DevSecOps Why Aren t You Doing It? Brian Liceaga, CISSP 1
|
|
- Duane Powers
- 5 years ago
- Views:
Transcription
1 DevSecOps Why Aren t You Doing It? Brian Liceaga, CISSP 1
2 Agenda State of DevOps Value of DevOps Benefitting from DevOps DevSecOps What you can do as InfoSec 2
3 The State of DevOps Automation is a huge boon to organizations. DevOps applies to all organizations. Lean product management drives higher organizational performance. High performers vs low performers: 46 times more frequent code deployments. 440 times faster lead time from commit to deploy. 96 times faster mean time to recover from downtime. 5 times lower change failure rate (changes are 1/5 as likely to fail). 3
4 Problems that continue to affect InfoSec teams Are any of these issues affecting your company? Slow patching processes (all systems not just external servers!) Lack of visibility into the changes being made in applications and systems Lack of or slow BC/DR execution abilities Disconnect between Infra/App Dev and Security Security being left behind in Agile Infra is making security decisions everyday without the Security team Security policies, processes, procedures seen as red tape Organizations adopting new technologies without Security input Traditional on-prem tooling not compatible with cloud 4
5 The Value of DevOps Infrastructure as Code - Defining and managing system configuration through code that can be versioned and tested in advance, rather than using a manual process. Continuous Delivery - Using Continuous Integration and test automation to build pipelines from development to test and then to production provides an engine to drive change. Continuous monitoring and measurement - Creating feedback loops from production back to engineering, collecting metrics, and making them visible to everyone to understand how the system is actually used and using this data to learn and improve. Learning from failure Since failure will happen, using it as learning opportunities to improve through constructive postmortems. 5
6 Wait this stuff sounds pretty good maybe security benefit too! 6
7 Benefitting from DevOps! Infrastructure as Code Less humans clicking around in the IaaS management console! Automatically enforce security policies at runtime BC/DR dream come true Continuous Delivery Code flaws are detected and patched sooner Continuous monitoring and measurement Testing what security controls work best in your environment Insight into security threats and enable Attack-Driven Defense Learning from failure Continuously red teaming (constant state of compromise) More resilient systems and more resilient organizations 7
8 Immutable Infrastructure Cattle vs. Kittens Destroy virtual servers with each deploy so updated code goes on new, patched servers. Don t give malware a habitat to thrive in Removing access to production servers/containers vs. 8
9 Environment Evolution Physical Servers -> Virtual Machines Monolithic Apps Service Oriented Architectures Microservices Onprem Cloud (XaaS offerings) Servers Containers Serverless? 9
10 Keeping Up With Velocity DevOps and Agile move fast MVPs should have security too Establishing approved code committers Ensure all activity is being centrally logged VCS, IaaS API calls, flow logs, correlate server logs with metadata tags, etc. No sensitive data should be logged! Bring knowledge/credibility to the table Befriend the Product Managers! Security awareness 10
11 Shifting Security to the Left 1. Culture of Collaboration Built-in vs Bolt-on 2. Translate Paper into Code 3. Fanatical Testing and Instrumentation 4. Provide Intuitive Security Measurement 5. Continuous Science 11
12 The Art of DevSecOps Names don t matter...actions do! SecOps? DevOps? TechOps? DevSecOps? DevOpsSec?...Krav Maga? Source: DevSecOps Foundation 12
13 The Security Funnel 13
14 Continuous Science 14
15 Security as Code 1. Pre-commit 2. Commit / CI Threat modeling IDE checks/ secure coding Peer review SAST Software composition analysis Abuse/misuse cases Git-secrets 3. QA and Acceptance DAST Automated security attacks (e.g. Fuzzing, Gauntlet) Configuration management 4. Prod Deploy / Post- Deploy Configuration management Continuous vulnerability scanning Automated runtime defense 15
16 Compliance as Code Compliance as Code tries to minimize paperwork and overhead (but yes you still need an IS policy!) Assess infrastructure s adherence to compliance requirements and monitor it on an ongoing basis Policies and rules are enforced and tracked through automated controls AWS Inspector 16
17 Automating Corrective Action Working Smarter More prevention less investigation Adopting DevSecOps 24x7 Proactive Security Monitoring over Reacting after being Informed of an Incident Our Approach AWS Lambda is triggered based on security policy violations Corrective action to contain incident
18 Automating Corrective Action - Use Case MFA is Removed User removes MFA Triggers Lambda Lambda revokes all IAM access for the account in violation X X X X X
19 DevSecOps Manifesto 1. Leaning in over Always Saying No 2. Data & Security Science over Fear, Uncertainty and Doubt 3. Open Contribution & Collaboration over Security-Only Requirements 4. Consumable Security Services with APIs over Mandated Security Controls & Paperwork 5. Business Driven Security Scores over Rubber Stamp Security 6. Red & Blue Team Exploit Testing over Relying on Scans & Theoretical Vulnerabilities 7. 24x7 Proactive Security Monitoring over Reacting after being Informed of an Incident 8. Shared Threat Intelligence over Keeping Info to Ourselves 9. Compliance Operations over Clipboards & Checklists 19
20 What can you do as InfoSec? A New and Improved Security Team Adopt DevOps mindset (if your org isn t doing it, then push for it or lead it within InfoSec) Redefine your role and relationships with the company Enabling DevSecOps requires a team of engineers instead of analysts Train existing analysts in DevOps and automation Operate in a constant state of compromise Fail fast and adapt quickly 20
21 THANK YOU! Contact: Brian Liceaga, CISSP Evolvesecurity.io 21
22 References DevSecOps.org DevOpsSec by Jim Bird. Published by O'Reilly Media, Inc., 2016 Flaticon 22
DevOps Anti-Patterns. Have the Ops team deal with it. Time to fire the Ops team! Let s hire a DevOps unit! COPYRIGHT 2019 MANICODE SECURITY
DevOps Anti-Patterns Have the Ops team deal with it. Time to fire the Ops team! Let s hire a DevOps unit! 31 Anti-Pattern: Throw it Over the Wall Development Operations 32 Anti-Pattern: DevOps Team Silo
More informationSecurity as Code: The Time is Now. Dave Shackleford Founder, Voodoo Security Sr. Instructor, SANS
Security as Code: The Time is Now Dave Shackleford Founder, Voodoo Security Sr. Instructor, SANS Introduction Business is moving faster to the cloud, and DevOps is accelerating scale and pushing automation
More informationDevelopment. Architecture QA. Operations
Development Architecture QA Operations Lack of business agility Slow to onboard new customers Hard to practice true DevOps Outpaced by disruptors Rogue dev projects Lack of SecOps agility Slow threat assessments
More informationLogging, Monitoring, and Alerting
Logging, Monitoring, and Alerting Logs are a part of daily life in the DevOps world In security, we focus on particular logs to detect security anomalies and for forensic capabilities A basic logging pipeline
More informationWeaving Security into Every Application
Weaving Security into Every Application Paul Fox AVP Technology AT&T 2018 TM Forum 1 Cyber Security Accelerating Threat Telecom Breaches 300,000 Number of complaints filed with the FBI Internet Crime Complaint
More informationTHE IMPACT OF HYBRID AND MULTI CLOUDS TO CYBERSECURITY PRIORITIES
SESSION ID: STR-R14 THE IMPACT OF HYBRID AND MULTI CLOUDS TO CYBERSECURITY PRIORITIES Doug Cahill Group Director and Senior Analyst Enterprise Strategy Group @dougcahill WHO IS THIS GUY? Topics The Composition
More informationAzure DevOps. Randy Pagels Intelligent Cloud Technical Specialist Great Lakes Region
Azure DevOps Randy Pagels Intelligent Cloud Technical Specialist Great Lakes Region What is DevOps? People. Process. Products. Build & Test Deploy DevOps is the union of people, process, and products to
More informationStrengthen and Scale security using DevSecOps
OWASP Indonesia Meetup Strengthen and Scale security using DevSecOps $ www.teachera.io!"# @secfigo % secfigo@gmail.com # whoami Author, Speaker and Community Leader. Speaker/Trainer at Blackhat, AppSec EU,
More informationAspirin as a Service: Using the Cloud to Cure Security Headaches
SESSION ID: CSV-T10 Aspirin as a Service: Using the Cloud to Cure Security Headaches Bill Shinn Principle Security Solutions Architect Amazon Web Services Rich Mogull CEO Securosis @rmogull Little. Cloudy.
More informationUnify DevOps and SecOps: Security Without Friction
SANS Secure DevOps Summit Unify DevOps and SecOps: Security Without Friction Matt Alderman, CISSP Chief Strategy & Marketing Officer Layered Insight @maldermania Technology Trend #1: Infrastructure Migrates
More informationCOMPLIANCE AUTOMATION BRIDGING THE GAP BETWEEN DEVELOPMENT AND INFORMATION SECURITY
COMPLIANCE AUTOMATION BRIDGING THE GAP BETWEEN DEVELOPMENT AND INFORMATION SECURITY Published January, 2018 : BRIDGING THE GAP BETWEEN DEVELOPMENT AND INFORMATION SECURITY Speed is nothing without control.
More informationSecure DevOps: A Puma s Tail
Secure DevOps: A Puma s Tail SANS Secure DevOps Summit Tuesday, October 10th 2017 Eric Johnson (@emjohn20) Eric Johnson, CISSP, GSSP, GWAPT Cypress Data Defense Principal Security Consultant Static code
More informationAn SDLC for the DevSecOps Era Or SecDevOps, or DevOpsSec,
An SDLC for the DevSecOps Era Or SecDevOps, or DevOpsSec, or zane@signalsciences.com @zanelackey Who you ll be heckling today Started out in offense Pentester / researcher at isec Partners / NCC Group
More informationApplication Security at Scale
Jake Marcinko Standards Manager, PCI Security Standards Council Jeff Williams CTO, Contrast Security Application Security at Scale AppSec at Scale Delivering Timely Security Solutions / Services to Meet
More informationSuman Sourav Director DevSecOps, Vantage Point Security. OWASP Indonesia Day 2017
Suman Sourav Director DevSecOps, Vantage Point Security OWASP Indonesia Day 2017 About me Certified Secure Software Lifecycle Professional (CSSLP) 12+ Years of Experience in Software Security Co-Founder
More informationOvercoming the Challenges of Automating Security in a DevOps Environment
SESSION ID: LAB-W02 Overcoming the Challenges of Automating Security in a DevOps Environment Murray Goldschmidt Chief Operating Officer Sense of Security @ITsecurityAU Michael McKinnon Director, Commercial
More informationCloud is the 'Only' Way Forward in Information Security. Leveraging Scale to Make the Unknown Known, in Dev, Sec & Ops.
George Gerchow, Sumo Logic Chief Information Security Officer Cloud is the 'Only' Way Forward in Information Security. Leveraging Scale to Make the Unknown Known, in Dev, Sec & Ops. Agenda Sumo Security
More informationDatabase Engineering. Percona Live, Amsterdam, September, 2015
Database Engineering Percona Live, Amsterdam, 2015 September, 2015 engineering, not administration 2 yesterday s DBA gatekeeper master builder superhero siloed specialized 3 engineering quantitative interdisciplinary
More informationCLOUD WORKLOAD SECURITY
SOLUTION OVERVIEW CLOUD WORKLOAD SECURITY Bottom line: If you re in IT today, you re already in the cloud. As technology becomes an increasingly important element of business success, the adoption of highly
More informationAWS Reference Design Document
AWS Reference Design Document Contents Overview... 1 Amazon Web Services (AWS), Public Cloud and the New Security Challenges... 1 Security at the Speed of DevOps... 2 Securing East-West and North-South
More informationSecurity Precognition: Chaos Engineering in Incident Response
SESSION ID: ASD-W03 Security Precognition: Chaos Engineering in Incident Response Aaron Rinehart Chief Technology Officer Verica.io @aaronrinehart Kyle Erickson Director of IoT Security Medtronic Resilience
More informationDevice Discovery for Vulnerability Assessment: Automating the Handoff
Device Discovery for Vulnerability Assessment: Automating the Handoff O V E R V I E W While vulnerability assessment tools are widely believed to be very mature and approaching commodity status, they are
More informationRethinking Product Security: Cloud Demands a New Way
SESSION ID: CSV-R11 Rethinking Product Security: Cloud Demands a New Way Reeny Sondhi Chief of Product Security Autodesk Inc. @reenysondhi Tony Arous Head of Application Security Autodesk Inc. @tonyarous
More informationBest Practices for Cloud Security at Scale. Phil Rodrigues Security Solutions Architect Amazon Web Services, ANZ
Best Practices for Cloud Security at Scale Phil Rodrigues Security Solutions Architect Web Services, ANZ www.cloudsec.com #CLOUDSEC Best Practices for Security at Scale Best of the Best tips for Security
More informationTransformation in Technology Barbara Duck Chief Information Officer. Investor Day 2018
Transformation in Technology Barbara Duck Chief Information Officer Investor Day 2018 Key Takeaways 1Transformation in Technology driving out cost, supporting a more technologyenabled business Our new
More informationManaging an Application Vulnerability Management Program in a CI/CD Environment. March 29, 2018 OWASP Vancouver - Karim Lalji 1
Managing an Application Vulnerability Management Program in a CI/CD Environment March 29, 2018 OWASP Vancouver - Karim Lalji 1 About Me Karim Lalji Managing Security Consultant (VA/PT) at TELUS Previously:
More informationCSV-W14 - BUILDING AND ADOPTING A CLOUD-NATIVE SECURITY PROGRAM
SESSION ID: CSV-W14 - BUILDING AND ADOPTING A CLOUD-NATIVE SECURITY PROGRAM Rich Mogull VP of Product/Analyst /Securosis @rmogull Bill Burns Chief Trust Officer, VP Business Transformation @x509v3 Our
More informationAdopting Modern Practices for Improved Cloud Security. Cox Automotive - Enterprise Risk & Security
Adopting Modern Practices for Improved Cloud Security Cox Automotive - Enterprise Risk & Security 1 About Cox Automotive Cox Automotive is a leading provider of products and services that span the automotive
More informationDeploying and Operating Cloud Native.NET apps
Deploying and Operating Cloud Native.NET apps Jenny McLaughlin, Sr. Platform Architect Cornelius Mendoza, Sr. Platform Architect Pivotal Cloud Native Practices Continuous Delivery DevOps Microservices
More information85% 89% 10/5/2018. Do You Have A Firewall Around Your Cloud? Conquering The Big Threats & Challenges
Do You Have A Firewall Around Your Cloud? California Cybersecurity Education Summit 2018 Tyson Moler Oracle Security, North America Public Sector Conquering The Big Threats & Challenges Real Life Threats
More informationCWIN CAPGEMINI WEEK OF INNOVATION NETWORKS. Re-platforming and Cloud Journey. Fausto Pasqualetti, Milano, 25 Settembre 2018
CWIN Re-platforming and Cloud Journey Fausto Pasqualetti, Milano, 25 Settembre 2018 CAPGEMINI WEEK OF INNOVATION NETWORKS Cloud Journey Fausto Pasqualetti 25/09/2018 2018 Capgemini. All rights reserved.
More informationAutomating Security Practices for the DevOps Revolution
Automating Security Practices for the DevOps Revolution Hari Srinivasan Director Product Management, Cloud and Virtualization Security Qualys Inc. 1 Qualys, Inc. 2018 Agenda Transformation of today s IT
More informationQualys Cloud Platform
18 QUALYS SECURITY CONFERENCE 2018 Qualys Cloud Platform Looking Under the Hood: What Makes Our Cloud Platform so Scalable and Powerful Dilip Bachwani Vice President, Engineering, Qualys, Inc. Cloud Platform
More informationAppSec in a DevOps World
AppSec in a DevOps World Peter Chestna Director of Developer Engagement 1 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES Who am I? 27 Years Software Development Experience 12 Years Application Security
More informationA DEVOPS STATE OF MIND. Chris Van Tuin Chief Technologist, West
A DEVOPS STATE OF MIND Chris Van Tuin Chief Technologist, West cvantuin@redhat.com THE NEED FOR SPEED THE ACCELERATION OF APPLICATION DELIVERY FOR THE BUSINESS In short, software is eating the world. -
More informationI keep hearing about DevOps What is it?
DevOps & OpenShift I keep hearing about DevOps What is it? FOR MANY ORGANIZATIONS, WHAT IS I.T. LIKE TODAY? WATERFALL AND SILOS Application Version X DEVELOPMENT OPERATIONS IT OPS IS UNDER PRESSURE ENVIRONMENT
More informationBuilding an Effective Cloud Operating Model on AWS
Building an Effective Cloud Operating Model on AWS Jeff Armstrong (Cloud Architect, Cloudreach) 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Introductions Cloud Operating Model
More informationThe New Normal. Unique Challenges When Monitoring Hybrid Cloud Environments
The New Normal Unique Challenges When Monitoring Hybrid Cloud Environments The Evolving Cybersecurity Landscape Every day, the cybersecurity landscape is expanding around us. Each new device connected
More informationOrchestrating the Continuous Delivery Process
Orchestrating the Continuous Delivery Process steven.g.harris@cloudbees.com @stevengharris SVP Products, CloudBees 1 Continuous Delivery Overview Feedback Loop App Lifecycle BUILD TEST STAGE Deploy Run
More informationIntegrating the Risk Management Framework (RMF) with DevOps
Integrating the Risk Management Framework (RMF) with DevOps March 2018 Timothy A. Chick Security Automation Systems Technical Manager Software Engineering Institute Carnegie Mellon University Pittsburgh,
More informationTHE ART OF SECURING 100 PRODUCTS. Nir
THE ART OF SECURING 100 PRODUCTS Nir Valtman @ValtmaNir I work for as the Application Security 1st time speaking publicly, except at Mmmm OH, AND Neither of my previous startups succeeded!
More informationAppScan Deployment APPLICATION SECURITY SERVICES. Colin Bell. Applications Security Senior Practice Manager
APPLICATION SECURITY SERVICES AppScan Deployment Colin Bell Applications Security Senior Practice Manager Copyright 2017 HCL Products & Platforms www.hcltech.com The Evolution of Devops 2001 - Continuous
More informationHow to Secure Your Cloud with...a Cloud?
A New Era of Thinking How to Secure Your Cloud with...a Cloud? Eitan Worcel Offering Manager - Application Security on Cloud IBM Security 1 2016 IBM Corporation 1 A New Era of Thinking Agenda IBM Cloud
More informationBUILDING APPLICATION SECURITY INTO PRODUCTION CONTAINER ENVIRONMENTS Informed by the National Institute of Standards and Technology
BUILDING APPLICATION SECURITY INTO PRODUCTION CONTAINER ENVIRONMENTS Informed by the National Institute of Standards and Technology ebook BUILDING APPLICATION SECURITY INTO PRODUCTION CONTAINER ENVIRONMENTS
More informationTaking Control of Your Application Security
EDUCAUSE Wednesday, May 3 rd Taking Control of Your Application Security 2017 SANS Institute All Rights Reserved INTRODUCTION Eric Johnson, CISSP, GSSP-Java, GSSP-.NET, GWAPT Application Security Curriculum
More informationMarc Hornbeek DevOps-the-Gray Principal DevOps Consultant, Trace3 Author, DevOps Test Engineering Course The DevOps Institute
HOST EXPERT PANEL Shashi Kiran CMO Quali Marc Hornbeek DevOps-the-Gray Principal DevOps Consultant, Trace3 Author, DevOps Test Engineering Course The DevOps Institute Pascal Joly Director, Technology Partnerships
More informationWHITEPAPER THE EVOLUTION OF APPSEC: FROM WAFS TO AUTONOMOUS APPLICATION PROTECTION
WHITEPAPER THE EVOLUTION OF APPSEC: FROM WAFS TO AUTONOMOUS APPLICATION PROTECTION 2 Web application firewalls (WAFs) entered the security market at the turn of the century as web apps became increasingly
More informationDevSecOps Shift Left Security. Prioritizing Incident Response using Security Posture Assessment and Attack Surface Analysis
DevSecOps Shift Left Security Prioritizing Incident Response using Security Posture Assessment and Attack Surface Analysis Themes Vulnerabilities are Low Hanging Fruit Why so many breaches that Anti-Virus
More informationA New Cyber Defense Management Regulation. Ophir Zilbiger, CRISC, CISSP SECOZ CEO
A New Cyber Defense Management Regulation Ophir Zilbiger, CRISC, CISSP SECOZ CEO Personal Background IT and Internet professional (since 1992) PwC (1999-2003) Global SME for Network Director Information
More informationPower Up/Level Up: Supercharging Your Security Program for Cloud and DevOps. Rich
Power Up/Level Up: Supercharging Your Security Program for Cloud and DevOps Rich Mogull @rmogull CISO Ragnarok The board is breathing down your neck, the CEO wants reports, and the CFO writes Try Open
More informationQuality Engineering in DevOps world a Strategic Enabler
www.cigniti.com Unsolicited Distribution is Restricted. Copyright 2015-16, Cigniti Technologies Quality Engineering in DevOps world a Strategic Enabler » Analyst Speak» DevOps in a nutshell» DevOps vs
More informationPRAGMATIC SECURITY AUTOMATION FOR CLOUD
SESSION ID: CSV-R04 PRAGMATIC SECURITY AUTOMATION FOR CLOUD Rich Mogull Analyst/VP of Product Securosis/DisruptOPS rmogull@disruptops.com @rmogull Cloud is Fundamentally Different Abstraction Automation
More informationWill your application be secure enough when Robots produce code for you?
SESSION ID: ASD-W02 Will your application be secure enough when Robots produce code for you? Hasan Yasar Technical Manager, Faculty Member SEI CMU @securelifecycle With the speed of DevOps It is me! I
More informationCLOUD SECURITY CRASH COURSE
CLOUD SECURITY CRASH COURSE ADDRESSING REAL WORLD CONCERNS Joel Friedman, CTSO ABOUT ME Name: Joel Friedman Title: Chief Technology & Security Officer of Datapipe Certifications: CISSP, CISA, CISM, CRISC,
More informationTHE FOUR PILLARS OF MODERN VULNERABILITY MANAGEMENT
WHITEPAPER THE FOUR PILLARS OF MODERN VULNERABILITY MANAGEMENT A comprehensive approach to reducing vulnerabilities across your ecosystem TABLE OF CONTENTS INTRODUCTION PAGE 3 1 2 3 4 ENHANCING NETWORK
More informationebook ADVANCED LOAD BALANCING IN THE CLOUD 5 WAYS TO SIMPLIFY THE CHAOS
ebook ADVANCED LOAD BALANCING IN THE CLOUD 5 WAYS TO SIMPLIFY THE CHAOS Introduction Load balancing isn t just about managing traffic anymore. As your infrastructure expands to include applications in
More informationSDx and the Future of Infrastructure
SDx and the Future of Infrastructure John Manville, SVP, Global Infrastructure Services, Cisco Radhika Chagarlamudi, Sr. Dir., IT, Business Collaboration and Software Platforms ITM-1004 A Ten Year Journey..
More informationSUSE s vision for agile software development and deployment in the Software Defined Datacenter
From Git to Cloud SUSE s vision for agile software development and deployment in the Software Defined Datacenter Joachim Werner Senior Product Manager joe@suse.com Peter Chadwick Director Product Management
More informationDevOps Agility in the Evolving Cloud Services Landscape
DevOps Agility in the Evolving Cloud Services Landscape Kiran Chitturi CTO Architect, Sungard Availability Services @nkchitturi Kiran Chitturi Architect in the Office of the CTO Focus on DevOps and cloud
More informationDevOps Tooling from AWS
DevOps Tooling from AWS What is DevOps? Improved Collaboration - the dropping of silos between teams allows greater collaboration and understanding of how the application is built and deployed. This allows
More informationDevOps A How To for Agility with Security
DevOps A How To for Agility with Security Murray Goldschmidt, COO Compliance, Protection & Business Confidence Sense of Security Pty Ltd Sydney Level 8, 66 King Street Sydney NSW 2000 Australia Melbourne
More informationSecuring Your Cloud Introduction Presentation
Securing Your Cloud Introduction Presentation Slides originally created by IBM Partial deck derived by Continental Resources, Inc. (ConRes) Security Division Revision March 17, 2017 1 IBM Security Today
More informationA DEVOPS STATE OF MIND. Chris Van Tuin Chief Technologist, West
A DEVOPS STATE OF MIND Chris Van Tuin Chief Technologist, West cvantuin@redhat.com In short, software is eating the world. - Marc Andreessen, Wall Street Journal, August 2011 UBER, LYFT FALLOUT: TAXI
More informationLift and Shift, Don t Lift and Pray: Pragmatic Cloud Migration Strategies
SESSION ID: STR-T08 Lift and Shift, Don t Lift and Pray: Pragmatic Cloud Migration Strategies Rich Mogull Analyst/CEO Securosis VP of Product DisruptOps rmogull@securosis.com Reality Bites There is relentless
More informationAutomating the Top 20 CIS Critical Security Controls
20 Automating the Top 20 CIS Critical Security Controls SUMMARY It s not easy being today s CISO or CIO. With the advent of cloud computing, Shadow IT, and mobility, the risk surface area for enterprises
More informationDevops, Docker and Security. John
Devops, Docker and Security John Willis @botchagalupe About Me https://github.com/botchagalupe/my-presentations One of the founding members of Devopsdays Co-author of the Devops Handbook. Author of the
More informationSecuring the Modern Data Center with Trend Micro Deep Security
Advania Fall Conference Securing the Modern Data Center with Trend Micro Deep Security Okan Kalak, Senior Sales Engineer okan@trendmicro.no Infrastructure change Containers 1011 0100 0010 Serverless Public
More informationCybersecurity Risk Mitigation: Protect Your Member Data. Introduction
Cybersecurity Risk Mitigation: Protect Your Member Data Presented by Matt Mitchell, CISSP Knowledge Consulting Group Introduction Matt Mitchell- Director Risk Assurance 17 years information security experience
More informationClosing the Hybrid Cloud Security Gap with Cavirin
Enterprise Strategy Group Getting to the bigger truth. Solution Showcase Closing the Hybrid Cloud Security Gap with Cavirin Date: June 2018 Author: Doug Cahill, Senior Analyst Abstract: Most organizations
More informationMicrosoft Security Management
Microsoft Security Management MICROSOFT SECURITY MANAGEMENT SECURITY MANAGEMENT CHALLENGES Some large financial services organizations have as many as 40 or more different security vendors inside their
More informationSOLUTION BRIEF RSA ARCHER IT & SECURITY RISK MANAGEMENT
RSA ARCHER IT & SECURITY RISK MANAGEMENT INTRODUCTION Organizations battle growing security challenges by building layer upon layer of defenses: firewalls, antivirus, intrusion prevention systems, intrusion
More informationThe Four Pillars of Modern Vulnerability Management
WHITEPAPER The Four Pillars of Modern Vulnerability Management A comprehensive approach to reducing vulnerabilities across your ecosystem TABLE OF CONTENTS Introduction 3 Enhancing Network Vulnerability
More informationDOS AND DON'TS OF DEVSECOPS
SESSION ID: DEV-F01 DOS AND DON'TS OF DEVSECOPS Hasan Yasar Technical Manager, Adjunct Faculty Member CERT Software Engineering Institute Carnegie Mellon University @SecureLifeCycle Notices Copyright 2018
More informationElizabeth Lawler CEO & Co-Founder Conjur,
SESSION ID: ASD-W02 Is DevOps Breaking Your Company? Elizabeth Lawler CEO & Co-Founder Conjur, Inc. @elizabethlawler Agenda I. Security + DevOps Overview Unstoppable Force vs Immovable Object Aligning
More informationManaging and Auditing Organizational Migration to the Cloud TELASA SECURITY
Managing and Auditing Organizational Migration to the Cloud 1 TELASA SECURITY About Me Brian Greidanus bgreidan@telasasecurity.com 18+ years of security and compliance experience delivering consulting
More informationAGILE AND CONTINUOUS THREAT MODELS
SESSION ID: DEV-R04 AGILE AND CONTINUOUS THREAT MODELS Nancy Davoust Vice President, Security Architecture and Technology Solutions Comcast CONTEXT FOR AGILE AND CONTINUOUS THREAT MODELING The Landscape
More informationNEXT GENERATION SECURITY OPERATIONS CENTER
DTS SOLUTION NEXT GENERATION SECURITY OPERATIONS CENTER SOC 2.0 - ENHANCED SECURITY O&M SOC 2.0 - SUCCESS FACTORS SOC 2.0 - FUNCTIONAL COMPONENTS DTS SOLUTION SOC 2.0 - ENHANCED SECURITY O&M SOC 2.0 Protecting
More informationCase Study: The Evolution of EMC s Product Security Office. Dan Reddy, CISSP, CSSLP EMC Product Security Office
Case Study: The Evolution of EMC s Product Security Office Dan Reddy, CISSP, CSSLP EMC Product Security Office 1 The Evolution of EMC Product Security 2000-2004 2005-2009 2010-Beyond External Drivers Hackers
More informationAZURE CLOUD SECURITY GUIDE: 6 BEST PRACTICES. To Secure Azure and Hybrid Cloud Environments
AZURE CLOUD SECURITY GUIDE: 6 BEST PRACTICES To Secure Azure and Hybrid Cloud Environments Introduction Cloud is at the core of every successful digital transformation initiative. With cloud comes new
More informationContainers & Microservices For Realists. Karthik
Containers & Microservices For Realists Karthik Gaekwad @iteration1 Karthik Gaekwad @iteration1 Principal Member of Technical Staff Oracle Container Cloud Team Previous: 10 years building cloud products
More informationA Practical Guide to Efficient Security Response
A Practical Guide to Efficient Security Response The Essential Checklist Start The Critical Challenges to Information Security Data breaches constantly threaten the modern enterprise. And the risk continues
More informationSix Weeks to Security Operations The AMP Story. Mike Byrne Cyber Security AMP
Six Weeks to Security Operations The AMP Story Mike Byrne Cyber Security AMP 1 Agenda Introductions The AMP Security Operations Story Lessons Learned 2 Speaker Introduction NAME: Mike Byrne TITLE: Consultant
More informationRSA IT Security Risk Management
RSA IT Security Risk Adding Insight to Security March 18, 2014 Wael Jaroudi GRC Sales Specialist 1 Where is Security Today? Companies have built layer upon layer of security, but is it helping? Complexity
More informationBest Practices in Securing a Multicloud World
Best Practices in Securing a Multicloud World Actions to take now to protect data, applications, and workloads We live in a multicloud world. A world where a multitude of offerings from Cloud Service Providers
More informationCompleting your AWS Cloud SECURING YOUR AMAZON WEB SERVICES ENVIRONMENT
Completing your AWS Cloud SECURING YOUR AMAZON WEB SERVICES ENVIRONMENT Introduction Amazon Web Services (AWS) provides Infrastructure as a Service (IaaS) cloud offerings for organizations. Using AWS,
More informationShift Left Testing: are you ready? Live Webinar, Sept 19
Shift Left Testing: are you ready? Live Webinar, Sept 19 Guy Arieli CTO, Experitest 01 What exactly is Shift Left? Agenda 02 03 How Shift Left affects application development & testing organizational structures
More informationCloud & AWS Essentials Agenda. Introduction What is the cloud? DevOps approach Basic AWS overview. VPC EC2 and EBS S3 RDS.
Agenda Introduction What is the cloud? DevOps approach Basic AWS overview VPC EC2 and EBS S3 RDS Hands-on exercise 1 What is the cloud? Cloud computing it is a model for enabling ubiquitous, on-demand
More informationDeep Dive on AWS CodeStar
Deep Dive on AWS CodeStar with AWS CI/CD workflow Tara E. Walker Technical Evangelist @taraw June 28, 2017 2015, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Agenda What is DevOps
More informationQualys Cloud Platform
Qualys Cloud Platform Our Journey into the Cloud: The Qualys Cloud Platform & Architecture Thomas Wendt Regional Manager Post-Sales, DACH, Qualys Inc. Digital Transformation More than just adopting new
More informationBUYER S GUIDE APPLICATION SECURITY BUYER S GUIDE:
BUYER S GUIDE APPLICATION SECURITY BUYER S GUIDE: 15 Questions to Ask Yourself and Your DAST Vendor > An Introduction to the AppSec Market Page 3 Dynamic Application Security Testing Requirements Page
More informationSecurity Governance and Management Scorecard
Security Governance and Management Scorecard Risk Analysis 1 - Please indicate the status of your risk analysis process. 6 - Documented, enforced, reviewed, and 2 - Are all (Network, Data, Apps, IAM, End
More informationSYMANTEC DATA CENTER SECURITY
SYMANTEC DATA CENTER SECURITY SYMANTEC UNIFIED SECURITY STRATEGY Users Cyber Security Services Monitoring, Incident Response, Simulation, Adversary Threat Intelligence Data Threat Protection Information
More informationContainer Deployment and Security Best Practices
Container Deployment and Security Best Practices How organizations are leveraging OpenShift, Quay, and Twistlock to deploy, manage, and secure a cloud native environment. John Morello CTO Twistlock Dirk
More informationThe Divine and Felonious Nature of Cyber Security
The Divine and Felonious Nature of Cyber Security ( Introduction to DevSecOps ) John Willis @botchagalupe https://github.com/botchagalupe/my-presentations The Felonious Nature of Cyber Security Infecting
More informationNEXT GENERATION CLOUD SECURITY
SESSION ID: CMI-F02 NEXT GENERATION CLOUD SECURITY Myles Hosford Head of FSI Security & Compliance Asia Amazon Web Services Agenda Introduction to Cloud Security Benefits of Cloud Security Cloud APIs &
More informationIntegrating Okta and Preempt Detecting and Preventing Threats With Greater Visibility and Proactive Enforcement
Integrating Okta and Preempt Detecting and Preventing Threats With Greater Visibility and Proactive Enforcement The Challenge: Smarter Attackers and Dissolving Perimeters Modern enterprises are simultaneously
More informationThe Intent based Data Center. Kim In-Sook Manager, ASEAN Data Center Architect Team Jan 11, 2018
The Intent based Data Center Kim In-Sook Manager, ASEAN Data Center Architect Team Jan 11, 2018 30,000+ Application developers. 7200+ Apps. 32 data centers. More software developers than Google, and more
More informationApplication Centric Microservices Ken Owens, CTO Cisco Intercloud Services. Redhat Summit 2015
Application Centric Microservices Ken Owens, CTO Cisco Intercloud Services Redhat Summit 2015 Agenda Introduction Why Application Centric Application Deployment Options What is Microservices Infrastructure
More informationRA-GRS, 130 replication support, ZRS, 130
Index A, B Agile approach advantages, 168 continuous software delivery, 167 definition, 167 disadvantages, 169 sprints, 167 168 Amazon Web Services (AWS) failure, 88 CloudTrail Service, 21 CloudWatch Service,
More informationDevOps Made Easy. Shireesh Thanneru, Platform Architect. Intel. Linoy Alexander, Director, DevOps
DevOps Made Easy Shireesh Thanneru, Platform Architect Intel Linoy Alexander, Director, DevOps Justyna Kucharczak, Sr. Product Marketing Manager, Platform Pegasystems Agenda Why DevOps? A look at benefits
More information