Devops security-An Insight into Secure-SDLC
9 likes2,076 views
The document discusses the integration of security within the DevOps process, emphasizing the importance of secure Software Development Life Cycle (SDLC) practices. It outlines various security measures such as threat modeling, secure code reviews, and continuous security testing, while addressing common challenges and the role of quality assurance in enhancing security. The author, an experienced software security professional, shares insights on security automation and metrics for effective DevOps security implementation.
Devops security-An Insight into Secure-SDLC
- 1. DevOps Security-Part1 An insight into S-SDLC SUMAN SOURAV
- 2. Agenda DevOps Security –Introduction Software Security Toll Gates in DevOps An inside story of continuous security testing implementation Challenges
- 3. Disclaimer Not endorsing any tools
- 4. About me Software Security Professional having 10+ years of experience Specialize in Secure SDLC implementation Threat Modeling/Secure Code Review/Penetration Testing/DevOps Security Secure Coding Trainer, SecurityQA Testing Trainer, Speaker What next for me ? IoT Security SmartCity Security
- 5. DevOps-Introduction Faster Release Cycle Shortened Delivery Time Unified Tools and Process Integration between different teams
- 6. Secure-SDLC Security Requirements • Requirements Threat Modeling • Design Secure Code Review • Development Vulnerability Scanning/PT • Deployment Monitoring • Operation Time to complete these activities ?
- 7. DevOps Security: Pre-Staging Source : Kaspersky Continuous Integration Security Automation Right Process, People, Tools Collaboration & Sharing Metrics and Data Analytics
- 8. Security Failures in DevOps Dev Risk
- 9. DEVELOPMENT BUILD AND DEPLOY STAGINGREQUIREMENTS External Repositorie s Common Components DESIGN Repository SCM Tools Security Test Automation Threat Modeling SCA Tools/IDE Plugins VS/PT/IASTComponents Monitoring Production Monitoring
- 10. Third Party Libraries- Security Report
- 11. Collaboration Product 1 Product 3 Product 2 Product 4 Product 5 Product 6 Product 7 Product 8 Product 9 Security Champions
- 12. Requirements Security Questionnaire Automated Score Calculation Provide guidance for component selection
- 13. Design
- 15. Development
- 16. Source Code Management 1. Branching 2. Ownerships
- 17. Secure Code Review-IDE Plugins (Demo) Develop and Test Takes couple of mins to generate vulnerability report
- 18. Vulnerability Coverage • Detect most obvious vulnerabilities • Quickly Provide Security posture of the applications
- 19. Merging Reports • Keep eyes of new issues and fixed issues • Less time in false positive analysis
- 22. CI Tools Integration Third Party libraries analysis Static Analysis Security Unit test Cases Dynamic Analysis
- 23. QA Role- in DevOps Security Security Review of Requirements & Design Documents Security Static Code Analysis Results Review Dynamic Security Analysis Penetration testing including Fuzz Testing Third Party Components Review QA Role
- 24. Security Unit Test Cases (Demo)
- 25. CI Integration-DAST Unit Test Cases Browsers Scanners Reports Reference: http://www.hindsightsoftware.com/blog/security- testing-with-selenium-and-the-zed-attack-proxy-zap
- 26. Static Analysis Integration Build Environment Fix Vulnerabilities Integrate With Build Upload to Server Execute Scan Generate report SA Developers Reporting Server Audit and Re-upload Login
- 27. Interactive Application Security Testing (IAST) Accuracy without false positive Testing is fast Indifferent to the underlying framework.
- 28. Vulnerability Management & Hybrid Analysis Static Analysis Dynami c Analysis Security QA VA/PT/I AST Priority Fix
- 29. Security Metrics & Data Analytics 10 20 30 40 110 85 71 20 0 20 40 60 80 100 120 Release 1 Release 2 Release 3 Release 4 Training Index Bug Index
- 30. Bug Tracking System Keep track of issue remediation Workflow to Automate issues creation & assigning ownership Automated email alert to respective product owners
- 31. Limitations & Challenges All manual tests cant be automated Test automations are not sequenced
- 32. Stay Tuned…….. DevOps Security-Part 2 --An insight into Security Operation