More Related Content
Similar to DevOps and the Future of Information Security
DevOps and the Future of Information Security
- 1. DevOps and theFuture of Information Security Darin Morris @techdevdari n in/darinmorris 2018
- 2. In General: What weâregoing talk about 2. How âdoing DevOpsâ affects how we secure Data and Computer-centric Information Systems In Particular: 1. What it really means to do DevOps Thoughts Iâve had around DevOps and Security
- 3. Motivation for thistalk âą I want âinformation technology practitionersâ to become more professional, more productive and happier at work. Many reasons, but some of the more major reasons are: âą Information systems need to be of higher quality and delivered faster â we need to really understand the DevOps philosophy to do that well. âą Security is often an afterthought in the IT systems lifecycle â that needs to change. âą We need a common, meaningful language â not buzzwords!
- 5. DevOps and Securityare very broad domains!
- 6. So can wecover enough in only 35 minutes?!
- 7. SOMEONE ONCE TOLDME NOT TO BITE OFF MORE THAN I COULD CHEW⊠I said Iâd rather CHOKE ON GREATNESS THAN NIBBLE ON MEDIOCRITY.
- 8. Letâs get toknow each other a little better!
- 9. Sales or Relationship Management Doesthis sound like your role? Marketing Finance Leadership (C-Suite) Human Resources Business Analyst / Big Data Analyst General Administrator In-house Legal
- 10. Project Manager or CoordinatorProduct Manager/Owner Software Architect Software Engineer Test Engineer Provision and Manage IT Infrastructure (IT Ops) Does this sound like your role? Dedicated Security or Compliance Something else? ?
- 11. OK! Less aboutyou. More about me!
- 12. Fun facts aboutme Most used programming languages: C#, JavaScript âSiliconCape Nativeâ First PC: Pentium 1 with Windows 95 First programming language: Java (JDK 1.3)
- 13. Professional background âą Iâma self-taught âTechnologistâ and I solve problems using technology. âą I've been a founder, manager, team lead and software engineer, in various sectors, and in teams of different shapes and sizes. âą Microsoft Certified Professional âą Certified ScrumMaster âą In the process of completing CSSLP, ITIL and ISTQB certifications. âą Member of a number of professional IT associations and bodies i.e. OWASP, ISACA, IITPSA âą Fulltime full stack software engineer for the past 13 years, primarily focussed on web and cloud-native software.
- 14. Letâs play agame!
- 15. True or False? DevOpsis only done by technical staff. Question #1
- 16. True or False? DevOpsis a Role. Question #2
- 17. True or False? DevOpsis a way of thinking about how we do work. Question #3
- 18. What is DevOpsreally?
- 20. âą DevOps Principlesand Practices are compatible with Agile âą DevOps is a logical continuation of Agile âą Agile serves as an effective enabler of DevOps Myth #1: DevOps replaces Agile
- 21. âą Can bemade compatible - many areas just become automated. Myth #2: DevOps is incompatible with ITIL
- 22. âą Controls are integratedinto every stage of daily work of the SDLC resulting in better quality and security and compliance outcomes. Myth #3: DevOps is incompatible with InfoSec and Compliance Image credit: Checkmarx Software Exposure platform (www.checkmarx.com)
- 23. âą Rarely thecase. Nature of IT Operations work just changes. âą Collaborates far earlier in SDLC with development. âą Enables developer productivity through APIs and self-service platforms that create environments, test and deploy code, monitor and display production telemetry, etc. âą IT Ops become more like Development âą i.e. engaged in product development for developers. Myth #4: DevOps means eliminating IT Operations
- 24. âą âDevOps isnâtabout automation, just as astronomy isnât about telescopesâ - Christopher Little Myth #5: DevOps is just Infrastructure as Code
- 25. DevOps is aboutTeam Work that enables efficient creation of value What DevOp really boils down to
- 26. So, how isSecurity affected?
- 27. Security and DevOps- DevSecOps? âą Security is fundamentally about mitigating risk (youâll never be 100% secure). âą Mitigating risk is enabled by maintaining integrity, availability and confidentially. âą Security principles havenât changed, the way we implement security has.
- 28. Security Fail Securely Minimize attack surface Least Privilege Integrity Auditing KeepThings Simple (Economy of mechanism) Separation of duties/privilege Confidentiality Psychological Acceptability Availability Single Point of Failure Defense in Depth Leverage Existing Components Open Design Complete Mediation Security Principles and Concepts
- 29.
Editor's Notes
- #3Â Aims: 1.1. Cover key principles. 1.2. Take audience on a journey to my AHA moment. 2. Delve into the impact of DevOps on security Clarify Terms and Concepts (Information Technology, Technology, DevOps, QA, Security) Provoke reflection on the way the audience currently does work and thought about what can be done better. Drive home the importance of security in software
- #4Â Is a pen and paper information technology?
- #5Â Disclaimer 1: I may be biased â Iâm a software developer Iâve been thinking about this stuff a lot lately, but Iâm probably ignorant to something. There is enough content to write about, never mind a short talk.
- #6Â Disclaimer 2: There is potentially a lot we could cover, but we have very little time.
- #7Â Disclaimer 2: There is potentially a lot we could cover, but we have very little time.
- #8Â I make joke. Har har.
- #16Â Answer: False Reason: DevOps isn't any single person's job. It's everyone's job.
- #17Â Answer: False Reason: DevOps isn't any single person's job. It's everyone's job.
- #18Â Answer: False Reason: DevOps isn't any single person's job. It's everyone's job.
- #20Â DevOps is a lot like the Standard Model of particle physics.
- #21Â Agile Toronto Conference 2008 Patrick Debois coined to the term DevOps when he organized the first DevOpsDays conference in 2009.
- #29Â DevOps is a lot like the Standard Model of particle physics