Extending DevSecOps Security Controls into the Cloud...Extending DevSecOps Security Controls into...

Extending DevSecOps Security Controls into the Cloud:

A SANS Survey

Today’s Speaker

• Eric Johnson– Senior SANS instructor and co-author of SANS courses SEC540, 510, and 584– Principal Security Engineer, Puma Security

Attend the Panel DiscussionExtending DevSecOps Security Controls into the Cloud:

A Panel Discussion of the 2020 SANS Survey

Wednesday, November 4, 20201 PM Eastern Time

https://www.sans.org/webcasts/114630

Today’s Agenda1. Cloud & DevSecOps Landscape2. Shift Left Analysis3. Shift Right Analysis4. Moving Forward

1. Cloud & DevOps Landscape

• 74% of organizations are delivering changes to production more than once per month.

• 14% increase in velocity during the past 4 years

Increasing VelocityYear-over-year comparison of how often changes are deployed to production systems:

Increasing Cloud AdoptionDelivery increases as systems transition to the cloud provider's responsibility model.

Most organizations (92%) use at least one public cloud provider, with slightly more than 60% using three or more public cloud providers. Why?

• Corporate mergers & acquisitions• Select the best platform/service available• Avoid cloud vendor lock-in

Multiple Cloud Providers

SECURITY IMPACT

MULTIPLE CLOUD PLATFORMS

COMPOUNDS SECURITY RISKS

• JavaScript leaps into the top position as cloud & microservice adoption increases.

• Java, .NET, C++ continue to remain high-risk due to legacy usage.

Increasing Platform RisksDevelopment programming languages present risk to application security teams:

27% of organizations do not perform security assessments at all.

Security vs. Delivery

Are security teams shifting right and learning how to harden public cloud?• Operations• Monitoring• Runtime security controls

Security vs. the Cloud

2. Shift Left Analysis

• Risk Assessments & Threat Modeling• Developer Security Training• Manual Code Review• Security Stories• Dependency/Supply Chain Analysis

Top 5 Shift Left Controls

Organizations are shifting to cloud native & cloud hosted Continuous Integration (CI) solutions:

Continuous Integration Tools

• Organizations are avoiding the complexity and overhead involved with installing, managing and hardening Docker and Kubernetes services.

Container Orchestration Tools

• Less than 40% of organizations shift security reviews into upfront requirements & design.

Security Testing Phases

3. Shift Right Analysis

• Configuration Security Monitoring• Vulnerability Scanning• Container Image Scanning• Web Application Firewalls (WAF)/Next Gen WAF• Network Detection & Response/Network Traffic Analysis

Top 5 Shift Right Controls

• Security teams (internal & external) still conduct most testing.• Security testing cannot scale at the velocity of DevOps.• Development and cross-functional teams must contribute more.

Security Testing Responsibility

Top DevSecOps Key Performance Indicators:• Time-to-fix• Security issues found

after deployment• Time-to-detect

Measuring Program Success

• Less than half of organizations are repairing critical vulnerabilities satisfactorily and in a timely manner.

Mean Time To Recover (MTTR)

4. Moving Forward

Major challenges are fundamentally organizational:• Insufficient budget• Shortage of security skills

and security training• Organizational silos• Lack of buy-in from

management and development teams

Organizational Challenges

• Securing buy-in from managers and developers

• Improving communications across disciplines

• Moving into the cloud can help organizations become more agile and secure.

Top Success Factors

Shift right in order to improve success shifting left:

Conclusions

Create a control plane for enforcing security and compliance.

Automation & Tooling

Collect attack data to identify real risks that need to be defended.

Test Coverage

Help security and compliance move at the speed of DevOps.

Cloud Platforms

Understand gaps in testing and controls, and shift left to improve process design and tooling.

Production Weaknesses

Please use GoToWebinar’s Questions tool to submit questions to our panel.

Send to “Organizers” and tell us if it’s for a specific panelist.

And to our attendees, thank you for joining us today!

AcknowledgmentsThanks to our sponsors:

Extending DevSecOps Security Controls into the Cloud...Extending DevSecOps Security Controls into...

Documents

DevSecOps of Containerization

A Cybersecurity Engineering Strategy for DevSecOps

DevSecOps SG Introduction - August Meetup

Enterprise Cloud Security via DevSecOps

DevSecOps and the Public Sector

Putting the Sec in DevSecOps

A DevSecOps Guide - Bitpipe... A DevSecOps Guide • 3 DevSecOps: Making It Happen After understanding the value of a DevOps mindset, making the cultural shift and reaping the benefits,

CSA - DevSecOps v1 compressed//aws.amazon.com/blogs/devops/implementing-devsecops-using-aws-codepipeline/ CodePipeline security group ... CSA - DevSecOps v1 compressed Created Date:

Does DevSecOps really exist?

DoD Enterprise DevSecOps Fundamentals · 2021. 6. 11. · DevSecOps, including normalized definitions of DevSecOps concepts. Other pertinent information is captured in corresponding

DevSecOps – Agility with Security...4 DevSecOps – Agility with Security In summary, DevSecOps aims to be a movement that extends all of the organisational benefits achieved through

DISA DevSecOps Enterprise Strategy · Web view2021/07/30 · A DevSecOps New World This document focuses on the DISA Enterprise DevSecOps Strategy to secure the Department of Defense

Humanising DevSecOps

DevSecOps Fundamentals Playbook

Presentation: DoD Enterprise DevSecOps Initiative

The Journey to DevSecOps

DevOps, DevSecOps, and vArmour - Whitepaper DevSecOps, and... · DevOps and DevSecOps DevOps has become a well established practice within many organizations. It aims to improve the

DevSecOps Fundamentals

DevSecOps Singapore introduction

DevSecOps in 10 minutes