What is DevOps:
DevOps is the combination of cultural philosophies, practices, and tools that increases an organization’s ability to deliver applications and services at high velocity: evolving and improving products at a faster pace than organizations using traditional software development and infrastructure management processes. This speed enables organizations to better serve their customers and compete more effectively in the market. (from AWS)
Prior to 2010,
- Structured Development methodologies
- Clent-server
- Waterfall Model
Now,
- Moved from structured development methodologies to object-oriented paradigm
- Moved from client-server to service-oriented architecture
- Moved from the waterfall model to agile methods
Continuous Integration and Continuous Delivery (CI/CD) relies on the automation of routine work.
Agile and DevOps
Basic SDLC has not changed .
Requirements ->Design->Development (Implementation)->Testing->Operations
Microsoft Security DLC: (From Microsoft Technets Blog)
How to Develop a Security Strategy winthin DevOps
Tools and Framework:
- Culture: Collaboration and Contribution. Everyone is responsible for security. Goal is equal to safely distributing security decisions
- Processes: Significant changes to existing workflows & processes. Team communication, collaboration, reporting, measurements, security, development, operations, end to end, implementing changes, continuous loop.
- Technologies: Threat modeling, attack surface evaluation, static & dynamic analysis, penetration testing, fuzz testing
Five Principles for Securing DevOps
- Automate Security in: automated invocation security testing with Comprehensive API.
- Integrate to Fail Quickly: Integrating security CI/CD pipeline for application security.
- No False Alarms
- Build Security Champions: train developers in security coding, a force multiplier, reduce culture conflict, embed app security knowledge into team
- Keep Operational Visibility: application security continues, closed loop feedback, security incidents
SAST (Static Application Security Testing) and DAST (Dynamic Application Security Testing)
Continuous Security:
Continuous Testing:
- Test Driven Security (TDS)
- Write tests that represent desired behavior
- Test will fail and that is expected.
- Implement controls to pass TDS tests
- Security teams help developers and IT operation teams to implement controls
Integrating DevOps and AppSec:
From: https://www.owasp.org/index.php/OWASP_AppSec_Pipeline#tab=Pipeline_Design_Patterns
Security Architecture and Design Review
- Product Requirements
- Early Designs
- Add security based on threat models
- Architecture is reviewed
- Security controls proposed
Security Code Review:
- Review code
- Verify security controls
- Verify architecture requirements
Security testing
- Can the product withhold a simulated attack?
- Manual testing
- Automated tools
Monitoring and Key Performance Indicators
Logging Pipeline includes:
Collect->Stream->Analyze->Store->Access
Incident Management:
NIST 800-61
For Detection & Analysis
- Blended approach to detection
- Business-focused Metrics
- Data-driven investigations
For Containment Eradication & Recovery
- Actionable alerts
- ChatOps for Communication
- Runbooks for remediation
- Adopt infrastructure as Code (IaC)
For Post-Incident Activity:
- Keep post-mortems actionable
- Analysis phase is worthless if little or no action is taken
- Lessons learned must be reflected in incident management runbook
KPI (Key Performance Indicators) based on business needs and compliance requirements
- Availability
- Change Failure
- Change Lead Time
- Change Volume
- Customer Issue Resolution Time
- Customer issue volume
- Defected Burn Rate
- Deployment Frequency
- Logging Availability
- Mean Time Between Failures (MTBF)
- Mean Time to Failure (MTTF)
- Mean Time to Recovery (MTTR)
- Number of False Positives
- Number of False Positive
- Number of Functional/Acceptance Tests
- Number of Passed /Failed Security Tests
- Number of unit/integration Tests
- Security Benchmark Deviation
- Security Controls
- Test Coverage
- Time to Patch
- Time to Value
- Vulnerability Patching Frequency
- Vulnerability Patching Lead Time
.png){kind=link}