FUTURESTACK13: AppSec in a DevOps World from Shaun Gordon, Director of Information Security & Compliance at New Relic

AppSec in a DevOps WorldSHAUN GORDONNEW RELIC DIRECTOR OF INFORMATION SECURITY & COMPLIANCE

OCTOBER 23, 2013

Wednesday, November 6, 13


Speed


Speed

SecurityWednesday, November 6, 13

Speedvs.

SecurityWednesday, November 6, 13


Accelerating Development Cycles


Accelerating Development CyclesBoxed Software

Waterfall1 Year


Accelerating Development CyclesWeb 1.0Waterfall3 months



Agile Web 2.04 week



DevOps2x week


Accelerating Development Cyclesdaily Continuous

DeploymentDevOps


Accelerating Development CyclesContinuous Deployment

DevOpshourly



hourlyContinuous Deployment

DevOps



3 monthsAgile4 week

Waterfall



3 monthsAgile4 week

Waterfall



hourlyContinuous Deployment

DevOps

daily


Traditional (Waterfall) SDLCRequirements Design Development Tes2ng Release Produc2on



Define functional (features) and non-functional requirements (capabilities)



Translate requirements into architecture and detailed design



Build it!



Ensure functional and non-functional requirements



Ship or push live



Maintain and patch as needed


Traditional (Waterfall) SDLC SecurityWednesday, November 6, 13

Traditional (Waterfall) SDLC Security

CheckpointsControls

Formal Processes


Traditional (Waterfall) SDLC SecurityRequirements Design Development Testing Release Production

• Functional & Non-Functional security requirement

• Architectural Review

• Threat Modeling

• Secure Coding Practices

• Static Analysis• White Box

Testing

• Dynamic Analysis

• Requirements Testing

• Penetration Testing

• Security Assessment

• Security Sign-Off

• Vulnerability Scanning






• Threat Modeling



Testing












• Threat Modeling



Testing












• Threat Modeling



Testing












• Threat Modeling



Testing












• Threat Modeling



Testing












• Threat Modeling



Testing












• Threat Modeling



Testing












• Threat Modeling



Testing












• Threat Modeling



Testing












• Threat Modeling



Testing












• Threat Modeling



Testing












• Threat Modeling



Testing












• Threat Modeling



Testing












• Threat Modeling



Testing










• Separation of Duties• Management Release Sign-Off• Limits on Production Access



• Threat Modeling



Testing













• Threat Modeling



Testing













• Threat Modeling



Testing









Continuous Deployment Security



Low to No friction (can’t slow us down)Transparent No significant changes to development processesMake us More Secure

Requirements



Low to No friction (can’t slow us down)Transparent No significant changes to development processesMake us More Secure

AutomationTraining & EmpowermentLightweight ProcessesTriageQuickly Detect & Respond

Requirements Strategies & Tactics





• Threat Modeling



Testing










Continuous Deployment SecurityRequirements Design Development Testing Release Production



• Threat Modeling



Testing










Continuous Deployment SecurityRequirements Design Development Testing Release Production



• Threat Modeling



Testing










Continuous Deployment SecurityProduction



• Threat Modeling



Testing









Development, Testing, & ReleaseRequirements & DesignRequirements Design Development Testing Release Production



• Threat Modeling



Testing









Continuous Deployment SecurityProduction



• Threat Modeling



Testing









Development, Testing, & ReleaseRequirements & Design





• Threat Modeling



Testing









ProductionDevelopment, Testing, & ReleaseRequirements & Design





Testing










• Threat Modeling

• Required Security Evaluation


Required Security Evaluation

1.Technical Overview2.Business Context3.Developer Concerns

< 25 Minute Meeting


Security Evaluation Outcomes



• Low Risk• Simple Guidance



• Higher Risk• Deep Dive• Whiteboarding• Threat Model


Security Evaluation Follow-Up


Security Evaluation Follow-Up

• Document• Follow Up




• Threat Modeling



Testing















Testing










• Lightweight Targeted Threat Modeling


Threat Modeling


Threat Modeling

Identify your assets and the threats against them


Threat Modeling

Identify your assets and the threats against them

Focus your resources on the greatest risks


Threat Modeling @ New Relic



Decompose your Application



Decompose your ApplicationIdentify your Assets




Enumerate your Threats




Enumerate your ThreatsRate & Rank your Threats




Enumerate your ThreatsRate & Rank your Threats

Address or AcceptWednesday, November 6, 13





Testing
























• Security Libraries & Services


Testing



Secure Libraries & Services

Authentication ServiceSecurity Event Logging ServiceInput Validation Regex Patterns

Encryption Libraries





Testing



























• Automated Static Analysis

• White Box Testing



Brakeman+

Jenkins

brakemanscanner.orgWednesday, November 6, 13




• White Box Testing




























• Testing Tools & Training


















































• Continuous Scanning in Test, Staging, & Production• Required Security Evaluation














• Continuous Scanning in Test, Staging, & Production







































































• Automated Commit Triage




Triage Process

Dangerous MethodsSensitive ModulesSecurity Keywords


























• Quick Detection & Recovery
















• Accountability• Management Release Sign-Off• Limits on Production Access







Continuous Deployment SecurityProductionDevelopment, Testing, & ReleaseRequirements & Design





• Accountability• Management Release Sign-Off• Limits on Production Access












• Accountability• Sidekick Process• Limits on Production Access















Two Sets of (masked) eyes on every changeWednesday, November 6, 13

• Accountability• Sidekick Process• Limits on Production Access






















• Accountability• Sidekick Process• Enabling Tools



























Powered By...


Powered By...

AutomationTraining & Empowerment

Lightweight ProcessesTriage

Quick Detection & Response


Auditors


Auditors

Compensating Controls


Auditors

Compensating Controls

Tell the Story


Thank You!


Thank You!

[email protected]

[email protected]


mailto:[email protected]






Image AttributionSlide 14Checkpoint Rheinpark by h1p://www.flickr.com/photos/kecko/3179561892/


http://www.flickr.com/photos/kecko/3179561892/

http://www.flickr.com/photos/kecko/3179561892/

Technology

FUTURESTACK13: AppSec in a DevOps World from Shaun Gordon, Director of Information Security & Compliance at New Relic