Organizations in today’s market must strike a balance between competitive differentiation and meeting evolving compliance standards-particularly related to software security. They need to obtain faster release and deployment cycles, improved collaboration between business stakeholders and application development and operations teams, and automation tools. DevOps, an innovative organizational and cultural way of organizing development and IT operations work, is addressing this challenge – driven by mounting evidence of its benefits to the business. However reaping these gains requires rethinking application security to deliver more secure code at DevOps speed.

1. © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES1 © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES
Accelerating the Move
to the Dev Use Case
DevOps.com - Security Boulevard Webinar – Applying Five Principles of
Securing DevOps
Austin Britt
Solutions Architect, Team Lead

2. © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES2
Austin Britt
• Former Security Program Manager
• Managed Fortune 100 application
security programs
• Developed program to manage
compensating controls across global
insurance provider
• At Veracode since 2012
• Boston OWASP Chapter Member
• Solutions Architect

3. © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES3
DevOps
Plan Dev QA Ops
Business Intent
App Knowledge
Ops Knowledge
Business Intent
App Knowledge
Ops Knowledge
Continuity
Waterfall
! ! ! ! = Handoff
Agile
!

4. © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES4
DevOps is built on Agile
Security

5. © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES5
Continuous Integration & Continuous Delivery
(CI/CD)
• Goal: Release new changes while
maintaining stability
• CI/CD seeks to automate the
process of transforming code
changes into working software
• Automation of code delivery into
runtime environments
• Typically built on top of preexisting
toolchains:
– Jenkins, VSTS, Hudson, CircleCI etc.
• Technologies that support CI/CD
work streams:
– Automated Build and Verification of
Code Changes
– Containerization
– Unit Tests
– Feature development
– Microservices
– Operational Monitoring

6. © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES6
Defining DevOps

7. © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES7
What does DevOps Enable?
• Shared responsibility for software delivery
and operation
• Allows software to meet business needs
• Removes organizational barriers between
agile teams and non-agile processes
• Faster and more frequent delivery to
market

8. © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES8
“Shift Left”: Securing DevOps
• Goal: Minimize
organization
risk without
slowing down
development
• Changing how
security
operates within
an organization
Security

9. © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES9
Five Principles for integrating security into DevOps
1 Automate Security In
DevOps Pipeline2 Integrate to “Fail Quickly”
3 No false alarms
4 Build security champions Development
5 Keep operational visibility Production

10. © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES10
Principle #1: Automate Security In
• Integrate into common
development tools
– IDE
– Build Systems
– Bug Tracking
– GRC
• Leverage
comprehensive APIs
• Integrate testing results
within development
backlogs

11. © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES11
Principle #2: Integrate to Fail Quickly
• Education that delivers cost
savings
– Inform development early
• Two Phased approach
– Consistent frequency (part of
pipeline)
– Development being proactive
(testing outside of the pipeline)
Development
Operations
Both failures create notifications within
the backlog

12. © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES12
Principle #3: No False Alarms
• Too many false positives will frustrate
development and security
• Technology will end up being ignored
• Action oriented and accurate findings
are important
• In CI/CD a failure may cause the
entire pipeline to stop
• Delays could yield lost revenue for the
whole organization

13. © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES13
Principle #4: Build Security Champions
• Eyes and ears of Security
• Specialized training
• Basic security concepts
• Threat modeling
• Grooming guidelines
• Secure code review training
• Security controls
• Capture the Flag Exercises
• Escalate when necessary

14. © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES14
Principle #5: Keep Operational Visibility
• Security doesn't stop once a release
candidate has made it to production
• Cultural decision to determine where
to test
– Pre production vs production
• Business may decide to bypass
security checks to move faster
• Misconfigured pipelines are possible
• Runtime environments are always
changing

15. © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES15
Ask the Questions!
• What do future architecture plans look like? Is is more service based?
• Which of your applications will pass through a CI/CD pipeline? On
what technology stack?
• What tolerance do you have for “false alarms” (FPs) related to security
within the pipeline?
• How do you plan to monitor your applications for security attacks?
• How do you plan to bring security expertise into the DevOps teams?

16. © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES16 © 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES
THANK YOU