Seven Deadly Saves To Security With Integrations
- 1. © 2017 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.1 DEVSECOPS
- 2. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.2 Who are we? Tim Jarrett (@tojarrett) • Over 20 years in software: development, project management, product management & strategy • At Veracode since 2008 • Grammy award winner, Bacon number of 3 Diptesh Shah • Over 15 years experience as a developer and engineering leader • At Veracode since 2017 • Recent Winter Olympics “swept” me into Curling
- 3. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.3 © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES Why appsec integrations?
- 4. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.4 • Continuous Delivery • Shorten feedback loops • Learn quickly DevSecOps: the end of manual security?
- 5. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.5 Fix earlier = fix cheaper 0 20 40 60 80 100 120 Design Implementation Testing Maintenance Source: IBM,based on Boehm, 1981/2001
- 6. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.6 Avoid rework Code Ship Discover issue Fix and ship again Development process – current state Code Discover issue Fix issue Ship Development process with integrations
- 7. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.7 Avoid context switching
- 8. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.8 © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES
- 9. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.9 DevSecOps – Follow the Code
- 10. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.10 Code phase 1 Develop 2 Check in Team processes (build, test, agile planning)
- 11. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.11 Build phase 1 Get latest check-ins from source control 2 Build and Run Tests Test Failures 3 Stage/ Deploy
- 12. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.12 Deploy and Production phase Deployment pipeline Stage/ Deploy Monitor for Incidents Scan for issues in production
- 13. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.13 Different development methodologies = different integration approaches Waterfall Agile DevOps 1-4 Releases Per Year 12-24 Releases Per Year 100+ Releases Per Year 50+ people 6-12 people 6-12 people
- 14. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.14 1 Develop 4 Check in Static Analysis 3 Build & Test 2 Backlog (tickets) Waterfall to agile: “build and test” Pass? 7 Synchronize No Yes 6 Static Analysis 6 Unit Tests Manual acceptance testing, move to stage, move to prod Nightly/ weekly 5 Build Scheduled Build 3a Manual Testing*
- 15. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.15 CI CD 1 Develop 4 Check in Static Analysis 3 Build & Test 2 Backlog DevOps: Protect the Pipeline Pass? 7 Synchronize No Yes 7 Deploy to QA/Stage 6 Static Analysis 6 Unit Tests 8 Dynamic Analysis 8 Regression Testing Pass? Yes Stage then Prod Per Check-in 5 Build CI/CD Pipeline 1a Static Analysis
- 16. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.16 © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES
- 17. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.17 Veracode Integrations Team Focused on delivering integration capabilities with the Veracode platform that enable development teams to “shift security left” and make the idea of “DevSecOps” a reality. • 12 person team; geographically distributed • Responsible for 20+ applications & supporting modules • 75 releases in 2017 (on pace for 144 releases in 2018) • SAFe / Agile Scrum • DevSecOps (evolution continues) • Vested interest in achieving our mission!!
- 18. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.18 In The Beginning 3 Build 4 Static Analysis 5 Security Results 2 Check in 1 Develop Backlog Scheduled Build Nightly/ weekly
- 19. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.19 Initially Fast Forward to Now Empower Developers – IDE Integration 1 Develop 4 Check in Sandbox Static Analysis 3 Build & Test 2 1 Develop 4 Check in Sandbox Static Analysis 3 Build & Test 2 1a Greenlight Static Analysis
- 20. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.20 1 Develop 4 Check in Sandbox Static Analysis 3 Build & Test 2 Automated Assessment – Build Server Integration 6 Static Analysis Nightly/ weekly 5 Build Scheduled Build 1a Greenlight Static Analysis Security Results 7
- 21. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.21 1 Develop 4 Check in Sandbox Static Analysis 3 Build & Test 2 Automated Issue Tracking Nightly/ weekly Scheduled Build 1a Greenlight Static Analysis 6 Static Analysis 5 Build 7 Synchronize
- 22. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.22 1 Develop 4 Check in Sandbox Static Analysis 3 Build & Test 2 Automated Assurance – Fail the Build Pass? 7 Synchronize No Yes 6 Static Analysis 6 Unit Tests Manual acceptance testing, move to stage, move to prod Nightly/ weekly 5 Build Scheduled Build 1a Greenlight Static Analysis
- 23. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.23 CI CD 1 Develop 4 Check in Sandbox Static Analysis 3 Build & Test 2 Continued Assurance Pass? 7 Synchronize No Yes 7 Deploy to QA/Stage 6 Static Analysis 6 Unit Tests Per Check-in 5 Build CI/CD Pipeline 1a Greenlight Static Analysis Manual acceptance testing, move to stage, move to prod
- 24. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.24 CI CD 1 Develop 4 Check in Sandbox Static Analysis 3 Build & Test 2 Continued Assurance – End Goal Pass? 7 Synchronize No Yes 7 Deploy to QA/Stage 6 Static Analysis 6 Unit Tests 8 Dynamic Analysis 8 Regression Testing Pass? Yes Stage then Prod Per Check-in 5 Build CI/CD Pipeline 1a Greenlight Static Analysis
- 25. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.25 © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES Making it happen
- 26. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.26 Relationships • Who is your peer in development / security? • Do you meet with them? • Do you understand each others’ goals? • Are you sympathetic to each others struggles?
- 27. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.27 Accountability • Shared between development and security • Part of annual goals for both teams • Measured and reported regularly
- 28. © 2018 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.28 Plan Code Build Test Stage Deploy Monitor Shift Left & Monitor Dynamic Application Security Testing Runtime Application Self Protection Open Source Risk MonitoringStatic Application Security Testing + 3rd Party Risk Analysis Training (eLearning, instructor led, metadata driven) Manual Penetration Testing Red Team Activities Remediation and Mitigation Guidance Secure Code Reviews Threat Modeling Security Grooming Secure Design
- 29. © 2017 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.29 © 2017 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES. Questions? @tojarrett