Download as PDF, PPTX
devsecops-reference-architectures-2018.pdf
- 1. DevSecOps Reference Architectures Derek E.Weeks VP and DevOps Advocate Sonatype 2018
- 2. About this collection 1. Thereference architectures can be used to validate choices you have made or are planning to make. 2. They are curated from the community. You will notice a number of common elements that are used repeatedly. 3. Each image has a link to its original source in the speaker notes, enabling you to deep dive for more knowledge. If you would like to have your reference architecture added to this deck, please send it to [email protected].
- 3. Integration Points andDegree of Automation DevSecOpsTooling Design Development (IDE) Repository Manager CI/CD Post-Deployment Open source governance Open source software analysis n/a Static Application Security Testing (SAST) n/a Dynamic Application Security Testing (DAST) n/a n/a n/a Interactive Application Security Testing (IAST) n/a n/a n/a Mobile Application Security Testing (MAST) n/a n/a Run-time Application Self Protection (RASP) n/a n/a n/a Container and Infrastructure Security n/a Source: Gartner, December 2017, Structuring Application Security Practices and Tools to Support DevOps and DevSecOps Degrees of DevSecOps Automation
- 4. Common Elements ofa DevSecOps Pipeline
- 5. DevSecOps according toU.S. Dept of Defense/JIDO Source: ADDO ‘17 “Governance and Transparency in GovSec DevOps: Leonel Garciga”
- 6. DevSecOps according toMagno Rodrigues Source: Stefan Streichsbier Linked in Slides “DevSecOps - The big picture”
- 7. DevSecOps according toCarnegie Mellon’s SEI Source: Derek Weeks, DZone “From Water-Scrum-Fall to DevSecOps”
- 8. DevSecOps according to Jim Bird Source:Jim Bird, O’Reilly “DevOpsSec: Securing Software through Continuous Delivery”
- 9. DevSecOps according toLarry Maccherone Source: Larry Maccherone @Lmaccherone, Twitter “Annotated DevSecOps cycle”
- 10. DevSecOps according toSteve Springett Source: Steve Springett, GitHub “Dependency-Track”
- 11. DevSecOps according toTeachEra Source: Mohammad Imran, Linked in “Practical DevSecOps Course - Part 1”
- 12. Learn More From Your Peers 21DevSecOps practitioners from leading enterprises to shared their experiences and best practices. All 21 recordings are available for free at www.alldaydevops.com.
- 13. DevSecOps according toCoveros Source: Alan Crouch, Coveros “Implementing the DevSecOps Process”
- 14. DevSecOps according toAaron Weaver Source: Stefan Streichsbier Linked in “DevSecOps - The big picture”
- 15. DevSecOps according toDr. Ravi Rajamiyer Source: Dr. Ravi Rajamiyer, DevOps Summit Journal “When “IoC” meets “SoC’”
- 16. DevSecOps according toACROSEC Source: Derek Weeks, Acrosec “Three important elements of Application Security: "Shift Left", "Security by Design" and "DevSecOps’”
- 17. DevSecOps according toRanger4 Source: Helen Beal, Linked in “DevSecOps is it a Good Thing”
- 18. DevSecOps according toAWS @IanMmmm Source: Ian Massingham, @IanMmmm, Linked In “Securing Systems at Cloud Scale with DevSecOps”
- 19. DevSecOps according toAWS Source: Priyanka Aash, Linked In “DevSecOps in Baby Steps”
- 20. DevSecOps according toAccenture Source: ADDO’17, YouTube “DevOps in Secure Environments: Strategies for Success: Dominic Delmolino”
- 21. DevSecOps according toShine Solutions Source: Archi Gunasekara, Shine Solutions “The Emmergence of the three towers:DecSecOps”
- 22. DevSecOps according toEllucian Source: Mohammad Imran, Linked in “Practical DevSecOps Course - Part 1”
- 23. DevSecOps according toWhiteHat Security Source: White Hat Security “Take Control Design a complete DevOps Program”
- 24. DevSecOps according toGSA Source: Tech at GSA “Building DevSecOps Culture”
- 25. DevSecOps according toSense of Security Source: ADDO’17, Youtube “DevOps: A How-To for Agility with Security: Murray Goldschmidt”
- 26. We would loveto add your DevSecOps reference architecture to this deck. How? 1. Send it to me ([email protected]), with the subject line: DevSecOps reference architecture. 2. Provide me link as to where people can find more information about the architecture (e.g., your blog, a video, a SlideShare deck). 3. I’ll add it to this deck with full attribution to you, and let you know that it’s been updated. It’s that easy. We all learn with help from the community. Thank you for your contributions!
- 27. About the Author Derek Weeks VPand DevOps Advocate, Sonatype Derek is a huge advocate of applying proven supply chain management principles into DevOps practices to improve efficiencies and sustain long-lasting competitive advantages. He currently serves as vice president and DevOps advocate at Sonatype, creators of the Nexus repository manager and the global leader in solutions for software supply chain automation. Derek is also the co-founder of All Day DevOps -- an online community of 40,000 IT professionals, and the lead researcher behind the annual State of the Software Supply Chain report for the DevOps industry. In 2018, Derek was recognized by DevOps.com as the“Best DevOps Evangelist”for his work in the community.