More Related Content
Similar to DevSecOps with Microsoft Tech
DevSecOps with Microsoft Tech
- 1. DevSecOps with MicrosoftTech Darin Morris @techdevdari n in/darinmorris
- 2. In General: What we’regoing talk about 2. How “doing DevOps” affects how we secure Data and Computer-centric Information Systems In Particular: 1. What it really means to do DevOps Thoughts I’ve had around DevOps and Security
- 3. Motivation for thistalk • I want “information technology practitioners” to become more professional, more productive and happier at work. Many reasons, but some of the more major reasons are: • Information systems need to be of higher quality and delivered faster – we need to really understand the DevOps philosophy to do that well. • Security is often an afterthought in the IT systems lifecycle – that needs to change. • We need a common language – not buzzwords.
- 5. DevOps and Securityare very broad domains!
- 6. SOMEONE ONCE TOLDME NOT TO BITE OFF MORE THAN I COULD CHEW… I said I’d rather CHOKE ON GREATNESS THAN NIBBLE ON MEDIOCRITY.
- 7. Let’s get toknow each other a little better!
- 8. Fun facts aboutme Most used programming languages: C#, JavaScript “SiliconCape Native” First PC: Pentium 1 with Windows 95 First programming language: Java (JDK 1.3)
- 9. Professional background • I’ma self-taught “Technologist” and I solve problems using technology. • I've been a founder, manager, team lead and software engineer, in various sectors, and in teams of different shapes and sizes. • Microsoft Certified Professional • Certified ScrumMaster • In the process of completing CSSLP, ITIL and ISTQB certifications. • Member of a number of professional IT associations and bodies i.e. OWASP, ISACA, IITPSA • Fulltime full stack software engineer for the past 13 years, primarily focussed on web and cloud-native software.
- 10. OK! Less aboutme. More about you!
- 11. Sales or Relationship Management Doesthis sound like your role? Marketing Finance Leadership (C-Suite) Human Resources Business Analyst / Big Data Analyst General Administrator In-house Legal
- 12. Project Manager or CoordinatorProduct Manager/Owner Software Architect Software Engineer Test Engineer Provision and Manage IT Infrastructure (IT Ops) Does this sound like your role? Dedicated Security or Compliance Something else? ?
- 13. Let’s play agame!
- 14. True or False? DevOpsis only done by technical staff. Question #1
- 15. True or False? DevOpsis a Role. Question #2
- 16. True or False? DevOpsis a way of thinking about how we do work. Question #3
- 17. It’s DevOps –not DevITOps (Nor is it BizDevOps or DevTestOps or OpsDev or even DevSecOps)
- 18. Things DevOps isassociated with
- 19. What is DevOpsreally?
- 20. • DevOps Principlesand Practices are compatible with Agile • DevOps is a logical continuation of Agile • Agile serves as an effective enabler of DevOps Myth #1: DevOps replaces Agile
- 21. • Can bemade compatible - many areas just become automated. Myth #2: DevOps is incompatible with ITIL
- 22. • Controls are integratedinto every stage of daily work of the SDLC resulting in better quality and security and compliance outcomes. Myth #3: DevOps is incompatible with InfoSec and Compliance Image credit: Checkmarx Software Exposure platform (www.checkmarx.com)
- 23. • Rarely thecase. Nature of IT Operations work just changes. • Collaborates far earlier in SDLC with development. • Enables developer productivity through APIs and self-service platforms that create environments, test and deploy code, monitor and display production telemetry, etc. • IT Ops become more like Development • i.e. engaged in product development for developers. Myth #4: DevOps means eliminating IT Operations
- 24. • “DevOps isn’tabout automation, just as astronomy isn’t about telescopes” - Christopher Little Myth #5: DevOps is just Infrastructure as Code
- 25. DevOps is aboutTeam Work that enables efficient creation of value What DevOp really boils down to
- 26. Not convinced? Read thesebooks Gene KimPatrick Debois John Willis Jaz Humble Kevin Behr George Spafford
- 27. So where does Securityfit in?
- 28. Security and DevOps- DevSecOps? • Security is fundamentally about mitigating risk (you’ll never be 100% secure). • Mitigating risk is enabled by maintaining integrity, availability and confidentially. • Security principles haven’t changed, the way we implement security has.
- 29. Security Fail Securely Minimize attack surface Least Privilege Auditing KeepThings Simple (Economy of mechanism) Confidentiality Psychological Acceptability Availability Single Point of Failure Defense in Depth Leverage Existing Components Open Design Complete Mediation Security Principles and Concepts Separation of duties/privilege Integrity
- 30. Where is Securityand Compliance applied?
- 31.
- 32. Key Take-aways! 1. DevOpsis primarily about a culture of teamwork that enables efficient creation of value at all levels of an organization. 2. Security principles haven’t changed, security and compliance just happens more often and at more localized scale.
- 33.
Editor's Notes
- #3 Aims: 1.1. Cover key principles. 1.2. Take audience on a journey to my AHA moment. 2. Delve into the impact of DevOps on security Clarify Terms and Concepts (Information Technology, Technology, DevOps, QA, Security) Provoke reflection on the way the audience currently does work and thought about what can be done better. Drive home the importance of security in software
- #4 Is a pen and paper information technology?
- #5 Disclaimer 1: I’ve been thinking about this stuff a lot lately, but I’m probably ignorant to something. There is enough content to write about, never mind a short talk.
- #6 Disclaimer 2: There is potentially a lot we could cover, but we have very little time.
- #7 I make joke. Har har.
- #15 Answer: False Reason: DevOps isn't any single person's job. It's everyone's job.
- #16 Answer: False Reason: DevOps isn't any single person's job. It's everyone's job.
- #17 Answer: False Reason: DevOps isn't any single person's job. It's everyone's job.
- #19 DevOps is a lot like the Standard Model of particle physics.
- #21 Agile Toronto Conference 2008 Patrick Debois coined to the term DevOps when he organized the first DevOpsDays conference in 2009.
- #30 DevOps is a lot like the Standard Model of particle physics
- #31 DevOps is a lot like the Standard Model of particle physics