In many organisations, development/operations teams are not in the same trenches with the security team. Talk is about how to build trust between different focus teams, how to put DevOps practices in-line with regulated and hardened environments. This talk is about common sense and security automation. And how security should be a requirement in each production deployment. There are differences, even in 2017, for Ops/Dev and Security regarding mindset on building, secure, resilient and yes agile systems. Security is not one fit's all solution, so there are different approaches to start-ups and well-regulated industries. From OS hardening to vulnerability scanning in build pipelines, from OSS projects till million dollars solutions. From common sense till aluminium tin foil hats and all this can be automated and should be automated. The talk will guide thru the best practices of the industry, for implementing and maintaining automated security controls and measures for Enterprises and startups based on speakers good and bad experience, in different Financial services, FinTech companies and startups.

1. implementing
continuous security
Jānis Orlovs
Riga DevOPS Days 2017

2. security = quality
devops = speed + communication + quality

3. security is not witchcraft
it is about risk assement

4. principles
over
techniques

5. to archive continous security
it has to be
built-in
not bolt-on

6. adapt industry designed
security architecture standards
don’t reinvent new wheel

7. good security
architecure based of
protection layers

8. security measures don’t
have to be simple, but
modular

9. observability
is
communication form
from your systems

10. monitoring and logging are
your eyes and ears

11. data visualization is as
important
as data gathering

12. automate responses from
monitoring/logging tools

13. include in your personal
workflow review
security data/events
each day

14. sucefull security must
be automated
in human and technical
level

15. checklists works great for
(currently) unautomable
tasks

16. nudges works for
directing staff and
users for unconsicnous
correct security
decissions

17. pick technical tools for
implementing continous security
for your environment

18. security tests
over
security scans

19. there is use-case for
automated
security tests and scans
in each part of
solution lifecycle

20. implementing
continuous security
Jānis Orlovs
Riga DevOPS Days 2017