Designing a secure software development process with DevOps

@meekrosoft
Designing a Secure SDLC
with DevOps
Mike Long @meekrosoft

@meekrosoft
Agenda
● SDLC BINGO
● What can we learn from history?
● Why define a SDLC?
● The role of DevOps
● Establishing security goals for a SDLC
● Implementation compliance controls
● Driving Security Culture with a SDLC

@meekrosoft
Spot the cargo cult!
Software Development
Life Cycle BINGO

@meekrosoft
“...the implementation
described above is risky
and invites failure”

@meekrosoft
Prince2 “This strong emphasis on tailoring has led
some users to complain that PRINCE2 is
unfalsiﬁable, i.e. it is impossible to tell
whether PRINCE2 "works" or constitutes
"best practice" if any problems encountered
with a project can be blamed on
inappropriate application of PRINCE2
rather than on PRINCE2 itself.”

@meekrosoft
Rational Unified Process
“We believe that a branded process like
RUP, or XP, is out -- because such a thing is
just a collection of practices. Instead
practices will become ﬁrst class citizens”
Ivar Jacobson
https://www.techrepublic.com/article/80-of-software-is-no-brain-work-ivar-jacobson/

@meekrosoft
SCRUM
“I really am coming to think that software
developers of all stripes should have no
adherence to any “Agile” method of any
kind”
Ron Jeffries
https://ronjeffries.com/articles/018-01ff/abandon-1/

@meekrosoft
What can we learn from
history?

@meekrosoft
All have a diagram

@meekrosoft
All will eventually be ridiculed
(often by their creators)
“...the implementation
described above is risky and
invites failure”
“This strong emphasis on tailoring has led
some users to complain that PRINCE2 is
unfalsiﬁable, i.e. it is impossible to tell
whether PRINCE2 "works" or constitutes
"best practice" if any problems encountered
with a project can be blamed on
inappropriate application of PRINCE2
rather than on PRINCE2 itself.”
“We believe that a branded process like RUP, or XP, is
out -- because such a thing is just a collection of
practices. Instead practices will become ﬁrst class
citizens”
Ivar Jacobson
https://www.techrepublic.com/article/80-of-softwar
e-is-no-brain-work-ivar-jacobson/
“I really am coming to think that software developers of all
stripes should have no adherence to any “Agile” method of
any kind”
Ron Jeffries
https://ronjeffries.com/articles/018-01ff/abandon-1/

@meekrosoft
Subject to confirmation bias
http://chainsawsuit.com/comic/2014/09/16/on-research/

@meekrosoft
Encourage template thinking

@meekrosoft
Why define a SDLC in the
first place?

@meekrosoft
Great advice for entrepreneurs,
terrible advice if you make
software that can:
● Control economies
● Drive cars
● Control insulin
● Manage critical infrastructure

@meekrosoft
Regulated Industries

@meekrosoft
§1.1 Regulations

@meekrosoft
ACME Corp.
Translate into
processes
Continuous
Documentation
Meetings and
Signoffs
§1.1 Regulations

@meekrosoft
Compliance with Standards
● Ensure that products and
services are safe, reliable
and of good quality.
● Reduce costs by
minimizing waste and
errors and increasing
productivity.
● Help companies to access
new markets

@meekrosoft
Defined Processes Improve Quality
“Checklists seem to provide
protection against such
failures. They remind us of the
minimum necessary steps
and make them explicit. They
not only offer the possibility of
verification but also instill a
kind of discipline of higher
performance.”

@meekrosoft
SW Compliance across the value stream
Confidential - Do Not Share
Scope Product
Management
Software
Development
IT Operations

@meekrosoft
So how do we get rid of
“silos, batches, queues
and gates” while staying
compliant?

@meekrosoft
The role of DevOps
in Compliance
A short introduction

@meekrosoft
DevOps is a SocioTechnical System

@meekrosoft
Compliance ALSO is a SocioTechnical
System

@meekrosoft
Compliance ALSO is a SocioTechnical
System
?

@meekrosoft
Change Advisory Board

@meekrosoft
We found that external approvals were negatively
correlated with lead time, deployment frequency,
and restore time, and had no correlation with
change fail rate. In short, approval by an external
body (such as a manager or CAB) simply doesn’t
work to increase the stability of production systems,
measured by the time to restore service and change
fail rate. However, it certainly slows things down. It is,
in fact, worse than having no change approval
process at all.
Forsgren PhD, Nicole. Accelerate: The Science of Lean Software and DevOps: Building and Scaling High Performing
Technology Organizations . IT Revolution Press. Kindle Edition.
Change Advisory Board

@meekrosoft
The Risk
“The absence of change
approval controls creates
the risk of untested and
unauthorized code being
introduced into
production.”

@meekrosoft
The Challenge
“Companies that decide
to move to a DevOps
model find the transition
difficult as manual
processes become
blockers for rapid rates of
change.”

@meekrosoft
The Reality
“PCI/DSS requirement is to
use two different
accounts, not necessarily
two different human
beings.”

@meekrosoft
“we find that the conflict
[between DevOps and Audit]
is just a perception ...
DevOps in fact can be
considered as a practice
that offers better
Audit/Compliance as
compliance.”

@meekrosoft
Compliance As Code
https://www.youtube.com/watch?v=A8Qwu1bYIO8

@meekrosoft
Establishing security
goals for a SDLC

@meekrosoft
● Code reviews
● Coding Standards
● Verifiable builds
● Test coverage
● Static Analysis
● Vulnerability Scanning
● Verifiable deployments
Conformance to process

@meekrosoft
Audit Traceability
ACME Corp.
Translate into
processes
Continuous
Documentation
Meetings and
Signoffs
§1.1 Regulations

@meekrosoft
Immutable Infrastructure + Hash == Traceability
“If everything is source code, no-one needs access to production”
@topopal
Immutable infrastructure
Software
package hash

@meekrosoft
Standard Tooling
● Lowers attack surface
● Faster to onboard new users
● “Rising tide lifts all boats”

@meekrosoft
Software Assurance Maturity Model.
https://owaspsamm.org

@meekrosoft
Implementing
compliance controls

@meekrosoft
Step 0: Value Stream Mapping

@meekrosoft
Step 1: Define your (automated) process
Process
Scope Product
Management
Software
Development
IT Operations
Nexus
Jenkins
Cucumber
SonarQube
Docker
Crucible
Bitbucket

@meekrosoft
Step 2: Locate
the data

@meekrosoft
compliancedb.comcompliancedb.com
Step 3: Automate the Audit Trail
System of
Record
Build
Test
Security
Analysis
Deploy to
Staging
Release
Candidate?
Create Artifact
Code Review Data
Unit Test Result
Functional Test Result
Analysis Result
Deployment Result
Compliance State

@meekrosoft
Step 4: Enforce compliance in the
pipelines
master

@meekrosoft
Step 5: Automate Release
Controls and Audit
Documentation
compliancedb.com
master
Release2?Release1

@meekrosoft
Step 6: Use the
time you used to
spend on
meetings and
paperwork to
catch up on the
latest devops
cr*p

@meekrosoft
Driving Security Culture
with a SDLC

@meekrosoft
740Over 740 applications going through one delivery pipeline
Aim for one pipeline

@meekrosoft
Google Binary Authentication for Borg
BAB
Product
Management
Software
Development
Release Control Production

@meekrosoftWith DevOps you CAN comply!

Designing a secure software development process with DevOps

More Related Content

What's hot

Similar to Designing a secure software development process with DevOps

More from Mike Long

Recently uploaded

Designing a secure software development process with DevOps