Security Process in DevSecOps
0 likes916 views
The document discusses security processes in DevSecOps. It outlines how security can be automated and shifted left through the development pipeline. Key stages discussed are the precommit stage, acceptance stage, and production stage. At the precommit stage, tools like static application security testing, software composition analysis, and container scanning are used. The acceptance stage utilizes dynamic testing like penetration testing and vulnerability assessments. For production, automation security baselines, runtime protections, and monitoring are recommended. Automating security helps focus on agility while still maintaining security.
Security Process in DevSecOps
- 1. Security Process in Jirayut Nimsaeng (Dear) CEO & Founder, Opsta (Thailand) Co.,Ltd. TechTalkThai Conference: Enterprise Cybersecurity 2021 October 5, 2021 https://bit.ly/opsta-ttt-sec-in-devops
- 2. Security Process in DevSecOps #whoami Jirayut Nimsaeng (Dear) Jirayut has been involved in DevSecOps, Container, Cloud Technology and Open Source for over 10 years. He has experienced and succeeded in transforming several companies to deliver greater values and be more agile. ● He is Founder and CEO of Opsta (Thailand) Co.,Ltd. ● He is Cloud/DevSecOps Transformation Consultant and Solution Architecture ● He is the first Certified Kubernetes Security Specialist (CKS) and Certified Kubernetes Administrator (CKA) in Thailand
- 3. Security Process in DevSecOps Agenda ● Automation Security ● Precommit Stage ● Acceptance Stage ● Production Stage ● Wrap Up
- 4. Security Process in DevSecOps Security Process in Automation Security
- 5. Security Process in DevSecOps DevOps Flow Infrastructure Support Tools VCS Artifacts CI CD Dev Test Prod Monitoring Load Testing Automation & Infrastructure as Code Developer Operation & SRE Communication Security Security
- 6. Security Process in DevSecOps DevSecOps Flow Infrastructure Support Tools VCS Artifacts CI CD Dev Test Prod Monitoring Load Testing Automation & Infrastructure as Code Developer Operation & SRE Security Communication Security Shift Left with Automation
- 7. Security Process in DevSecOps Automation Security Infrastructure Support Tools VCS Artifacts CI CD Dev Test Prod Monitoring Load Testing Automation & Infrastructure as Code Developer Operation & SRE Security Automation Security Communication
- 8. Security Process in DevSecOps Security Automation in every steps Secure Coding SAST SCA Vulnerability Assessment Penetration Testing IAST Compliance Validation Threat Intelligence Secret Manager DAST Binary Analysis Threat Modelling SOC SOAR
- 9. Security Process in DevSecOps Automation Security Tools Code Build Secret Test Release Runtime Monitor Multi-purpose Commercial
- 10. Security Process in DevSecOps Security Stages on DevOps Flow Code Build Secret Test Release Runtime Monitor Precommit Stage Acceptance Stage Production Stage
- 11. Security Process in DevSecOps Security Process in Automation Security: Precommit Stage
- 12. Security Process in DevSecOps Secure Coding Secure coding is the practice of writing software that's protected from vulnerabilities. Some examples below refer from OWASP Secure Coding Practices ● Input Validation ● Authentication and Password Management ● Session Management ● Access Control ● Cryptographic Practices ● Error Handling and Logging ● Communication Security ● and much more...
- 13. Security Process in DevSecOps SAST (Static Application Security Testing) SAST is a testing methodology that analyzes source code to find security vulnerabilities. SAST scans an application before the code is compiled. It’s also known as white box testing.
- 14. Security Process in DevSecOps SAST (Static Application Security Testing)
- 15. Security Process in DevSecOps SCA (Software Composition Analysis) SCA scans source code to inventory all open-source components to eliminate vulnerabilities those listed in the National Vulnerability Database (NVD) and compatibility issues with open-source licenses.
- 16. Security Process in DevSecOps SCA (Software Composition Analysis)
- 17. Security Process in DevSecOps Security Process in Automation Security: Acceptance Stage
- 18. Security Process in DevSecOps Software Security Testing (1) Software security testing is the process of assessing and testing a system to discover security risks and vulnerabilities of the system and its data. ● Penetration Testing - The system undergoes analysis and attack from simulated malicious attackers. ● Fuzz Testing - is a brute-force reliability testing technique wherein you create and inject random data into a file or API in order to intentionally cause errors and then see what happens
- 19. Security Process in DevSecOps Software Security Testing (2) ● Vulnerability Assessment - The system is scanned and analyzed for security issues. ● DAST (Dynamic Application Security Testing) tools automate security tests for a variety of real-world threats. DAST is a black-box testing method to identify vulnerabilities in their applications from an external perspective to better simulate threats most easily accessed by hackers outside their organization
- 20. Security Process in DevSecOps VA Scan and DAST
- 21. Security Process in DevSecOps IAST (Interactive Application Security Testing) IAST instruments applications by deploying agents and sensors in running applications and continuously analyzing all application interactions initiated by manual tests, automated tests, or a combination of both to identify vulnerabilities in real time
- 22. Security Process in DevSecOps IAST (Interactive Application Security Testing)
- 23. Security Process in DevSecOps Infrastructure as Code (IaC) Security IaC Security test and monitor your infrastructure as code such as Ansible, Terraform modules and Kubernetes YAML, JSON, and Helm charts to detect configuration issues that could open your deployments to attack and malicious behavior.
- 24. Security Process in DevSecOps Kubernetes Security ● Kubernetes Certificates ● Secret ● Network Policy ● Namespace ● Quota ● TLS Ingress Endpoint ● Secure Node Metadata ● CIS Benchmark ● Verify Platform Binary ● Harden Docker Image ● Image Policy Webhook ● Immutability ● RBAC ● Secure Service Account ● Secure API Endpoint ● Admission Controller ● Node Restriction ● Runtime Sandbox ● Non-Root Container ● Security Context ● Pod Security Policy ● Open Policy Agent ● Auditing
- 25. Security Process in DevSecOps Container Image Security Container security software is used to secure multiple components of containerized applications or files, along with their infrastructure and connected networks. Testing capabilities will assist in developing security policies, discover zero-day vulnerabilities, and simulate attacks from common threat sources.
- 26. Security Process in DevSecOps Container Image Security
- 27. Security Process in DevSecOps Signed Container Image
- 28. Security Process in DevSecOps Secrets Management Secrets management refers to the tools and methods for managing digital authentication credentials (secrets), including passwords, keys, APIs, and tokens for use in applications, services, privileged accounts and other sensitive parts of the IT ecosystem.
- 29. Security Process in DevSecOps Privileged Access Management (PAM) PAM software allows companies to secure their privileged credentials in a centralized, secure vault (a password safe). Additionally, these solutions control who has access to, and therefore who can use, the privileged credentials based on access policies (including user permissions and specific timeframes), often recording or logging user activity while using the credentials.
- 30. Security Process in DevSecOps Privileged Access Management (PAM)
- 31. Security Process in DevSecOps Security Process in Automation Security: Production Stage
- 32. Security Process in DevSecOps Automation Security Baseline Automation Security Baseline build standard hardening steps into your recipes instead of using scripts or manual checklists. This includes minimizing the attack surface by removing all packages that aren’t needed and that have known problems; and changing default configurations to be safe.
- 33. Security Process in DevSecOps Automation Security Baseline Tools
- 34. Security Process in DevSecOps Cloud Security Automation ● Monitoring - it is necessary that you monitor the workflow of all the tasks in your infrastructure. ● Evaluation - give you insights into which tasks can be automated like repetitive tasks, resource provisioning, deployments, creating security rules, etc. ● In-depth analysis - analyze the collected information in depth by differentiating it on the basis of severity as high, medium or low risk. ● Reporting - The automation processes should be configured to generate the reports to present the overview of the changes before or after. ● Remediations - implement remediation and improve overall security posture.
- 35. Security Process in DevSecOps RASP (Run-time Application Security Protection) RASP works inside the application. It’s plugged into an application or its runtime environment and can control application execution. RASP lets an app run continuous security checks on itself and respond to live attacks by terminating an attacker’s session and alerting defenders to the attack.
- 36. Security Process in DevSecOps WAF (Web Application Firewall) WAF or Web Application Firewall helps protect web applications by filtering and monitoring HTTP traffic between a web application and the Internet. It typically protects web applications from attacks such as cross-site forgery, cross-site-scripting (XSS), file inclusion, and SQL injection, among others. A WAF is a protocol layer 7 defense (in the OSI model)
- 37. Security Process in DevSecOps Security monitoring, sometimes referred to as "security information monitoring (SIM)" or "security event monitoring (SEM)," involves collecting and analysing information to detect suspicious behavior or unauthorised system changes on your network, defining which types of behavior should trigger alerts, and taking action on alerts as needed. Security Monitoring
- 38. Security Process in DevSecOps Security Process in Wrap Up
- 39. Security Process in DevSecOps Automation Security Agile Focus DevOps Focus on Automation Security in every steps with Automation Code Build Integrate Test Release Configure Monitor Plan Deploy
- 40. Security Process in DevSecOps More questions? [email protected] Jirayut Nimsaeng CEO & Founder Opsta (Thailand) 086-069-4042 Facebook