Why to DevSecOps - Introduction of Bangalore Azure Group meetup
•
2 j'aime•259 vues
What is DevSecOps and why to do so. My slides for Bangalore Azure Group meetup event in July 2018
Recommandé
Recommandé
Contenu connexe
Tendances
Tendances (20)
Similaire à Why to DevSecOps - Introduction of Bangalore Azure Group meetup
Similaire à Why to DevSecOps - Introduction of Bangalore Azure Group meetup (20)
Plus de Sébastien Paulet
Plus de Sébastien Paulet (20)
Dernier
Dernier (20)
Why to DevSecOps - Introduction of Bangalore Azure Group meetup
- 1. 1@SP_twit 21st July 2018Why to DevSecOps? Sebastien Paulet Microsoft MVP Office Server and Services FR
- 2. 2@SP_twit@SP_twit Situation • CTOs want cheaper, faster projects with high ROI since 15 years • Answer is Agile methodologies
- 4. 4@SP_twit@SP_twit DevOps • Culture • Automation • Lean • Measurement • Share
- 5. 5@SP_twit@SP_twit DevOps on Azure • Azure ARM • Azure Automation DSC • Azure Application Insights • Visual Studio Team Services • Azure Container Services • Azure Container Registry
- 6. 6@SP_twit@SP_twit Security • “It’s important” -> “what’s the risk?” • More complexity • Security leaks -> bad buzz (Facebook, Sony, etc.) -> slow down adoption • New regulations • India : Information Technology Act (2000) (“IT Act”) to include Section 43A and Section 72A • GDPR (Europe) : mandatory to declare all security intrusion/leaks -> Up to 4% worldwide revenue fine • Specific regulation rules (banking, military, etc.)
- 7. 7@SP_twit@SP_twit DevSecOps Manifesto (Larry Maccherone) • Build security in more than bolt it on • Rely on empowered development teams more than security specialists • Implement features securely more than security features • Use tools as feedback for learning more than end-of-phase stage gates • Build on culture change more than policy enforcement
- 8. 8@SP_twit@SP_twit Security everywhere at all levels
- 9. 9@SP_twit@SP_twit DevSecOps actions • Automate security • Empower engineering teams • Maintain continuous assurance • Set up operational hygiene
- 11. 11@SP_twit@SP_twit DevSecOps on Azure • BinSkim - A binary static analysis tool that provides security and correctness results for Windows portable executables • Checkmarx - A Static Application Security Testing (SAST) tool • Manage your open source usage and security as reported by your CI/CD pipeline • OWASP • OSWAP zap vsts extension • WhiteSource Software • Visual Studio Code Analysis and the Roslyn Security Analyzers • See https://docs.microsoft.com/en-us/vsts/articles/security-validation-cicd-pipeline?view=vsts