+ All Categories
Home > Documents > Achieving Secure Continuous Delivery (cont..)...Apr 26, 2016  · Continuous Delivery (cont..) ......

Achieving Secure Continuous Delivery (cont..)...Apr 26, 2016  · Continuous Delivery (cont..) ......

Date post: 20-Aug-2020
Category:

Documents
Upload: others
View: 1 times
Download: 0 times
Download Report this document
Share this document with a friend
13
Achieving Secure Continuous Delivery (cont..) --lightning talk-- Nikos / Jesus / Lucian April 2018
Transcript
Page 1: Achieving Secure Continuous Delivery (cont..)...Apr 26, 2016  · Continuous Delivery (cont..) ... Product has a Roadmap and Security is (always) not (always) part of it Security requirements

AchievingSecure ContinuousDelivery(cont..)--lightningtalk--

Nikos/Jesus/Lucian

April2018

https://www.owasp.org/index.php/London#Thursday.2C_28th_July_2016_.28Central_London.29
Page 2: Achieving Secure Continuous Delivery (cont..)...Apr 26, 2016  · Continuous Delivery (cont..) ... Product has a Roadmap and Security is (always) not (always) part of it Security requirements

Typicaldiscussions…

X

Page 3: Achieving Secure Continuous Delivery (cont..)...Apr 26, 2016  · Continuous Delivery (cont..) ... Product has a Roadmap and Security is (always) not (always) part of it Security requirements

Painpoints

Sameproblemin2018!

Difficultaccessto(uncorrelated)vulnerabilitydata

Noclearviewonthesecurityriskofaspecificbuildorrelease

Norealagreedsecuritygate(notriggerthreshold)

Shortmemory!Toolsgeteasilyforgottenorabandoned…

ProducthasaRoadmapandSecurityis(always)not(always)partofit

Securityrequirementsappear(darkmagic!)whenprojectisalmostfinished

Securitysign-offisabottleneck[choke]

Securitytestingtools!Lotsoftools!!Andreports!!!

WhenamIfinallysecureenough?Never!saysMordac.

Page 4: Achieving Secure Continuous Delivery (cont..)...Apr 26, 2016  · Continuous Delivery (cont..) ... Product has a Roadmap and Security is (always) not (always) part of it Security requirements

Tools!!

LinkHERE

SASTlistHERE

DASTlistHERE

DependencyCheckingToolslistHERE

ContainerSecuritytoolsHERE

GooglelistHERE

OthersHERE

http://apps.testinsane.com/mindmaps/Tag/hacking%20tools
https://www.owasp.org/index.php/Source_Code_Analysis_Tools
https://www.owasp.org/index.php/Category:Vulnerability_Scanning_Tools
https://www.peerlyst.com/posts/a-list-of-tools-used-to-manage-third-party-library-dependencies-and-vulnerability-identification-peerlyst
https://sysdig.com/blog/20-docker-security-tools/
http://maps.google.co.nz/intl/en/about/appsecurity/tools/
https://xebialabs.com/the-ultimate-devops-tool-chest/security/
Page 5: Achieving Secure Continuous Delivery (cont..)...Apr 26, 2016  · Continuous Delivery (cont..) ... Product has a Roadmap and Security is (always) not (always) part of it Security requirements

TheWant

Automation&centralisationofapplicationsecuritytesting

Riskbasedapproachtoapplicationdelivery&deployment

SecurityChampionsprocessandresponsibilities

Page 6: Achieving Secure Continuous Delivery (cont..)...Apr 26, 2016  · Continuous Delivery (cont..) ... Product has a Roadmap and Security is (always) not (always) part of it Security requirements

Existinginitiatives

Lots!!!OWASPAppSecPipelineOWASPOWTFOWASPDefectDojo

OtherstalkingaboutthisHEREHEREHEREHEREHEREHEREHEREHEREHERE

HEREHEREHEREHEREHERE

OWASPIsrael

OWASPAppSecPipeline

ChristianSchneider

STDD

SAMPLE

https://www.owasp.org/index.php/OWASP_AppSec_Pipeline
https://www.owasp.org/index.php/OWASP_OWTF#tab=Main
https://www.owasp.org/index.php/OWASP_DefectDojo_Project
http://files.asset.microfocus.com/4aa6-8302/en/4aa6-8302.pdf
https://www.sans.org/reading-room/whitepapers/critical/continuous-security-implementing-critical-controls-devops-environment-36552
http://mattboegner.com/secure_cicd_pipeline_2/
https://docs.microsoft.com/en-us/vsts/articles/security-validation-cicd-pipeline?view=vsts
https://www.ncsc.gov.uk/guidance/continually-test-your-security
https://www.securify.nl/blog/SFY20150303/automating-security-tests-using-owasp-zap-and-jenkins.html
https://www.owasp.org/images/e/ea/OWASPIL-2017-04-03_Automated-tests-ZAP-Webdriverio_OmerLeviHevroni.pdf
https://www.continuumsecurity.net/bdd-security/
https://denimgroup.com/resources/blog/2016/12/effective-application-security-testing-in-devops-pipelines/
https://2015.appsec.eu/wp-content/uploads/2015/09/owasp-appseceu2015-schneider.pdf
http://cdn2.hubspot.net/hubfs/203759/docs/WPhandbook0616.pdf
http://shop.oreilly.com/product/0636920045106.do
https://www.youtube.com/watch?v=fPdYBoW4g9Q
https://www.youtube.com/watch?v=3k922FTnGb8
https://www.owasp.org/index.php/OWASP_AppSec_Pipeline
Page 7: Achieving Secure Continuous Delivery (cont..)...Apr 26, 2016  · Continuous Delivery (cont..) ... Product has a Roadmap and Security is (always) not (always) part of it Security requirements

Wherewearenow

Zed Attack Proxy

Security

Page 8: Achieving Secure Continuous Delivery (cont..)...Apr 26, 2016  · Continuous Delivery (cont..) ... Product has a Roadmap and Security is (always) not (always) part of it Security requirements

DeveloperJenkins

Page 9: Achieving Secure Continuous Delivery (cont..)...Apr 26, 2016  · Continuous Delivery (cont..) ... Product has a Roadmap and Security is (always) not (always) part of it Security requirements

SecurityJenkins

3.Checkmypolicy

2.HowdoesThreadfixreceiveresults4.Howweinform

1.HowdoesJenkinsruntools

Page 10: Achieving Secure Continuous Delivery (cont..)...Apr 26, 2016  · Continuous Delivery (cont..) ... Product has a Roadmap and Security is (always) not (always) part of it Security requirements

Threadfixpolicies

Page 11: Achieving Secure Continuous Delivery (cont..)...Apr 26, 2016  · Continuous Delivery (cont..) ... Product has a Roadmap and Security is (always) not (always) part of it Security requirements

Fixingthestuff

Page 12: Achieving Secure Continuous Delivery (cont..)...Apr 26, 2016  · Continuous Delivery (cont..) ... Product has a Roadmap and Security is (always) not (always) part of it Security requirements

Next?Whatisbestforyouandyourbusinesses‘appetite?

GetaDevSecOpsteamtobuildandmaintaintoolz&stuffforyou£££

OWASPproject(Pipelines?)tosupportallfreetoolinputsintoonecentralrepo

(Somehow)workwithcommercialtoolproviderstosupportthat

InspireandempoweryourSecurityChampions

Page 13: Achieving Secure Continuous Delivery (cont..)...Apr 26, 2016  · Continuous Delivery (cont..) ... Product has a Roadmap and Security is (always) not (always) part of it Security requirements

Q/A


Recommended
Practical Static Analysis for Continuous Application · Continuous Security Automated, always-on processes for detecting ... Static analysis security tool for Ruby on Rails 8. @presidentbeef

Practical Static Analysis for Continuous Application · Continuous Security Automated, always-on processes for detecting ... Static analysis security tool for Ruby on Rails 8. @presidentbeef

Documents

Reliability, Availability, and Serviceability (RAS) for ... · •Workload distribution •Symmetric replication between head nodes •Continuous service •Always up to date ...

Reliability, Availability, and Serviceability (RAS) for ... · •Workload distribution •Symmetric replication between head nodes •Continuous service •Always up to date ...

Documents

Always On: How Data Analytics and Continuous Auditing and ...

Always On: How Data Analytics and Continuous Auditing and ...

Documents

Continuous Cooker / Dryer - Home - Anco Eaglin Cont Cooker.pdf · Continuous Cooker / Dryer RENDERING DIVERSITY ... ANCO Disc cookers and dryers are designed to handle a wide range

Continuous Cooker / Dryer - Home - Anco Eaglin Cont Cooker.pdf · Continuous Cooker / Dryer RENDERING DIVERSITY ... ANCO Disc cookers and dryers are designed to handle a wide range

Documents

Theory of Contingent Claims - EISTIet.perso.eisti.fr/pdfs/th-cont-claims2013-11-06.pdf · Introduction Mono-Period Market, RECALL Discrete Time Markets Continuous Time Markets Theory

Theory of Contingent Claims - EISTIet.perso.eisti.fr/pdfs/th-cont-claims2013-11-06.pdf · Introduction Mono-Period Market, RECALL Discrete Time Markets Continuous Time Markets Theory

Documents

Questions? / Team Status Reports Continuous Improvement (cont.) SQA in the real world

Questions? / Team Status Reports Continuous Improvement (cont.) SQA in the real world

Documents

Verification of continuous predictands · gives always worse skill score than long-term climatology: ask always which climatology is used to evaluate the skill • If the climatology

Verification of continuous predictands · gives always worse skill score than long-term climatology: ask always which climatology is used to evaluate the skill • If the climatology

Documents

HYDRAULIC MOTORS EPMS - series 3 · Type EPMS 80 EPMS 100 EPMS 125 EPMS 160 cont. Int.* cont. Int.* peak** cont. int.* cont. Int.* peak** cont. Int.* cont. Int.* peak** cont. 0-100

HYDRAULIC MOTORS EPMS - series 3 · Type EPMS 80 EPMS 100 EPMS 125 EPMS 160 cont. Int.* cont. Int.* peak** cont. int.* cont. Int.* peak** cont. Int.* cont. Int.* peak** cont. 0-100

Documents

MAS1302: Computational Probability and Statistics: Week 7ndw/week7.pdf · Simulating Continuous Random Behaviour (cont.) MAS1302: Computational Probability and Statistics: Week 7

MAS1302: Computational Probability and Statistics: Week 7ndw/week7.pdf · Simulating Continuous Random Behaviour (cont.) MAS1302: Computational Probability and Statistics: Week 7

Documents

II.3-API-CONT CONTINUOUS API MODEL II.3-API-CONT-2 rfs:23apicont-1.wpd periods. Unit hydrographs derived from other storms are not directly compatible with the event API model because

II.3-API-CONT CONTINUOUS API MODEL II.3-API-CONT-2 rfs:23apicont-1.wpd periods. Unit hydrographs derived from other storms are not directly compatible with the event API model because

Documents

E190Q – Lecture 14 Autonomous Robot Navigation · Example: Differential drive robot (cont’) ! Iterative Collision checking is simple but not always efficient: ! Algorithm: 1.

E190Q – Lecture 14 Autonomous Robot Navigation · Example: Differential drive robot (cont’) ! Iterative Collision checking is simple but not always efficient: ! Algorithm: 1.

Documents

The Agile Cultural Shift: Why Agile Isn’t Always Agile...and continuous integration, continuous delivery (CICD) has been challenging for many reasons, not the least of which is strong

The Agile Cultural Shift: Why Agile Isn’t Always Agile...and continuous integration, continuous delivery (CICD) has been challenging for many reasons, not the least of which is strong

Documents

American Music Review - brooklyn.cuny.edu · American Music Review Vol. XLVI, No. 2: Spring 2017 3 Dominican Migrants, Plural Identities, and Popular Music (cont.) tity “always

American Music Review - brooklyn.cuny.edu · American Music Review Vol. XLVI, No. 2: Spring 2017 3 Dominican Migrants, Plural Identities, and Popular Music (cont.) tity “always

Documents

r Eye Tracking for Everyone - Massachusetts …people.csail.mit.edu/khosla/papers/cvpr2016_Khosla.pdf[13] 51 cont. 35 cont. videos Ours 1474 cont. 13+cont. cont. 2,445,504 Table 1:

r Eye Tracking for Everyone - Massachusetts …people.csail.mit.edu/khosla/papers/cvpr2016_Khosla.pdf[13] 51 cont. 35 cont. videos Ours 1474 cont. 13+cont. cont. 2,445,504 Table 1:

Documents

Assess, Design, Implement, and Manage Continuous Availability · 2014-07-16 · Always On: Assess, Design, Implement, and Manage Continuous Availability 3 Managing continuous availability

Assess, Design, Implement, and Manage Continuous Availability · 2014-07-16 · Always On: Assess, Design, Implement, and Manage Continuous Availability 3 Managing continuous availability

Documents

Introduction to Optimizationdimo.brockhoff/... · 16/10/2015  · Fri, 9.10.2015 AA Introduction to Continuous Optimization Fri, 16.10.2015 AA End of Intro to Cont. Opt. + Gradient-Based

Introduction to Optimizationdimo.brockhoff/... · 16/10/2015  · Fri, 9.10.2015 AA Introduction to Continuous Optimization Fri, 16.10.2015 AA End of Intro to Cont. Opt. + Gradient-Based

Documents

Continuous ImPRovement - Alverno College · But where continuous improvement at Alverno has always been apparent ... in this annual report. Their accomplishments give us all such

Continuous ImPRovement - Alverno College · But where continuous improvement at Alverno has always been apparent ... in this annual report. Their accomplishments give us all such

Documents

Building a Culture of Continuous Improvement · Safety Continuous Improvement Long-Term View Mutual Trust and Respect Open, 2-Way Communication Core Values Always Our Foundation….

Building a Culture of Continuous Improvement · Safety Continuous Improvement Long-Term View Mutual Trust and Respect Open, 2-Way Communication Core Values Always Our Foundation….

Documents