The document discusses how security and DevOps can have a better relationship by embedding security earlier in the development process. It suggests that security can speed up DevOps by automating security checks into CI/CD pipelines through automated code reviews, scanning for vulnerabilities, and testing for bugs. This enables developers to release faster with less risk while improving the overall security posture over time. When security is considered from the beginning, it reduces security issues and incidents in production and builds more trust in the products that are developed.

1. Hi DevOps, I’m Security, I
Love You
@stuhirstinfosec

2. Disclaimers;
I like memes & gifs.
I’m not an ‘expert’ or a
‘thought leader’, but I’ve
learned some stuff along the
way.
@stuhirstinfosec

3. Who Am I?
@stuhirstinfosec

4. @stuhirstinfosec

5. @stuhirstinfosec

6. @stuhirstinfosec
So what’s wrong
and how can we
make it better?

7. @stuhirstinfosec

8. @stuhirstinfosec

9. @stuhirstinfosec

10. @stuhirstinfosec

11. @stuhirstinfosec
We’ve perpetuated a
myth that DevOps cause
us pain

12. @stuhirstinfosec
This sums up what
has been wrong…
Security believes it
has to clean up the
“unicorn shit” from
DevOps.
No wonder our
relationship has
been fraught…

13. @stuhirstinfosec
Here, have a
Jira ticket.
You’re
welcome.

14. @stuhirstinfosec

15. @stuhirstinfosec

16. @stuhirstinfosec

17. @stuhirstinfosec

18. @stuhirstinfosec
SHIFTING LEFT!
(IMBEDDING SECURITY AS
EARLY AS WE CAN)

19. @stuhirstinfosec

20. @stuhirstinfosec
Security
SPEEDS UP
DEVOPS!!!

21. @stuhirstinfosec

22. @stuhirstinfosec
HEAR ME OUT!
I’ll explain how….

23. @stuhirstinfosec
CI/CD & Code
• We don’t need you to code more
securely, we should prevent it anyway
• Automated code review
• Code scanning (SAST/DAST)
• OWASP Top 10
• Behaviour-driven (BDD)

24. @stuhirstinfosec
CI/CD & Code
• Release faster with less risk (yay!)
• Fewer bugs to fix
• Leverage open-source
• Remediate vulnerabilities at scale

25. @stuhirstinfosec
Bugs
• Are Security bugs any different to
functional bugs?!
• Finding sec bugs will improve overall
posture & introduce best practice over
time

26. @stuhirstinfosec
Bugs - how do we find them?
• Bug Bounty / Crowdsourced testing
• ‘Hack Yourself First’/Red Teaming
• Scanners - e.g. OWASP ZAP
• Pen Tests

27. @stuhirstinfosec

28. @stuhirstinfosec
Cloud

29. @stuhirstinfosec
Automating Security into Cloud
Infrastructure pipelines can;
• Make public buckets impossible
• Force encryption at rest/in transit
• Establish key management and rotation
• Help with cost control (yes, really!)

30. @stuhirstinfosec

31. @stuhirstinfosec

32. @stuhirstinfosec
Data
• We help make it available by reducing
Denial Of Service attacks
• Preserve integrity so data can’t be
altered
• Ensure confidentiality

33. @stuhirstinfosec

34. @stuhirstinfosec
Keys & Secrets
North Carolina State University examined
accidental leakage of authentication
secrets to GitHub…..

35. @stuhirstinfosec
Keys & Secrets
1. Secrets in over 100,000
repositories
2. Over 1000 committed
daily

36. @stuhirstinfosec
Keys & Secrets
• Git-Secrets
• Hashicorp Vault
• https://github.com/dxa4481/truffleHog
(search for high-entropy strings)

37. @stuhirstinfosec

38. @stuhirstinfosec
Threat Modelling
• What are we working on?
• What can go wrong?
• What are we going to do about it?
• Did we do a good job?

40. @stuhirstinfosec
Threat Modelling -
benefits
• Reduce attack surface
• Reduce vulnerabilities in Production
• Increase collaboration
• Architect better product!

41. @stuhirstinfosec
Reducing Risk &
Incidents
• Boards LOVE risk reduction!
• Fewer incidents = more time doing cool
shit
• Less time dealing with 9pm Friday
nonsense = more beer time

42. @stuhirstinfosec
WE MUST EXPECT
SECURITY
INCIDENTS TO
HAPPEN!

43. @stuhirstinfosec
Scalability
• Helps businesses grow quickly with less
friction
• Reduces the need for growing Security
teams
• Brings accountability into DevOps

44. @stuhirstinfosec

45. @stuhirstinfosec
Compliance &
Regulation

46. @stuhirstinfosec
Compliance

47. @stuhirstinfosec
How Can
DevOps Help
Security?

48. @stuhirstinfosec
Better Security
increases TRUST
in the products we
build

49. @stuhirstinfosec

50. @stuhirstinfosec

51. @stuhirstinfosec

52. @stuhirstinfosec

53. @stuhirstinfosec

54. @stuhirstinfosec

55. FANKS!
@stuhirstinfosec