What is DevOps:

DevOps is the combination of cultural philosophies, practices, and tools that increases an organization’s ability to deliver applications and services at high velocity: evolving and improving products at a faster pace than organizations using traditional software development and infrastructure management processes. This speed enables organizations to better serve their customers and compete more effectively in the market. (from AWS)

Prior to 2010,

  • Structured Development methodologies
  • Clent-server
  • Waterfall Model

Now,

  • Moved from structured development methodologies to object-oriented paradigm
  • Moved from client-server to service-oriented architecture
  • Moved from the waterfall model to agile methods

Continuous Integration and Continuous Delivery (CI/CD) relies on the automation of routine work.

Agile and DevOps

From DevOps to DevSecOps_第1张图片 From DevOps to DevSecOps_第2张图片

Basic SDLC has not changed .

Requirements ->Design->Development (Implementation)->Testing->Operations

Microsoft Security DLC: (From Microsoft Technets Blog)

The Microsoft Security Development Lifecycle – Simplified

How to Develop a Security Strategy winthin DevOps

Tools and Framework:

  • Culture: Collaboration and Contribution. Everyone is responsible for security. Goal is equal to safely distributing security decisions
  • Processes: Significant changes to existing workflows & processes. Team communication, collaboration, reporting, measurements, security, development, operations, end to end, implementing changes, continuous loop. 
  • Technologies: Threat modeling, attack surface evaluation, static & dynamic analysis, penetration testing, fuzz testing

Five Principles for Securing DevOps

  • Automate Security in: automated invocation security testing with Comprehensive API.
  • Integrate to Fail Quickly: Integrating security CI/CD pipeline for application security.
  • No False Alarms
  • Build Security Champions: train developers in security coding, a force multiplier, reduce culture conflict, embed app security knowledge into team
  • Keep Operational Visibility: application security continues, closed loop feedback, security incidents

SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing)

From DevOps to DevSecOps_第3张图片 From DevOps to DevSecOps_第4张图片


Continuous Security:

From DevOps to DevSecOps_第5张图片 From DevOps to DevSecOps_第6张图片

Continuous Testing:

  • Test Driven Security (TDS)
  • Write tests that represent desired behavior
  • Test will fail and that is expected. 
  • Implement controls to pass TDS tests
  • Security teams help developers and IT operation teams  to implement controls

Integrating DevOps and AppSec:

From: https://www.owasp.org/index.php/OWASP_AppSec_Pipeline#tab=Pipeline_Design_Patterns

From DevOps to DevSecOps_第7张图片 From DevOps to DevSecOps_第8张图片



Security Architecture and Design Review

  • Product Requirements
  • Early Designs
  • Add security based on threat models
  • Architecture is reviewed
  • Security controls proposed

Security Code Review:

  • Review code
  • Verify security controls
  • Verify architecture requirements

Security testing

  • Can the product withhold a simulated attack?
    • Manual testing
    • Automated tools

Monitoring and Key Performance Indicators

Logging Pipeline includes:

Collect->Stream->Analyze->Store->Access

Incident Management:

NIST 800-61

From DevOps to DevSecOps_第9张图片 From DevOps to DevSecOps_第10张图片

For Detection & Analysis

  • Blended approach  to detection
  • Business-focused Metrics
  • Data-driven investigations

For Containment Eradication & Recovery

  • Actionable alerts
  • ChatOps for Communication
  • Runbooks for remediation
  • Adopt infrastructure as Code (IaC)

For Post-Incident Activity:

  • Keep post-mortems actionable
  • Analysis phase is worthless if little or no action is taken
  • Lessons learned must be reflected in incident management runbook

KPI (Key Performance Indicators) based on business needs and compliance requirements

  • Availability
  • Change Failure
  • Change Lead Time
  • Change Volume
  • Customer Issue Resolution Time
  • Customer issue volume
  • Defected Burn Rate
  • Deployment Frequency
  • Logging Availability
  • Mean Time Between Failures (MTBF)
  • Mean Time to Failure (MTTF)
  • Mean Time to Recovery (MTTR)
  • Number of False Positives
  • Number of False Positive
  • Number of Functional/Acceptance Tests
  • Number of Passed /Failed Security Tests
  • Number of unit/integration Tests
  • Security Benchmark Deviation
  • Security Controls
  • Test Coverage
  • Time to Patch
  • Time to Value
  • Vulnerability Patching Frequency
  • Vulnerability Patching Lead Time