As we embrace DevOps to optimize our Agility, we need to move away from slow, manually intensive processes into more of a continuous flow of software into production. Whether we are doing true “Continuous Deployment” straight to production or not, we no longer have time for slow, manual, late-lifecycle security assessments to determine if our code is going to put us on the front page of the newspaper (for the wrong reasons). What we need is the visibility to know that our code is secure enough to pass muster every day. What we need is continuous security.
The DevSecOps movement is about exactly that: shifting security assessment left and integrating it into the daily and sprint-ly cycles that DevOps has made popular. It means finding those touchpoints in our continuous integration/continuous delivery (CI/CD) pipeline where security tools can be inserted and run continuously against the software changes as they are made. It means using static code analysis, dynamic security testing, secure composition analysis of third party components, and platform vulnerability scanning to look at all aspects of security everyday. It means breaking builds and rejecting changes when developers introduce new security vulnerabilities. It means integrating all this information with the observability tools we are putting in place to continuously monitor the health of our system. In this talk, I present my successes and challenges with integrating security into DevOps pipelines to provide continuous assessment of security posture. I focus on my latest experiences building delivery pipelines for a containerized microservice-based project where we integrated a broad set of open source and commercial tools to gather and present security data.
Specifically, I highlight:
* Touchpoints in your pipeline to asses security during build, deployment, and testing
* Tool categories needed with examples of open-source and commercial options
* Considerations to align tools with “security controls” for compliance
* Data gathering, reporting, and dashboarding to get an easy view of security status and improve the overall observability of the system
* Team structures to encourage collaboration of security engineers with developers
This talk is perfect for people struggling with ways to integrate application security assessment into their Agile development process.
