Nsc42 the security phoenix
•Download as PPTX, PDF•
0 likes•36 views
DEVSECOPS & Cloud security
Recommended
Recommended
More Related Content
What's hot
What's hot (10)
Similar to Nsc42 the security phoenix
Similar to Nsc42 the security phoenix (20)
Recently uploaded
Recently uploaded (20)
Nsc42 the security phoenix
- 1. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) The Security Phoenix raises from DEV-OPS ashes Cyber Security & Cloud Expo - North America @FrankSEC42 From DEV-OPS Security raises in DEV-SEC-OPS-BIZ-RISK-GOV https://uk.linkedin.com/in/fracipo
- 2. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) Agenda About the author Conclusions Q&A Security Phoenix – Security Ops Security Phoenix – Visualization & Security Phoenix Tech Evolution of DEVOPS in Security Phoenix Context @FrankSEC42 Security Phoenix – Governance & Education
- 3. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) www.nsc42.co.ukwww.nsc42.co.ukwww.nsc42.co.uk @FrankSEC42https://uk.linkedin.com/in/fracipo About the Francesco 3 Francesco Cipollone Founder – NSC42 LTD I’m a CISO and a CISO Advisor, Cybersecurity Cloud Expert. Speaker, Researcher and Chair of Cloud security Alliance UK, Researcher and associate to ISC2. I’ve been helping organizations define and implement cybersecurity strategies and protect their organizations against cybersecurity attacks Website Articles NSC42 LinkedIn Security is everybody’s job We need to make security cool and frictionless Copyright © NSC42 Ltd 2019 Email@FrankSec42 Fracipo Linkein
- 4. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) www.nsc42.co.uk @FrankSEC42https://uk.linkedin.com/in/fracipo What the hek is DEV-SEC-OPS? 4 What kind of animal is the DEV-SEC-OPS? Integrate security into the OPS team (and add a spark of BIZ)
- 5. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) www.nsc42.co.uk @FrankSEC42https://uk.linkedin.com/in/fracipo Anatomy of a phoenix 5 What Are the core component of Security Pheonix Secure Operate Secure Design Build & Test People & Education Governance & Risk mng
- 6. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) www.nsc42.co.uk @FrankSEC42https://uk.linkedin.com/in/fracipo Major Breaches 6 2009/ 2010 2012 Microsoft Heartland US Military Aol TJMax 2013 2016 2017 2014 2015 2018 Sony PSN NHS Betfair Steam Deep Root IRS Anthem Dropbox Lastfm Blizzard Marriot Twitter MyHeritage Uber Quora.. Why fixing Security Vulnerabilities is everybody’s job? Equifax Myspace Twitter Yahoo Linkedin Friend Finder Dailymotion Mossack Fonseca JP Morgan Home Depo Ebay Yahoo(orignal) US Retailers Adobe UbiSoft Court Ventures 2012 2019 … …because we all get affected by it
- 7. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) www.nsc42.co.uk @FrankSEC42https://uk.linkedin.com/in/fracipo Major Breaches 7 Image Credit Information is Beautiful
- 8. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) www.nsc42.co.uk @FrankSEC42https://uk.linkedin.com/in/fracipo The Crisis 8 DEV-OPS & SEC -> SEC - how to go from problem to enabler? Let’s see how security is reborn in DEV-OPS world Blending architecture DEV-OPS and Business/Risk
- 9. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) www.nsc42.co.uk @FrankSEC42https://uk.linkedin.com/in/fracipo What do you get out of Security Phoenix? 9 1. Trust the Product team but keep them accountable: Trust & Verify & License to Operate 2. Visualize and Fix Vulnerability at scale and pace (DEV & Ops) 3. Security Design, Governance and Education
- 10. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) www.nsc42.co.uk @FrankSEC42https://uk.linkedin.com/in/fracipo What do you get out of Security Phoenix? 10 1. Trust the Product team but keep them accountable: Trust & Verify & License to Operate 2. Visualize and Fix Vulnerability at scale and pace (DEV & Ops) 3. Security Design, Governance and Education
- 11. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) www.nsc42.co.uk @FrankSEC42https://uk.linkedin.com/in/fracipo Trust & Verify Core – Fast & Confident – Core Concepts 11 Going fast but with confidence (SEC) 1. Trust & Verify 2. License to operate/code 3. Day in Day fix Vulnerabilities >> Set Thresholds: Bild vs Fix, Vulnerability trending Operate People & Education
- 12. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) www.nsc42.co.uk @FrankSEC42https://uk.linkedin.com/in/fracipo DEVSECOPS - Fast and Confident 12 Trusted DEV-OPS team can operate at speed… as long as they have the license to operate DEV Security Productio n Security
- 13. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) www.nsc42.co.uk @FrankSEC42https://uk.linkedin.com/in/fracipo Trust & Verify – Under the hood 13 Learning & Education Build vs FIX Target Application Security Scanners Production Dashboard Development Dashboard Job Queue Defects Bugs New Features Am I compliant with Code Defects Target ? Triage & Vulnerability Per applicationDay to day fix or build Code 3rd parties Components (FOSS + Libraries) Engeneers & Developers DEV-SEC-OPS Application Group (unit that works on one or more application) DEV Test Prod nt to prod he License erate Engeneers & Developers Application/ Product Owner Security Champion Security Architect Security Vulnerabilities Bugs& Errors NEWFeatures Thresholds Vulnerability Targets (Quarter) Phoenix Aggregator DB License to operate Risk/BIZ?
- 14. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) www.nsc42.co.uk @FrankSEC42https://uk.linkedin.com/in/fracipo Team Structure 14 Ap Se Job Qu Defec Bugs Am i still compliant with Overall Build vs FIX Targets ? Code 3rd parties Components (FOSS + Libraries) Deployment to prod Relies on the License to Operate Security Vulnerabilities Bugs& Errors NEWFeatures ThresholdsApplication Security Scanners Production Dashboard Development Dashboard Job Queue Defects Bugs New Features Am I compliant with Code Defects Target ? Am i still compliant with Overall Build vs FIX Targets ? Triage & Vulnerability Per applicationDay to day fix or build Code 3rd parties Components (FOSS + Libraries) Engeneers & Developers DEV-SEC-OPS Application Group (unit that works on one or more application) DEV Test Prod Deployment to prod Relies on the License to Operate Engeneers & Developers Application/ Product Owner Security Champion Security Architect Security Vulnerabilities Bugs& Errors NEWFeatures Thresholds License to operate
- 15. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) www.nsc42.co.uk @FrankSEC42https://uk.linkedin.com/in/fracipo Trust & Verify Key concepts - Summary 15 Developer can operate fast and deploy as long as they have a license 1. Trust your developers and apply a ‘license to operate’ 2. Apply governance (light and heavy weight) 3. Visualize and keep everyone accountable 4. Make security resource available to the developers and document the fixes
- 16. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) www.nsc42.co.uk @FrankSEC42https://uk.linkedin.com/in/fracipo Application Security Scanners Production Dashboard Development Dashboard Job Queue Defects Bugs New Features Am I compliant with Code Defects Target ? Am i still compliant with Overall Build vs FIX Targets ? Triage & Vulnerability Per applicationDay to day fix or build Code 3rd parties Components (FOSS + Libraries) Engeneers & Developers DEV-SEC-OPS Application Group (unit that works on one or more application) DEV Test Prod Deployment to prod Relies on the License to Operate Engeneers & Developers Application/ Product Owner Security Champion Security Architect Security Vulnerabilities Bugs& Errors NEWFeatures Thresholds Trust & Verify Framework 16 Learning & Education
- 17. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) www.nsc42.co.uk @FrankSEC42https://uk.linkedin.com/in/fracipo What do you get out of Security Phoenix? 17 1. Trust the Product team but keep them accountable: Trust & Verify & License to Operate 2. Visualize and Fix Vulnerability at scale and pace (DEV & Ops) 3. Security Design and Education
- 18. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) www.nsc42.co.uk @FrankSEC42https://uk.linkedin.com/in/fracipo Dashboard for Code Defects 18 Example of a dashboard for Vulnerability Visualization DEV Security Productio n Security
- 19. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) www.nsc42.co.uk @FrankSEC42https://uk.linkedin.com/in/fracipo Dashboard for Code Defects -> Under the hood 19 Repositories Build/Staging/UAT/ Test Environments Scanner for Code Scanner for Build Dashboards For SAST DEV Dashboard Scanner for Test Dashboard Build/ Test Production Prod Scnner Dashboards PROD Dashboards Development-Testing Production Scanner for prod Triage the vulnerabilities Scan At various Stages Scanners to Tickets or aggregators DEV Security Productio n Security SET Targets For Prod & DEV Vuln
- 20. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) www.nsc42.co.uk @FrankSEC42https://uk.linkedin.com/in/fracipo Security Operation 20 Secure Operate: What to do 1. OS & App – Patch 2. Framework – Scan & Patch 3. Libraries & Open source components 4. Code – From your DEV Pipeline 5. Libraries – from your Build/DEV DEV Security Productio n Security Hardware OS/Container Apps (3rd Party) Frameworks Libraries (3rd) / FOSS Code/Build
- 21. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) www.nsc42.co.uk @FrankSEC42https://uk.linkedin.com/in/fracipo What do you get out of Security Phoenix? 22 1. Trust the Product team but keep them accountable: Trust & Verify & License to Operate 2. Visualize and Fix Vulnerability at scale and pace (DEV & Ops) 3. Security Design and Education
- 22. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) www.nsc42.co.uk @FrankSEC42https://uk.linkedin.com/in/fracipo Definition of security Impacting Change 23 Governanc e Functional Change OPS Test Small Change/ FIX/ Patching Small Change/ Bugfix/ Patching Sandbox/Prototyping Deployment Environment Functional Change - Any Change impacting the core functionalities of an application DEV-OPS PhaseDesign Phase Governance Delegated to the Champion(s) and Application owner(s) Governance on the Security DesignAuthority & Security Architects Iterations DEV Initial Design (Iterations) Functional Change
- 23. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) www.nsc42.co.uk @FrankSEC42https://uk.linkedin.com/in/fracipo Security Education in DEV-SEC-OPS 24 1. Awareness Training For your users 2. Craft Training based on the scanner (faults) data 3. Education on the job – What good looks like 4. Make the training entertaining (CTF and Rewards) Security Education Education:
- 24. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) www.nsc42.co.uk @FrankSEC42https://uk.linkedin.com/in/fracipo Conclusion 25 - Trust And Verify - Vulnerability Management every day life - Automation vs people aspect – is a transformation - Data Driven Education - Governance at scale Security at scale and pace Security is everybody’s job
- 25. Every 2 weeks 1.30 PM UK Time Cyber #MentoringMonday Podcast @FrankSEC42
- 26. Cyber Security Awards 2020 Cloud Security Influencer of the Year Submission – 10 of May 2020 (TBD) Ceremony 4 July 2020 #CYSECAWARDS20https://cybersecurityawards.com/ https://cloudsecurityalliance.org.uk Submit: info@cybersecurityawards.com Info:
- 27. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) www.nsc42.co.uk @FrankSEC42https://uk.linkedin.com/in/fracipo Q&A 29
- 28. Copyright © NSC42 Ltd 2019 (content & Picture under Licence) www.nsc42.co.uk @FrankSEC42https://uk.linkedin.com/in/fracipo Contacts 30 Get in touch: https://uk.linkedin.com/in/fracipo Francesco.cipollone (at) nsc42.co.uk www.nsc42.co.uk Thank you WHEN YOU ARE CYBERSAFE WE ARE CYBERHAPPY @FrankSEC42
Editor's Notes
- Intro Thank you for being here and a thanks to Whitehall media for organizing this event What are we going to talk about? <pause?> … oh yes phenix and the death of infosec <pause?> …oh sorry you thought you would have a future as security people? Well yes and no… <smile & pause> Who has read harry potter here? Who knows here what is a phenix? And how does a phenix relate to infosec?? Today we are going to talk about how the infosec program is reborn under a rain of fire inside the dev-ops world
- Agenda for today Agenda for today - Author - Quick background - Evolution of DEVOPS in Security Phoenix - Security Phoenix – Visualization & Security Phoenix Tech - Security Phoenix – Security Ops - Security Phoenix – Governance & Education - Trust & Verify / License to operate Conclusions Q&A
- Quick background about Francesco…me…as you might have noticed my favorite colors are black and red. I’m a Cybersecurity Cloud Expert and CISO/Advisor. I’m an active Public Speaker, as you can see, researcher and Director of Events of Cloud security Alliance UK, Researcher and associate to ISC2. I’ve been helping organizations define and implement cybersecurity strategies and protect their organizations against cybersecurity attacks I help international organization of different industries and sizes financial services, banking, Telco and thig gives me different prospective on the security problem One important theme that I put in all the presentation is that that Security is everybody job and we will see why Also The key to success in security is to make it frictionless
- So what is DEV-OPS? Opening: So, what are we talking about? DEVOPS and Security. What the hek is devops? DEVOPS is a mythological beast… where you merge the development community with the operational community to have a single animal that is responsible of the lifecycle of their own application Is continuous integration between DEVelopment and OPerationS (continuous integration) Why is so actual today? Because of the speed of delivery So how do we add another element in this picture (Sec) … Security Phoenix is where DEV-OPS reborn as a mythological animal with security at heart
- So what are the different part of a phoenix? With at their head people and education (head) Design (wing) Build & Test (wing) Operate is at the heart (heart) Guided by governance and risk management (tail) Can a bird fly without wings or with just one wing? Maybe but really badly Can a bird fly without a head? Don’t think so Can a bird have direction without a tail But ultimately security is about our people as they are our herald! Security is everybody’s job Let’s see why
- Why Is security Important Major breaches over the years…let’s think about the dark knights We can’t scale! We need more security people ! I’ll let this image sink in for a second. Those are just the major breaches over the years. Most of them were due to mistakes like unpatched systems, exposed databases, password guessing, brute force. What all those breaches have in common? Complex Nation state act – no Complex and intricated cyber attacks – Sometimes Missing the basics (e.g. patching ) and human error is the answer you are really searching for. By doing the basic right you will be better off than 80% of other organizations This explains why security is everyone's responsibility? Because we all get affected by it! https://blog.storagecraft.com/7-infamous-cloud-security-breaches/ https://informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/ A lot of the breaches have similarities: Basic patching Server exposed without credentials
- Setting the context Just to let you know what the malicious actors have been up to: Just to give some prospective: Size of the breaches (orange interesting stories) https://informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/
- So how does security fit in DEV-OPS? Done badly the existing governance and controls get forced onto the new world Done correctly security becomes almost transparent So how do we do it correctly? With Security Phoenix! Security Function is reborn! Let’s analyze the phoenix
- What would you get out of the pillar? Trust of the developers – Embedding security in the DEV-OPS pods. Key enabler for doing this at scale? Trust & Verify and License to operate How to fix vulnerability at scale? The concept of Triage and Visualization Upskill and fill the gap in security: Keep people accountable: Security Governance Shift Left & Design – not talking much here
- So let’s see the people aspect: Trust & Verify and license to operate
- Problem that we are trying to solve>How to fix the problem at scale and at pace DEV-SEC-OPS Ultimately is all about our people & Education People are the first line of defiance for your business What are the key concept of Security Phoenix? Trust the team but verify (dashboards, build vs fix) License to operate: if you deploy quality code you have the license Fixing vulnerabilities as everyday life (sprint) Set thresholds (reduction of vulnerabilities and build vs fix)
- This new mode of operation shall rely on the ability of the team to demonstrate they can operate securely and at pace Transformation – License to Operate -> Trust your DEV-OPS but verify As long as the DEV-OPS team operate under the license Apply governance (light and heavy weight) Make security everybody’s responsibility but provide resource to guide (during transformation)
- The Whole concept relies on license to operate: if you promote good code, you good to go How to verify: Thresholds for reduction of vulnerabilities (Dashboards) Thresholds for Build VS fix Security Learning Code Scanners -> Output in Phoenix DB -> Thresholds Code Scanners -> Output in Jira ticket -> Threshold in Phoenix DB -> Build vs FIX tickets Learning platform -> Output in Phoenix DB -> team doing training? Teams triage and remediated locally to the pod People aspect: Risk management & BUZ – not yet automated If something can’t be updated/remediated than risk assessment (not covered here) Application/Product owner (empowered by Pods and Security Champions) decide how many vulnerabilities to fix at every sprint
- The Pod Structure Dev + Engineers – DEV + OPS Sec Champions to show what good looks like App Owner to guide the business for new feature Sec Arch – To oversee the Design Part of application and review changes Monitoring – Appsec (day in day out Vuln Fixes Dashboard and trending – what vulnerability to fix first Build vs FIX - ensure the thresholds are healthy
- Trust your developers and apply a ‘license to operate’ -> this can be removed Apply governance (light and heavy weight) – faster for team that are compliant with security more scrutiny for team that are not Visualize and keep everyone accountable – give the product owner the ability to see if new vulnerabilities are getting introduced Make security resource available to the developers and document the fixes – produce internal reference for what security looks like for your org
- The Whole concept relies on license to operate: if you promote good code, you good to go How to verify: Thresholds for reduction of vulnerabilities (Dashbaords) Thresholds for Build VS fix Scanners output in jira Teams triage and remediated locally to the pod If something can’t be updated/remediated than risk assessment (not covered here) Application/Product owner (empowered by Pods and Security Champions) decide how many vulnerabilities to fix at every sprint
- Let’s see the visualization aspect behind the element discussed
- Thresholds example (DEV)
- Theme: Visualization helps both the teams working on the code and the application owner providing governance The tools ultimately are not as intelligent as a developer but only provide suggestion on how to prioritize vulnerabilities Scanners architecture Different Scan at different stages Divide DEV/Prod Scanners individual dashboards for false positives Aggregate the vulnerabilities in aggregators (e.g. Kennar) Scanners dashboards to mark false positives or risk accept but make sure there is a process behind it Triage of the vulnerabilities inside the scanners or feed into auto generation of thickets
- For operation – Scan/Monitor & Bugfix (nothing else than a change) Key thing here: Prioritize what to fix! Fixes will be in competition with feature! Is not all about security OS & App – Scan and monitor – Rebuild frequently so you don’t have to worry Framework – Scan & Patch – Rebuild App with latest (release cadence) FOSS – open source components! Watch for Contributor account take over (refer to Netflix) Libraries & Open source components – Scan & rebuild with new libraries - Rebuild App with latest (release cadence) – RISK management if you can’t update or no update is available Code – From your DEV Pipeline – Those are your security code defect (internal or external bug bounty to detect which one is more dangerous
- For open source vulnerabilities it takes a long time to fix Why is that? Because rebuilding is not always immediate You say 0 days? I say normally a patch is between 16 and 94 days to be fixed… That leaves a lot of exposure to yourself
- So Let’s see the last aspect: Design and Education
- Security governance in dev-sec-ops – Challenging Definition of change: Small Changes vs security impacting changes Change control & Security education – security review closer to the Application PODs Initial design assessment Improvements: Pre approved services Patterns Standards into automation
- Educate the Users -> Report vulnerability Educate the Users -> Aware of social engineering Hands on and hands-off training (OWASP great resource)
- Security is hard and roles of the architect is changing No 1 solution fits all, tailor this model to your organization! Key concepts: Trust And Verify Vulnerability Management every day life Automation vs people aspect – is a transformation Data Driven Education Governance at scale Closing: Ultimately there is no 1 solution that fits all and look at the security transformation as a people transformation. You can’t automate people but you can make people’s life easier using tool. Don’t let the tool use you but use the tool to prioritize the work
- Q&A