and Addressing
bottlenecks

23. Mapping your Delivery Pipeline
Idea/Feature/Bug Fix/
Enhancement
Production
Development Build QA SIT UAT Prod
PMO
Requirements/
Analyst
Developer
CustomersLine of Business
Build
Engineer
QA Team Integration Tester User/Tester Operations
Artifact Repository
Deployment Engineer
Release Management
Code Repository
Deploy
Get Feedback
Infrastructure as Code/
Cloud Patterns
Feedback
Customer or
Customer Surrogate
Metrics - Reporting/Dashboarding
Tasks
Artifacts

24. DevOps Innovation Workshop
24
Review the current state
1. Business goals, IT goals, current
initiatives
2. DevOps
3. Requirements
4. Environments
5. Repositories
6. Roles / Organization
7. Metrics
8. Security
Prioritize challenges to be
resolved
Create a first pass at an
improvement roadmap
The whiteboard

25. Questions?
25