RoboCop: Bringing Law and Order to CI/CD

© 2016 ELLUCIAN. 1

RoboCop

Bringing Law and Order to CI/CDFranklin Mosley

© 2016 ELLUCIAN. 2

• Information Security Professional

• Software Engineer

• Enjoy Capture the Flag

• Movie and Trivia Enthusiast

Who Am I?

© 2016 ELLUCIAN. 3

Agenda

1 RoboCop

2 DevSecOps

3 Security Tools

4 Case Study

© 2016 ELLUCIAN. 4

RoboCop

© 2016 ELLUCIAN. 5

RoboCop Locations

Film: Detroit City HallActual: Dallas Municipal Bldg

116 S. Harwood St.

Film: OCP BuildingActual: Dallas City Hall, 1500

Marilla St

© 2016 ELLUCIAN. 6

RoboCop’s Prime Directives

© 2016 ELLUCIAN. 7

Serve the Public Trust

Excuse me. I have to go. Somewhere there is a crime happening.RoboCop “RoboCop”

• Business Driven Security• Open Collaboration• Leaning In• Translate Security for the Layperson

© 2016 ELLUCIAN. 8

Protect The Innocent

Come quietly or there will be… troubleRoboCop “RoboCop”

• Developers are not security experts• Security can be an afterthought• Developers are lazy

© 2016 ELLUCIAN. 9

Uphold The Law

• What are your policies?• What are your standards?• Security Gates

You are illegally parked on private property. You have twenty seconds to move your vehicle.

ED-209 “RoboCop”

© 2016 ELLUCIAN. 10

DevSecOps at Ellucian


Achieving student success advances our entire society


40years

2,400institutions

18,000,000students

40countries


How We Define DevOps

People working together with a common set of tools & goals to achieve the best customer experience


DevSecOps

DevSecOps: automation of security tasks by embedding security controls and processes into the DevOps workflow


Application Security Testing Technologies

Dynamic InteractiveStatic


Static Application Security Testing (SAST)

Pros ConsShows vulnerabilities at their source

False Positives

No need for code compilation

May report findings that can’t be exploited


Dynamic Application Security Testing (DAST)

Pros ConsShows vulnerabilitiesexposed in real-time

Cannot identify location for remediation

No need for source code May not cover all areasof the application

Detects vulnerabilities on client and server-side

Must rebuild the application when modifying code


SAST vs. DAST

SAST• Poor crypto implementation• Issues in dead/unused code• Hard coded secrets

DAST• Environment configuration issues

• Authentication issues• Session management issues

• Runtime privilege issues

SAST & DAST• SQLi• Cross-site Scripting• Path Traversal• Buffer Overflows• HTTP Response Splitting


Interactive Application Security Testing (IAST)

Pros ConsCan enhance DAST Can’t run on its ownMay identify vulnerable lines of code

Has to be integrated with the application



Other Resources

Enterprise DevOps at Scale with AWS | AWS Public Sector SummitEllucian has been migrating its entire organization from a myriad of software delivery mechanisms, many of them manual, to a highly automated and advanced suite of DevOps tools. In this talk, we go over some of the challenges we have faced and also discuss our thoughts on the evolution of DevOps and the emerging patterns of managing AWS-based environments.https://youtu.be/MqP1lU39jcM

DevOps on the AWS CloudLearn how REAN Cloud helped AWS customer Ellucian develop a DevOps framework to transform their software delivery process for over 80 product lines.https://youtu.be/071rB05Oj9g


Choose technologies that meet your business

needs and processes

Make security a feature

Summary

Automate as much as possible


Thank you.

Franklin [email protected]

https://www.linkedin.com/in/franklinmosley

Technology

RoboCop: Bringing Law and Order to CI/CD