Download as PDF, PPTX
Uploaded byDevSecCon
Why does security matter for devops by Caroline Wong
This document discusses why security matters for DevOps. It begins by introducing the speaker and intended audience. It then explains how the role of security is changing from protecting the perimeter to addressing risks from vendors and mobile endpoints. Security matters for DevOps because major companies have experienced high-profile data breaches, which hurt sales, acquisition, press, and compliance. The document outlines the NIST Cybersecurity Framework approach of identifying, preventing, detecting, responding to, and recovering from incidents. It emphasizes that security for DevOps must be business-driven, on-demand to fit the DevOps toolchain, and built on a culture of trust.
More Related Content
Similar to Why does security matter for devops by Caroline Wong
![Governance, Deployment & Methodologies for Agentic Automation [2/3]](https://cdn.slidesharecdn.com/ss_thumbnails/agenticcommunityseries-day2-251112135038-a386476d-thumbnail.jpg?width=640&height=640&fit=bounds)
Why does security matter for devops by Caroline Wong
- 1. Why does Security matterfor DevOps? Caroline Wong, CISSP Vice President of Security Strategy, Cobalt www.cobalt.io
- 2. About Me B.S. inElectrical Engineering and Computer Sciences (U.C. Berkeley) 12 years in Information Security ● Security practitioner at eBay, Zynga ● Product manager at Symantec ● Consultant at Cigital (acquired by Synopsys) Joined Cobalt.io in 2016
- 3. About Me /About You In the room, ● Engineers ● Security ● Doing DevOps today ○ Born DevOps ○ Became DevOps ● Thinking about doing DevOps
- 4. Agenda ● Why doesDevOps matter? ● The changing role of Security ● Why Security matters ● What to do about it ● Key Takeaways
- 5. First things first-- Why does DevOps matter?
- 6. Businesses do whatthey need to do to survive and succeed. If their customers need agility then they will evolve to accommodate that.
- 7. 27% Percentage of organizationsthat have made the switch to DevOps, according to the 2017 State of DevOps Report
- 8. How is therole of Security changing?
- 9. Then ● Protect thePerimeter ● SDLC Gates ● On-premise Data Center and Workforce
- 10. Now ● Vendor Risk(goes both ways) ● Apps and APIs ● Mobile Workforce Endpoints
- 11. Why do youthink Security matters for DevOps?
- 13.
- 14.
- 15.
- 16.
- 17.
- 18.
- 19.
- 20.
- 21.
- 22.
- 23. Why does Securitymatter for DevOps? Sales / Acquisition
- 24. Why does Securitymatter for DevOps? Sales / Acquisition Press
- 25. Why does Securitymatter for DevOps? Sales / Acquisition Press Compliance
- 28. It’s all aboutthe $$$
- 29. So… what todo?
- 32.
- 35.
- 37.
- 39. Security for DevOps It’sabout preventing unplanned work and rework. It’s also about trust. “Super Tribe”
- 40. NIST Cybersecurity Framework 1.Identify 2. Prevent 3. Detect 4. Respond 5. Recover
- 41.
- 42. 1. Identify ● Learnthe business ○ Learn the DevOps tool chain ○ Understand what functions are critical ● Eliminate scope where you can ● Supply chain management Identify Prevent Re spo nd Re cov er Det ect
- 43. 2. Prevent ● Attack-drivenawareness ○ Learn from the past ● Policy and procedures ○ E.g. change management and secret management ● Reduce technical debt ○ Vendor patches and updates ● On-demand security testing Identify Prevent Re spo nd Re cov er Det ect
- 44. 3. Detect, Respond,Recover Detect ● Logging, monitoring, alerting Respond ● Incident response planning ○ Supply chain considerations Recover ● Post mortem ● Lessons learned Identify Prevent Re spo nd Re cov er Det ect
- 45. Key Takeaways Security forDevOps must be: ● Business driven ○ Understand business risks and tradeoffs ○ Supply chain (both ways) ○ Scoping matters ● On-demand ○ DevOps toolchain (Slack, GitHub, JIRA, etc.) ○ But manual still matters ● Built to fit a culture of trust ○ Real not theoretical ○ Valid not false positive ○ Trust but verify Resources and References ● The Phoenix Project (novel) ● Enabling DevOps: A Security Imperative (podcast) ● 2017 State of DevOps ● DZone’s Guide to Automated Testing ● NIST Cybersecurity Framework ● Special thanks to Mike Shema, Esben Friis-Jensen, Christian Hansen, and Cameron Clifford