Downloaded 28 times
Uploaded byVMware Tanzu
Building a DevSecOps Pipeline Around Your Spring Boot Application
The document discusses building a DevSecOps pipeline for Spring Boot applications, emphasizing the integration of security into DevOps practices to address new risks from technologies like cloud and containers. It outlines two main security challenges: adapting existing security tools for new technologies and developing new security solutions. The importance of involving developers in security ownership and making security practices collaborative and automated is also highlighted.
More Related Content
![[DSC Europe 22] Lakehouse architecture with Delta Lake and Databricks - Draga...](https://cdn.slidesharecdn.com/ss_thumbnails/draganberic-lakehousearchitecturewithdeltalakeanddatabricks-221130080712-6e817e95-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to Building a DevSecOps Pipeline Around Your Spring Boot Application
Building a DevSecOps Pipeline Around Your Spring Boot Application
- 1. Building a DevSecOpsPipeline Around your Spring Boot Application Spring One Platform, 2019 Simon Maple @hayleydenb
- 2. Building a DevSecOpsPipeline Around your Spring Boot Application Spring One Platform, 2019 Simon Maple Hayley Denbraver @hayleydenb
- 3. Send Simon nicetweets: @sjmaple @hayleydenb
- 4.
- 5. Hayley Denbraver Developer Advocate,Snyk @hayleydenb snyk.io
- 6.
- 7.
- 8. DevSecOps for SpringBoot @hayleydenb
- 9.
- 10. We all loveDevOps! But Why? @hayleydenb
- 11. DevOps helps delivervalue and address market needs faster and at scale @hayleydenb
- 12. What does “doingDevOps” mean? @hayleydenb
- 13. •DevOps Technologies •DevOps Methodologies •DevOpsShared Ownership @hayleydenb
- 14.
- 15. •Securing DevOps Technologies •Securityin DevOps Methodologies •Including Security in DevOps Shared Ownership @hayleydenb
- 16. •Securing DevOps Technologies •Securityin DevOps Methodologies •Including Security in DevOps Shared Ownership @hayleydenb
- 17. Securing DevOps Technologies DevOpsCreated or Drove Adoption of new Technologies Cloud Containers Serverless Open Source Libraries @hayleydenb
- 18. Securing DevOps Technologies Theadoption of these new technologies create two main security problems. @hayleydenb
- 19. Problem 1: How dowe adapt our current tools to protect our DevOps projects @hayleydenb
- 20.
- 21.
- 22.
- 23.
- 24. How do youidentify malware or viruses in a container? @hayleydenb
- 25. End Point Protectionvia Container Host
- 26. How do you“patch your servers” in an ad-hoc, disposable container? @hayleydenb
- 27. Scan Container imagesfor OS Vulnerabilities @hayleydenb
- 28. The need toadapt is an opportunity for new players @hayleydenb
- 29. Problem 2: New technologiesintroduce new security risk that require new security solutions. @hayleydenb
- 30. Cloud introduces therisk of unsecured buckets at an unprecedented scale. @hayleydenb
- 31. An Example • ConsiderUber’s 2016 data breach • Attackers accessed the details of nearly 600,000 drivers • “Some personal info” on nearly 57 mil users was also compromised @hayleydenb
- 32. What happened? • Devpushed S3 tokens to a private GitHub repo • Attackers gained access to repo, obtained tokens • At the time, Uber wasn’t using 2FA • Attackers used tokens to steal info from S3 @hayleydenb
- 33. An Interlude Please Use2FA/MFA. Please. @hayleydenb
- 34.
- 35. New platforms alsomean new insecure configuration risks @hayleydenb
- 36. Default does notmean best @hayleydenb
- 37.
- 38. Cloud Security Config Staticand Event Scan @hayleydenb
- 39. New risk fromcontainers: Sandbox escaping! @hayleydenb
- 40.
- 42. Security for DevOpsTechnologies 1. Adapt existing tools to new tech 2. Create new tools to address new problems @hayleydenb
- 43. •Securing DevOps Technologies •Securityin DevOps Methodologies •Including Security in DevOps Shared Ownership @hayleydenb
- 44. Security in DevOpsMethodologies CI/CD Microservices @hayleydenb
- 45. Traditional Approach • Writecode for the added functionality • Turn code over to security for a review • Wait • Receive notes and issues from security that you must address • Redo a bunch of work to address changes. Play a prank on your security reviewer to vent your feelings. • Now it is Thanksgiving, so no one is around so wait some more • Release • Profit??? @hayleydenb
- 46.
- 47.
- 48.
- 49. • You keepyour traditional security review and it causes a bottle neck in your CI/CD process meaning you don’t really get the benefits from CI/CD • You scrap the security review/or say you will do it later because you are moving too fast • You find a way to practice Continuous Security @hayleydenb
- 50. Automated App SecTesting • We can automate app sec testing! • There are a few different ways to approach this. • Let’s talk about static and dynamic testing. @hayleydenb
- 51. Static Testing • Scanyour code to find potential vulnerable code paths • Scans take hours (or days) to run != builds take minutes • Adaptation: incremental scans • Run long scans ~weekly • Run “Delta” scans in the build • Still a problem with false positives… different topic! @hayleydenb
- 52. Dynamic Testing • Testsa deployed instance like a hacker to find vulnerabilities • Scans require dedicated env… often doesn’t exist. • Scans take way too long to complete • Adaptation: • IAST - instrument app, run unit-tests, deduce security issues • Less comprehensive, but works with less overhead • Very imperfect… but sometimes work @hayleydenb
- 53. Open Source KnownVulnerabilities • Flag use of libraries with known vulnerabilities • “Break build” on vulnerability or otherwise alert • Fast & accurate - naturally CI/CD friendly… @hayleydenb
- 54.
- 55. - Clear perimeter -Constrained flow - Wholesale deploys - Many perimeters - Flexible flow - Constant deploys @hayleydenb
- 56. Adaptions • Adaptation: Trackdata flows across apps @hayleydenb
- 57. Adaptions • Adaptation: Embedinstallation into deploy flow @hayleydenb
- 58. Opportunities There are positivechanges too @hayleydenb
- 59. Opportunities When a containermisbehaves… Just kill it! (It’ll start up again in no time) @hayleydenb
- 60. Opportunities Continuous Deployments mean Fastsecurity patch deployment! (contain risks faster and more safely than ever) @hayleydenb
- 61. Opportunities CI/CD means easy Automatedsecurity gating! (block secrets or vulns from passing, enforce policies, etc.) @hayleydenb
- 62. Security in DevOpsMethodologies • Adapt current security practices • Take the opportunity to leverage automation and do security better @hayleydenb
- 63. •Securing DevOps Technologies •Securityin DevOps Methodologies •Including Security in DevOps Shared Ownership @hayleydenb
- 64. DevSecOps includes security inthe ownership model @hayleydenb
- 65. The Syrian ElectronicArmy and the Financial Times @hayleydenb
- 66. 1. Phishing emailto employees who had publicly shared their email Masked link to an attacker controlled compromised site @hayleydenb
- 67. Developers were the2nd most likely to click a link in a phishing email Internal Salesforce Phishing Test run by Masha Sedova (@modMasha) @hayleydenb
- 68. Compromising a high privilegeddeveloper is hitting the jackpot @hayleydenb
- 69. 2. Link redirectsto spoofed FT Single Sign-on page (for Google Apps) Some users entered their passwords… @hayleydenb
- 70. 3. Attackers usecompromised accounts to Email more FT users this time from an FT email address More users are compromised… @hayleydenb
- 71. 4. IT findsout, sends warning email to all. Attackers send identical email - with evil links @hayleydenb
- 72. 5. Attackers gainaccess to several official Twitter accounts and blog @hayleydenb
- 73. “A sobering day” byAndrew Betts, a compromised FT developer @hayleydenb
- 74. “Developers might wellthink they’d be wise to all this – and I thought I was.” https://labs.ft.com/2013/05/a-sobering-day/ @hayleydenb
- 75. DevOps means developersare more powerful than ever @hayleydenb
- 76. • Code isshipped at a fast pace • Developers access production systems daily • Developers access user data daily @hayleydenb
- 77.
- 78. Developers cannot outsourcesecurity. Nobody else can keep up. @hayleydenb
- 79. Developers believe dev should(co)own security Source: State of open source security https://snyk.io/blog/81-believe-developers-should-own-security-but-they-arent-well-equipped/ 68% of users feel developers should own security responsibility of container images
- 80. Security tools aredesigned for security professionals @hayleydenb
- 81. Find or buildsecurity tools that developers will use @hayleydenb
- 82. Challenge: Security embraces Dev DevEmbraces Security @hayleydenb
- 83. Security • Provides devswith the tools (Dev tools!) and training they need to succeed • Sets a clear policy that is well documented, actionable • Acceptable vs. Unacceptable risk • Prioritization: What gets flagged vs. what fails the build • How are team members onboarded? • Available to support the team as security issues arise • Make issues actionable @hayleydenb
- 84. Developers • Use toolsprovided • Ask good questions and give feedback. • Understand and embrace the policy • Don’t fall into the SEP Field Trap @hayleydenb
- 85. –Douglas Adams, Life,the Universe and Everything “The Somebody Else's Problem field is much simpler and more effective, and what's more can be run for over a hundred years on a single torch battery. This is because it relies on people's natural disposition not to see anything they don't want to, weren't expecting, or can't explain.” @hayleydenb
- 86. Security in DevOpsOwnership • Find a tool or tools that developers will actually adopt • Look for ways to engage devs in security @hayleydenb
- 87. DevOps helps delivervalue and adapt to market needs faster and at scale @hayleydenb
- 88. 1. Securing DevOpsTechnologies 2. Security in DevOps Methodologies 3. Include Security in DevOps Shared Ownership @hayleydenb
- 89. Security For DevOpsTechnologies: 1. Adapt existing security tools to new tech 2. Address new security risks new tech introduced @hayleydenb
- 90. Security For DevOpsMethodologies: 1. Adapt how existing security tools are applied 2. Use the new opportunities to do security better @hayleydenb
- 91. Include Security inDevOps Shared ownership: 1. Find security tools dev will actually use 2. Look for ways to engage dev in security @hayleydenb
- 92.
- 93.
- 94.
- 95.
- 96. Thank You! Hayley Denbraver,Developer Advocate hayley@snyk.io @hayleydenb