From DevOps to DevSecOps: 2 Dimensions of Security for DevOps
2 likes1,812 views
This document discusses security considerations for DevOps enterprises transitioning to DevSecOps. It identifies three dimensions of security: 1) securing the perimeter, 2) securing the delivery pipeline, and 3) securing deliverables. For the delivery pipeline, it notes vulnerabilities related to supply chains, insider attacks, errors in development, and weaknesses in design/code/integration. It emphasizes applying security practices throughout the development lifecycle, from coding through deployment. The document provides references for further reading on DevOps security best practices.
From DevOps to DevSecOps: 2 Dimensions of Security for DevOps
- 2. #WhoAmI • 20+ Years in Software Development and Delivery • IBM’s Client-facing CTO for DevOps • Author: DevOps For Dummies - http://ibm.co/devopsfordum mies • Write DevOps and Cloud Adoption Blog: http://bit.ly/sdarchitect
- 5. DevOps approach: Apply Lean principles accelerate feedback and improve time to value 5 People Process Line-of- business Customer 1 3 2 1. Get ideas into production fast 2. Get people to use it 3. Get feedback Continuously Improve: I. Application Delivered II. Environment Deployed III. Application and Environment Delivery Process
- 6. Delivering a Business Capability: Multi-Speed IT Development SCM Build Package Repo Deploy Development SCM Build Package Repo Deploy Development SCM Build Package Repo Deploy Development SCM Build Package Repo Deploy Test Stage Production Application N Application C Application B Application A Enterprise Release Agile/Innovation Edge Rapid Delivery for Innovation • Agile • Antifragile • Experimentation • New and Innovative • Hybrid Cloud • PaaS Industrialized Core Deliver at regular cadence • Waterfall -> Agile • Stability • Predictability • Lean Delivery pipeline • Core and Legacy Hybrid Infrastructure – Physical, Cloud • IaaS/PaaS Business Capability
- 8. Three (Two) Dimensions of Security 8 1. Secure the Perimeter 2. Secure the Delivery Pipeline 3. Secure the Deliverable http://www.ibm.com/developerworks/library/d-security- considerations-devops-adoption/
- 10. 2. Secure the Delivery Pipeline 10 Secure Engineering Patch ManagementSecure Build and Deploy Availability and Business ContinuitySeparation of Duties Security Evaluation and Learning Development SCM Build Package Repo Deploy Testing Staging Production FeedbackPlanning Manage
- 11. 3. Secure the Deliverable 11 Application Middleware Config Middleware OS Config Hardware FullStack Blueprint Policies Secure: • Code • Scripts • Packages • Components • Configurations • Content • Policies • Roles Development SCM Build Package Repo Deploy Testing Staging Production FeedbackPlanning Manage
- 12. Risks and Vulnerabilities - Delivery Pipeline and Deliverables 12 1. Vulnerabilities related to the supply chain 2. Insider attacks 3. Errors and mistakes in the development project 4. Weaknesses in the design, code, and integration 5. API Economy and Security http://www.ibm.com/developerworks/library/d-security- considerations-devops-adoption/
- 13. Vulnerabilities related to the supply chain 13 External Supplier A External Supplier B Internal Supplier A Internal Supplier B Development SCM Build Package Repo Deploy Testing Staging Production FeedbackPlanning Manage
- 15. Errors and mistakes in the development project 15 1 per min 1 per min 4 per min 1 per min 4 per min 4 per min • Reduced Batch size • Continuous Validation: – Continuous Security Testing – Testing small batches in every Sprint • Antifragile Systems – Servers are ‘cattle’ not ‘pets’ – MTBF vs MTTR
- 18. The API economy and security: Implementation 18https://developer.ibm.com/architecture/gallery/APImanagement 1. API Key management 2. API provider/consumer Identity Management 3. API Access control 4. API Usage management/throttling 5. API Security Incident Monitoring 6. API Logging and audit trail
- 23. Mapping your Delivery Pipeline Idea/Feature/Bug Fix/ Enhancement Production Development Build QA SIT UAT Prod PMO Requirements/ Analyst Developer CustomersLine of Business Build Engineer QA Team Integration Tester User/Tester Operations Artifact Repository Deployment Engineer Release Management Code Repository Deploy Get Feedback Infrastructure as Code/ Cloud Patterns Feedback Customer or Customer Surrogate Metrics - Reporting/Dashboarding Tasks Artifacts
- 24. DevOps Innovation Workshop 24 Review the current state 1. Business goals, IT goals, current initiatives 2. DevOps 3. Requirements 4. Environments 5. Repositories 6. Roles / Organization 7. Metrics 8. Security Prioritize challenges to be resolved Create a first pass at an improvement roadmap The whiteboard
- 25. Questions? 25