This Online TechTalk “Azure Cloud for DEV” was delivered by Oleksandr Yevtushenko on April 28, 2021 Speaker told about Azure Cloud from the developers' side and analyzed inner working Azure DevOps Pipelines and the best practices in building Secure SDLC. More details and video: https://bit.ly/3DENjTd More details and video:

1. Azure Cloud for
DEV
ALEX YEVTUSHENKO
SENIOR SOLUTIONS ARCHITECT
GLOBALLOGIC 2021
Wednesday, April 28, 2021

2. / INTRODUCTION
Wednesday, April 28, 2021 Azure Cloud for DEV /2
ALEX YEVTUSHENKO
SENIOR SOLUTIONS ARCHITECT
GLOBALLOGIC
Email: o.yevtushenko@globallogic.com
Phone: +38 (093) 586 2559
Skype: alexrster

3. / INTRODUCTION
Agenda
–DevSecOps
–Azure services for DEV
–Azure DevOps & GitHub
–Secure SDLC best practices
Wednesday, April 28, 2021 Azure Cloud for DEV /3

4. / MICROSOFT DEV PLATFORM
Wednesday, April 28, 2021 Azure Cloud for DEV /4

5. / GITHUB ACTIONS VS AZURE DEVOPS PIPELINES
Wednesday, April 28, 2021 Azure Cloud for DEV /5

6. • On-prem
• Azure
• AWS
• Google Cloud Platform
• Elastic, to any scale
• Fully managed
• Packages always the latest
• Supports all OS for CI/CD
• Largest ecosystem
• Community-led automation
Monitor
Build Test
Release
Deploy
Operate
Code
End-to-end, code-to-cloud
DevOps
Deploy anywhere, including
your own data centers
Home for all developers
Home for the world’s code
Plan
Wednesday, April 28, 2021 Azure Cloud for DEV /6

7. / AZURE DEVOPS
Wednesday, April 28, 2021 Azure Cloud for DEV /7

8. GitHub Actions
Automate
Build, test and deploy with
confidence
Customizable
Wednesday, April 28, 2021 Azure Cloud for DEV /8

9. Wednesday, April 28, 2021 Azure Cloud for DEV /9

10. DevSecOps
Wednesday, April 28, 2021 Azure Cloud for DEV /10

11. / DEVSECOPS
Wednesday, April 28, 2021 Azure Cloud for DEV /11

12. / DEVSECOPS
Wednesday, April 28, 2021 Azure Cloud for DEV /12

13. / SECURE SDLC
Wednesday, April 28, 2021 Azure Cloud for DEV /13

14. / SECURITY SCANS
Wednesday, April 28, 2021 Azure Cloud for DEV /14

15. / AZURE DEVOPS
Wednesday, April 28, 2021 Azure Cloud for DEV /15
Artifacts
Repos
Pipelines

16. / CONTIUNOUS SECURITY VALIDATION
MARKET LEADING TOOLS
• OWASP
• CHECKMARX
• WHITESOURCE SOFTWARE
• BINSKIM
• OWASP ZAP VSTS EXTENSION
• MANAGE YOUR OPEN SOURCE USAGE AND
SECURITY AS REPORTED BY YOUR CI/CD
PIPELINE
• VISUAL STUDIO CODE ANALYSIS AND THE
ROSLYN SECURITY ANALYZERS
Wednesday, April 28, 2021 Azure Cloud for DEV /16

17. CODE
SECURITY & COMPLIANCE
Wednesday, April 28, 2021 Azure Cloud for DEV /17

18. Code security & compliance
Dependency
Insights
• Real-time inventory
• License compliance
• Vulnerability alerting
Vulnerability
Management
• Code scanning
• Secret scanning
• Largest vulnerability database
• Automated security updates
CodeQL
• World’s most advanced code analysis
• Vulnerability hunting tool
• Community of top security experts
Wednesday, April 28, 2021 Azure Cloud for DEV /18

19. CodeScanning
Find and fix vulnerabilities fast
Find and fix vulnerabilities before they are merged
into the code base with automated CodeQL scans
Community of top security experts
Community-driven query set powers every
project with a world-class security team.
Integrated with developer workflow
Integrate security results directly into the
developer workflow for a frictionless
experience and faster development
Wednesday, April 28, 2021 Azure Cloud for DEV /19

20. / GITHUB CODE SCANNING
Wednesday, April 28, 2021 Azure Cloud for DEV /20

21. / GITHUB CODE SCANNING
Wednesday, April 28, 2021 Azure Cloud for DEV /21

22. / GITHUB CODE SCANNING
Wednesday, April 28, 2021 Azure Cloud for DEV /22

23. / GITHUB SECURITY & ANALYSIS
Wednesday, April 28, 2021 Azure Cloud for DEV /23

24. / GITHUB DEPENDABOT ALERTS
Wednesday, April 28, 2021 Azure Cloud for DEV /24

25. / GITHUB DEPENDABOT ALERTS
Wednesday, April 28, 2021 Azure Cloud for DEV /25

26. / GITHUB DEPENDABOT ALERTS
Wednesday, April 28, 2021 Azure Cloud for DEV /26

27. / GITHUB DEPENDABOT ALERTS
Wednesday, April 28, 2021 Azure Cloud for DEV /27

28. / GITHUB DEPENDABOT PREVIEW
Wednesday, April 28, 2021 Azure Cloud for DEV /28

29. / GITHUB DEPENDABOT PREVIEW
Wednesday, April 28, 2021 Azure Cloud for DEV /29

30. Wednesday, April 28, 2021 Azure Cloud for DEV /30
BUILD & DEPLOY Free
for public repositories

31. / PIPELINE COMPOSITION
Wednesday, April 28, 2021 Azure Cloud for DEV /31

32. / PIPELINE ENVIRONMENT
Wednesday, April 28, 2021 Azure Cloud for DEV /32

33. / PIPELINE WORKFLOW
Wednesday, April 28, 2021 Azure Cloud for DEV /33

34. / PIPELINE WORKFLOW STEPS
Wednesday, April 28, 2021 Azure Cloud for DEV /34

35. / PIPELINE LOGS
Wednesday, April 28, 2021 Azure Cloud for DEV /35

36. / PIPELINE CAPABILITIES
Wednesday, April 28, 2021 Azure Cloud for DEV /36

37. / PIPELINE AGENT
Wednesday, April 28, 2021 Azure Cloud for DEV /37

38. / AGENT WORKLOAD
Wednesday, April 28, 2021 Azure Cloud for DEV /38

39. / PIPELINE AGENT
Wednesday, April 28, 2021 Azure Cloud for DEV /39

40. Wednesday, April 28, 2021 Azure Cloud for DEV /40
HOSTED OR SELF-HOSTED

41. / HOSTED AGENT
Wednesday, April 28, 2021 Azure Cloud for DEV /41

42. / HOSTED AGENT CAPABILITIES
Wednesday, April 28, 2021 Azure Cloud for DEV /42

43. / SELF-HOSTED AGENT
Wednesday, April 28, 2021 Azure Cloud for DEV /43
VIRTUAL MACHINE DOCKER CONTAINER

44. / SELF-HOSTED AGENT
Wednesday, April 28, 2021 Azure Cloud for DEV /44
AZURE DEVOPS
PIPELINE AGENT

45. / SELF-HOSTED AGENT POOL
Wednesday, April 28, 2021 Azure Cloud for DEV /45
SINGLE VM SCALE SET

46. Wednesday, April 28, 2021 Azure Cloud for DEV /47
DEPLOY THE VALUE

47. / DEPLOYMENT PIPELINE
Wednesday, April 28, 2021 Azure Cloud for DEV /48

48. / FEATURE FLAGS
Wednesday, April 28, 2021 Azure Cloud for DEV /49
Enable or disable a feature for selected users
2
Enable or disable a feature as selected by user
1
Enable or disable a feature for everyone
3

49. / FEATURE FLAGS
Wednesday, April 28, 2021 Azure Cloud for DEV /50

50. / USER TYPES
– CANARIES who voluntarily test
bleeding edge features as soon as
they are available
– EARLY ADOPTERS who voluntarily
preview releases, considered more
refined than the canary bits
– USERS who consume the
products, after passing through
canaries and early adopters
Wednesday, April 28, 2021 Azure Cloud for DEV /51

51. / APP CONFIGURATION – FEATURE MANAGER
Wednesday, April 28, 2021 Azure Cloud for DEV /52

52. / FEATURE FLAGS – LAUNCHDARKLY
Wednesday, April 28, 2021 Azure Cloud for DEV /53
https://launchdarkly.com

53. / FEATURE FLAGS – FEATUREHUB
Wednesday, April 28, 2021 Azure Cloud for DEV /54
https://github.com/featurehub-io/featurehub

54. /
Soft Launch Incremental Rollout
New Feature
Rollout
Feedback
SAFE DEPLOYMENT
Wednesday, April 28, 2021 Azure Cloud for DEV /55

55. /
Done
ROLLBACK CHANGES
Wednesday, April 28, 2021 Azure Cloud for DEV /56

56. CONTAINER SECURITY
Wednesday, April 28, 2021 Azure Cloud for DEV /57

57. / E2E SECURITY
Wednesday, April 28, 2021 Azure Cloud for DEV /58

58. / AZURE SECURITY CENTER
Wednesday, April 28, 2021 Azure Cloud for DEV /59

59. / CONTAINER IMAGE SCANNING
Wednesday, April 28, 2021 Azure Cloud for DEV /60

60. / CONTAINER IMAGE SCANNING
Wednesday, April 28, 2021 Azure Cloud for DEV /61

61. / CONTAINER IMAGE SCANNING
Wednesday, April 28, 2021 Azure Cloud for DEV /62

62. / CONTAINER RUNTIME SECURITY
Wednesday, April 28, 2021 Azure Cloud for DEV /63

63. DEVOPS ❤ GITHUB
Wednesday, April 28, 2021 Azure Cloud for DEV /64

64. / DEVOPS ❤ GITHUB
Wednesday, April 28, 2021 Azure Cloud for DEV /65

65. / GITHUB ❤ DEVOPS
Wednesday, April 28, 2021 Azure Cloud for DEV /66

66. / GITHUB ACTIONS ❤ DEVOPS PIPELINES
Wednesday, April 28, 2021 Azure Cloud for DEV /67

67. / DEVOPS REPORTS
Wednesday, April 28, 2021 Azure Cloud for DEV /68

68. /
Summary
• DevSecOps
• Code Security & Compliane
• Azure Pipelines & Github Actions infrastructure
• Containers security best practices
• Runtime environment security
OUTRO
Wednesday, April 28, 2021 Azure Cloud for DEV /69

69. THANK YOU!

70. GitHub
Secrets
Wednesday, April 28, 2021 Azure Cloud for DEV /71

71. Azure Key Vault
Wednesday, April 28, 2021 Azure Cloud for DEV /72

72. Azure Key Vault
Wednesday, April 28, 2021 Azure Cloud for DEV /73