Protecting Agile Transformation through Secure DevOps (DevSecOps)

Protecting Agile Transformation through
Secure DevOps
Eryk Budi Pratama | Cyber Defense Community (CDEF.id)

Who am I
 Cyber Security & Community Enthusiast, Cyber
Defense Indonesia Community (https://cdef.id/)
 Cyber Security Strategy & Governance, Technical
Assessment, Cloud Security, Emerging Technology,
DevSecOps
 IT Advisory, Audit, Governance, Risk, & Compliance
 Knowledge Hunter
 @proferyk
proferyk@gmail.com

About CDEF.id (https://cdef.id/)
Join Us https://cdef.id/pendaftaran-anggota-komunitas/

The great shift left
Source: KPMG
Forward-looking organizations understand that Agile & DevOps are about
shifting the value stream closer to the business
The shift left focuses quality on solving the
right problems, Using automation, process
improvements, and the business can focus on
the main impacts to the organizations ability to
deliver quality at scale.
“Automation can drive quality,
risk reductions, and speed to
market, and even improve
quality of life for employees.”

Risks of using Agile and DevOps
Lack of documentation
Continuous changes in design
Scaling requires careful management
Dependencies on ‘soft’ controls (i.e.,
team skills, knowledge, communication)
High levels of autonomy across teams
and business units
Inconsistent application of principles driven by
individual experience and/or knowledge.
Design requirements may change over the course of
product development without revisiting security or
control requirements.
Large, cross-functional teams and complex solutions can
cause additional work, not less.
‘Soft’ controls may lead to compliance challenges.
Inconsistent approaches to meeting control
objectives increase the risk of objectives not being
met.

Balancing act of risk and controls
Agile and DevOps methodologies introduce new risks into the control
environment due to the high speed, high volume nature of change.
Source: KPMG

Dev & Sec Challenges
What do DEVELOPERS want? What Does the Security Need?
 Autonomy/Empowerment
 Automate Everything
 Think It, Build It, Run It
 Business Outcome Orientation
 Thin Slice Development/Minimum
Viable Product
 Predictability
 Risk Management
 Innovative Products
 Accuracy and fewer FP/FNs
 Product Security/Supportability
 Accountability

DevOps Activities
Source: Gartner

Shifting Security to the Left means built-in
Security is a Design Constraint
“Apps & data are as safe as
where you put it, what’s in it,
how you inspect it, who talks
to it, and how its protected…”

Security by design in the pipeline and team
Leading organizations are embedding security into everything they do using DevSecOps
SecOps
DevOps
SecDevOps
Security
OperationsDevelopment
The addition of security within DevOps has coined many terms including DevOpsSec, SecDevOps, DevOpsSec.
These terms are generally used to refer to specific activities within the DevOps process. Secure DevOps means
that security is built into the entire
Culture Automation Metrics Sharing
Source: KPMG

Integrating Security into
DevOps

What’s the Secure DevOps Mission?
…creating targeted customer value through
secure iterative innovation at speed & scale …
Security is Everyone’s Job!

Seamlessly Integrating Security in DevOps
Source: Gartner

(Continuous) Security and Risk
 Continuous and adaptive security
decision making
 Continuous and integrated risk
management
 Continuous application security
testing
 Continuous asset, entity and service
discovery
 Continuous authentication
 Continuous authorization
 Continuous compliance
 Continuous data monitoring
 Continuous identity trust
assessment
 Continuous monitoring and visibility
 Continuous protection
 Continuous risk assessment
 Continuous risk discovery
 Continuous risk-prioritized response
 Continuous security posture
assessment
 Continuous trust assessment
 Continuous exposure assessment

Application Security Testing in Pipeline
Source: Gartner

Make Security Guidance Agile Friendly
Source: Gartner
Crafting Effective Agile User Stories for Security Requirements (Example)

The Art of Secure DevOps
Secure DevOps

Secure DevOps Needs
 Active Collaboration
 High Engagement
 Smaller Projects
 Smaller Blast Radius
 Experimentation
 Open Contribution
 Fail Fast Culture
 Ability to adapt and learn
 DevOps Understanding
 Focusing on Simplicity
Can we make it simple? Yes!
 Smaller Teams, Smaller Services, Smaller
Failures
 Customer focus
 Products and Services have security built-in
along the supply chain
 Measurement is built-in to support culture of
Continuous Improvement

How can we get started?
Small Project Migration Big Project
Approach is tailored to small
experiments and pipeline
testing.
Pros:
 Requires DevOps Approach
 Fast failures
 Team learns to collaborate
 Higher Productivity, Less
Waste
Cons:
 Skill shortages
 Team needs vision to avoid
micro-focus churn
Approach allows organization to
map and adjust for what they
already know.
Pros:
 Allows companies to keep
 operating while teams figure
 out what’s needed
Cons:
 Overload
 Can be slower to accomplish
completion
 Failures can become complex
Approach is “all-in” and used to
transform an organization as a
whole.
Pros:
 Firm commitment alleviates
political back and forth
 Focus & All-in Speed
Cons:
 Bigger Failures
 Difficult for everyone to learn
from mistakes and
experiments

Example – Perimeter Testing
PCI DSS1.1.1 –Approve/Test/Detect
firewall changes
Scan API, Ingest Config/Cloudtrail,
trigger firewall audits and revert
unapproved changes to heal to spec
Measure : Certify annually
Impact : High
Labor : 40 hours/Annually
Tools : Excel, Text Pad, Open Source
or Commercial Config Management
Measure : Mean time to Detection,
Mean time to Resolve
Impact : Depends on Resource
Labor : 40 hours/First Year, 8 hours per
yr maintain
Tools : APIs, Logs, Open Source,
Commercial

Example – Configuration Management
PCI DSS2.2 -Develop & Assure
configuration standards for all system
components.
Track known good CF stacks & AMIs,
alert or neutralize non-
compliant/non-approved deploys
Measure : Certify annually
Impact : High
Labor : 40 hours/Annually/Per
Major Component
Tools : Excel, Text Pad, Open Source
or Commercial Config Management
Measure : Mean time to Detection,
Mean time to Resolve
Impact : High
Labor : 40 hours/First Year, 1 hour per
yr maintain/Per Component
Tools : APIs, Logs, Open Source,
Commercial

Case Study
to assist the Enhanced Data Security Program, and as part of
that effort, began an initiative to “identify opportunities to
enhance the Security Integration into DevOps”

Problems
Teams are using EAL as
their source of truth,
even though they know it
to be incomplete and
inaccurate
Teams consistently
expressed interest in
security, but don’t have
a good outlet to learn
and ask questions
Across the SDLC there are
controls without
guidelines, which leaves
security implementation
up to individual
application teams
Teams have asked for
secure code training,
and there is currently
no vehicle to deliver it
All enterprise projects
have security
requirements, but
smaller and legacy
projects do not undergo
the same scrutiny
Physical asset
management is good,
but they are far from
managing applications
and services correctly

Key Themes
There is an unmet desire for security awareness among DevOps
teams.
Risk-based security scrutiny of applications and services is
inconsistent.
Developers have a hard time knowing what security work to do.
1
2
3

Recommendation - Program-level Enablers
To support significant risk reduction across the SDLC process and the broader enterprise, Client was recommended to
pursue further improvement of the following programs:
Key Theme Recommendation Description
There is an unmet desire for
security awareness among
DevOps teams.
Security
Champions
A structured program to assign one leader to a small group of developers to oversee
and drive security integration into development.
Risk-based security scrutiny
of applications and services
is inconsistent.
Asset
Management
There is a process for maintaining up-to-date records for all application related assets
(products, servers, APIs etc.) across the organization. This process should account for
onboarding of newly created assets, ownership assignment, and for regular updates to
existing assets.
Developers have a hard time
knowing what security work
to do.
Security & Privacy
Requirements
Management
There is a program focused on including security and privacy requirements as a
forethought for each new project, application, and service.

Recommendation - Tactical
Client pursue implementation of the following prioritized security controls across the SDLC.
Key Theme SDLC Controls Description
Available security
capabilities are not
consistently
adopted across
DevOps teams.
IDE Scanning of
Code
Code security is analyzed locally and reports are generated to provide
developers with real-time feedback throughout coding.
DAST
Dynamic security tests are run after code pushes to check for runtime
vulnerabilities.
SAST
Static security tests are run after code pushes to detect coding errors.
Security Test Case
Creation
Developers must create automated and reusable test cases that address
the requirements of Security Department provided security user stories.
Advanced Security
Code Review
Security sensitive code that involves the use of cryptography,
authentication, and authorization, must be reviewed by an approved party
within Security Department .

Collect feedback to
continually improve and
update the control’s
solution based on user
suggestions and changes
in demand.
Implementation Roadmap
Each security control’s implementation will follow a unique roadmap, but the overall approach remains the same:
Assign an owner to the
security control who will
oversee functionality,
answer questions, and
assist users.
1
Define KPIs that will
measure the control’s
success criteria and elicit
the reporting frequency.
2
Procure and deploy a
solution that can
demonstrably meet the
requirements of the
control.
3
Distribute messaging
about the control’s
purpose, how to
leverage it, and who to
contact for questions
and concerns.
4 5

Turning DevOps Into Secure DevOps
… it’s all about maintaining agility for developers
… without getting in the way

Protecting Agile Transformation through Secure DevOps (DevSecOps)

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Protecting Agile Transformation through Secure DevOps (DevSecOps)

Similar to Protecting Agile Transformation through Secure DevOps (DevSecOps) (20)

More from Eryk Budi Pratama

More from Eryk Budi Pratama (20)

Recently uploaded

Recently uploaded (20)

Protecting Agile Transformation through Secure DevOps (DevSecOps)