DevSecOps Manchester - May 2019
- 1. DevSecOps – London Gathering May 2019
- 2. THE JOURNEY … • Venue (s) • Do you need support from vendors • Speakers • What content • Defining a theme • Recordings; Streaming • Give-aways (not prizes) • Format of meetup • How long • Networking • Collaboration
- 3. WAYS TO STAY IN TOUCH https://www.meetup.com/DevSecOps-London-Gathering https://twitter.com/DevSecOps_LG https://www.linkedin.com/company/devsecops-london-gathering https://github.com/DevSecOps-LondonGathering https://www.youtube.com/channel/UCR4oVMkRjNN2OQaWMiBcfJA
- 5. SHOUT OUT *** Meetups *** OWASP London Chapter www.meetup.com/OWASP-London/ OWASP WIA www.meetup.com/womeninappsec/ DevSecOps Manchester www.meetup.com/DevSecOps-Manchester/ DevSecOps – Netherlands www.meetup.com/DevSecOps-Netherlands/ LLHS www.meetup.com/LLHS-Ladies-of-London-Hacking-Society/ *** Technology Specific *** Istio London www.meetup.com/Istio-London/ Kubernetes London www.meetup.com/Kubernetes-London/ Threat Modeling www.meetup.com/The-Threat-Modeling-Meetup/ Docker London www.meetup.com/Docker-London/
- 6. SHOUT OUT *** Conferences *** DevSecCon London https://www.devseccon.com/london-2019/ Open Security Summit https://open-security-summit.org/ Bsides London https://www.securitybsides.org.uk/
- 7. DEVSECOPS – LONDON GATHERING ANNIVERSARY EVENT 2019 Date: Wednesday 11th September Venue: Near St Paul’s Speakers so far: • Dr. Helen Thackray Topics: • Rounding up a few vendors to show us how they conduct secure development. • Playing back what hiring has been like the last year. Sponsorship/Support so far:
- 8. DevSecOps – People & Culture • Break down the silo; no change here, just like the original DevOps movement • Not aware of what is going on – likely you are not part of the “DevSecOps” team; leave your ivory tower and build relationships • Conduct a Value Stream Mapping exercise to optimize your delivery (rinse and repeat) • Drill down and sketch out the details of each workflow before solutionising • Try new checks/controls as part of the pipeline
- 9. IDE Static Code Analysis SCM Dynamic Analysis Open Source Software Security Security Testing Framework Binary Repository Define Security Test CasesThreat Modeling Security Standards Automation Tools: Passing Criteria Risk Management Out of Band Security Testing Security Champions DevSecOps Engineer Security Audit Artifacts CI Build Server DevSecOps – Tooling & Assurance Examples (May 2019) curl nmap sslyze sqlmap Interactive Testing Infrastructure Assurance Threat Modeling Container Security
- 10. Dev Workstation Build Server Centralize Report (Vulnerability Management) Server SCM Static Code Analysis (SAST) Dynamic Testing (DAST) Interactive Testing (IAST) Open Source Component Security Manual Penetration Testing – Out of Band Scope: Application and Network layer – White/Black box Defect Management AUTOMATION INTEGRATION POINTS SECURITYASSURANCEMODEL Updated: May 2019 Container Security Infrastructure Scanning