Download as PDF, PPTX
Uploaded bySonatype
A Secure DevOps Journey
The document outlines Veracode's transition from traditional development methodologies to a secure DevOps approach, detailing the evolution from waterfall to agile and finally to DevOps. It emphasizes the importance of cultural changes, automation, and integrated security practices throughout this journey. The presentation also highlights the challenges faced and the need for continuous improvement in the organization's processes and technologies.
More Related Content
![[DevSecOps Live] DevSecOps: Challenges and Opportunities](https://cdn.slidesharecdn.com/ss_thumbnails/20200316dsochallengesopportunities-200416111818-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to A Secure DevOps Journey
A Secure DevOps Journey
- 1. November 15, 2016 ASecure DevOps Journey Peter Chestna, Director of Developer Engagement, Veracode
- 2.
- 3. • Development methodologiesused at Veracode – Waterfall, Agile, DevOps – People – Process – Technology – Security • Veracode’s journey – What did we change – What were the results Goals
- 4. • 2006 –Veracode founded/Waterfall • 2012 – Agile • 2013 – Purina • 2014 – Microservices • 2015 - DevOps Veracode Timeline
- 5. Felt like… Transformation –People/Org/Culture Management • Leading change • Organizational • Breaking the silos • New specialties • New skills – care & feeding • New expectations Individual • Uncertainty/fear/anger • Organizational • New manager • New team/peers • New skills – X-functional • New expectations
- 6. Looked like… Transformation -Process Most of the change occurred in Agile • Waterfall -> Agile was revolutionary • Agile -> DevOps was evolutionary • Like the Monty Python theory of dinosaurs
- 7. Waterfall Transformation - Technology Agile DevOps Notas big of a difference between stages Just more and more automation
- 8. There was Waterfall Inthe beginning…
- 9. Waterfall - Process Findinganything late creates a cycle of waste
- 10.
- 11. • Gantt charts •Text documents • Requirements • Architecture • Designs • Test plans • Manual tests • Manual deploy • Shell scripts • SQL cripts Waterfall - Technology Old School
- 12. Waterfall - Security Occurredduring testing cycle Back end of process Mostly manual Unpredictable amount of work
- 13. Coming of Age:Agile
- 14. Agile - Process Copyright2005, Mountain Goat Software
- 15.
- 16. Agile – TechnologyInitially
- 17. Agile – Security– Early Days 3 Build 4 Static Analysis Hardening Sprint 5 Security Results Security Results 2 Check in 1 Develop Agile Backlog
- 18. 1 Develop 6 Static Analysis 7 Synchronize 4 Check in Static Analysis 3 Build & Test 2 Agile Backlog Agile– Security – Automated and Integrated 5 Build Nightly
- 19. Agile – Securityis not limited to automation of static analysis! Security Champions Security Grooming (Requirements Review) Security as part of the Definition of Done Threat Modeling Secure Code Review Pen Testing Pre-Productions Dynamic Analysis
- 20. Agile - Cultureclash between Dev, OPS and Security
- 21. We Have Arrived:DevOps
- 22.
- 23. DevOps - People Breakthe Silos Reorganize Change the Culture
- 24.
- 25.
- 26. 1 Develop 4 Check in Static Analysis 3 Build & Test 2 Backlog DevOps– Security – Integrated into CD Pipeline Pass? 7 Synchronize No Yes 7 Deploy to Stage 6 Static Analysis 6 Unit Tests 8 Dynamic Analysis 8 Regression Testing Pass? Yes Prod Per Check-in 5 Build CD Pipeline
- 27. Training (eLearning, instructor led,metadata driven) Static Application Security Testing + 3rd Party Risk Analysis Remediation and Mitigation Guidance Secure Code Reviews Manual Penetration Testing Red Team Activities Runtime Application Self Protection Dynamic Application Security Testing Plan Code Build Test Stage Deploy Monitor Threat Modeling Security Grooming Secure Design DevOps – Pervasive Security
- 28. This Is OurJourney • Revolution at the micro level • Evolution at the macro level Innovation • Always constructively dissatisfied • Hypothesize, prototype, measure • Sharpen the saw Continuous Improvement
- 29.
- 30. Thank You w ww . v e r a c o d e . c o m @PeteChestna