S360 2015 dev_secops_program

Celebrating a decade
of guiding security
professionals.
@Secure360 or www.Secure360.org
Establishing a DevSecOps
Program
Shannon Lietz
DevSecOps Leader &
Sr. Mgr Cloud Security Engineering at Intuit

of guiding security
professionals.
Who I am
• 25+ years Technology and
Security Experience
• Background in Security R&D
• Working with the Cloud before
it was called the “Cloud”
• Manage my teams using
DevOps and Scrum
• IR & Crisis Management
-- FOUNDER --

of guiding security
professionals.
How was DevSecOps discovered?
Securing at the rate of Innovation…
• Pain
• Trial & Error
• Blood, sweat & tears
• Ouch, my head hurts!
It would have been great to hear this talk a couple years ago….
Bang
Head
Here

of guiding security
professionals.
Case for Change
• DevOps, Agile and Scrum on the rise…
• Workload migrations to software defined environments….
• Enterprises increasingly turning to Public and Private Cloud
Providers…
• Talent migrating to progressive companies willing to
embrace change…
• Start-ups now have game changing capabilities available
for rent… Public Cloud
• Competitive landscape has been changing…

of guiding security
professionals.
What is DevSecOps?
Problem Statement
• DevOps requires continuous Deployments
• Fast decision making is critical to DevOps success
• Traditional Security just doesn’t scale or move fast enough…
Welcome DevSecOps!!
• Customer focused Mindset
• Scale, Scale, Scale
• Objective Criteria
• Proactive Hunting
• Continuous Detection & Response

of guiding security
professionals.
Emerging Security Trends
• Shortage of Security Professionals
• Big companies are attempting to scale security to move
faster: Facebook, Netflix, LinkedIn, AWS, Intuit
• Industry Leaders talking about the integration of DevOps
& Security: Joe Sullivan, Jason Chan, Gene Kim, Josh
Corman
• Introduction of DevSecOps at MIRCon in 2014
• SecDevOps at RSA 2015 was full day of dedicated content
• LinkedIn People Search: 8 DevSecOps, 7 SecDevOps, 7
DevOpsSec, 29k+ Cloud Security

of guiding security
professionals.
The Art of DevSecOps
DevSecOps
Security
Engineering
Experiment,
Automate,
Test
Security
Operations
Hunt,
Detect,
Contain
Compliance
Operations
Respond,
Manage,
Train
Security
Science
Learn,
Measure,
Forecast

of guiding security
professionals.
Getting Started
Some basic principles:
• You don’t need to do all of DevSecOps at once.
• Small security teams can have a profound impact.
• Organize around self-service.
• Figure out how to communicate security for the
layperson.

of guiding security
professionals.
Path to DevSecOps
Security as
Code?
Experiment:
Automate
Policy
Governance
Security
Operations?
Experiment:
Detection via
Security
Operations
Experiment:
Compliance via
DevSecOps
toolkit
Experiment:
Science via
Profiling
DevOps +
Security
DevOps +
DevSecOps
Compliance
Operations?
Science?
Start
Here?

of guiding security
professionals.
The DevSecOps Mindset
• Customer Focus
• Open & Transparent
• Iteration over Perfection
• Hunting over Reaction
• Hmmm - wait a minute, this sounds like a
manifesto -> insert shameless plug here:
http://www.devsecops.org

of guiding security
professionals.
What’s the Work of a DevSecOps Team?
Imagine that you will need to support all facets of
security inline with development teams and at speed…
• Do you have enough security experts to embed
resources in DevOps teams?
• Have you got amazing talent that would rather hunt
for Security defects than create value?
• Are you ready to invest in Self-Service for Security?
• Are you working with a Cloud environment and can
your team code?

of guiding security
professionals.
Ready to make these decisions?
On-Prem Partial On-Prem
Outsource w/ No
Indemnif.
Outsource w/
Part.Indemnif.
Outsource w/
Full Indemnif.
Who is responsible?
INTERNAL
You You You You + Partner Partner
PARTNERS
Which minimal
controls are needed?
Physical Security;
Secure Handling &
Disposal
File or Object
Encryption for
Sensitive Data;
Physical Security;
Secure Handling &
Disposal
File or Object
Encryption for
Sensitive Data;
Partner Security;
SOC Attestation
File or Object
Encryption for
Sensitive Data;
Partner Security;
SOC Attestation
Partner Security
Controls; SOC
Attestation
Where does data
transit and get stored?
company “owned”
data center or co-
location
any compute &
transit; data stored
on-prem
public cloud; free
services
SaaS; public cloud;
free services;
private cloud
managed services;
SaaS; private cloud
What are the
innovation benefits?
reduced latency;
search sensitive
data
speed; reduced
friction; search
sensitive data
speed; reduced
friction; evolving
patterns;
community
speed; reduced
friction; evolving
patterns;
community
speed; reduced
friction;
indemnification
What are the potential
risks?
SQL Injection;
Internal Threats;
Mistakes; Phishing;
Increased Friction;
Slow
Latency; SQL
Injection; Internal
Threats; Mistakes;
Phishing; Increased
Friction; Slow
Inability to Search
Sensitive Data; SQL
Injection; Internal
Threats; Mistakes;
Phishing; Govt.
Requests Unknown;
Reduced Financial
responsibility
Inability to Search
Sensitive Data; SQL
Injection; Internal
Threats; Mistakes;
Phishing; Govt.
Requests Unknown
Inability to Search
Sensitive Data; SQL
Injection; Internal
Threats; Mistakes;
Phishing; Govt.
Requests Unknown

of guiding security
professionals.
Or set up “policies” that look like this…
{
"Version": "2015-05-09",
"Statement": {
"Effect": "Allow",
"Action": [
"iam:ChangePassword",
"iam:GetAccountPasswordPolicy"
],
"Resource": "*"
}
}

of guiding security
professionals.
And how do you hunt for security issues
in software defined environments?

of guiding security
professionals.
Can you communicate security
complexity using simple processes?
1Discover
2Evaluate
3Control
4Communicate

of guiding security
professionals.
More importantly, how do you
translate?
begin
(iam.client.list_role_policies(:role_name => role)[:policy_names]
- roledb.list_policies(role)).each do |policy|
log.warn("Deleting Policy "#{policy}", which is not part of the approved baseline.")
if policydiff("{}",
URI.decode(iam.client.get_role_policy(
:role_name => role,
:policy_name => policy
)[:policy_document]),
{:argv => ARGV, :diff => options.diff})
end
options.dryrun ? nil :
iam.client.delete_role_policy(
:role_name => role,
:policy_name => policy
)
end
Account Grade:
BHeal Account?

of guiding security
professionals.
Consider the DevSecOps Approach:
Incident Drive Development (IDD)
• Share your Security Tools within everyone in your
organization
• Everything is an incident, how you deal with it is a
matter of priority and severity
• Running campaigns & internal bounty programs,
consider giving out t-shirts
• Use your security experts as scientists
• Keep Investigations separate

of guiding security
professionals.
Your environment should look
something like this…
insights
security
sciencesecurity
tools & data
AWS
accounts
S3
Glacier
EC2
CloudTrail
ingestion
threat intel

of guiding security
professionals.
And your team will need to operate
like this…
Central Account
(Trusted)
Admin
IAM IAMIAM IAM IAM IAM
BU Accounts (Trusting)
SecRole SecRole SecRole SecRole SecRole SecRole
IAM
How did we decide which roles would be deployed?
• Human
• IAM Admin
• Incident Response
• Read Only
• Services
• IAM Grantor
• Instance Roles required to support security
services
• Read Only

of guiding security
professionals.
It’s not easy but it can make a
difference…
• Security stops being the reason nothing gets
done.
• Everyone in your organization is responsible
for security.
• Security can be a differentiator in most
organizations and leads to its own innovation
discovery

of guiding security
professionals.
Vendors embracing DevSecOps
• AWS
• TAP by Mandiant
• SumoLogic
• Splunk
• OpenDNS
• Evident.io
• AlertLogic
• Tanium
• Outlier Security
• Continuum Security

of guiding security
professionals.
Resources
• http://www.devsecops.org
• @devsecops
• LinkedIn Group: DevSecOps
• Github: DevSecOps
• shannon@devsecops.org

S360 2015 dev_secops_program

More Related Content

What's hot

Viewers also liked

Similar to S360 2015 dev_secops_program

Recently uploaded

S360 2015 dev_secops_program

Editor's Notes