SlideShare une entreprise Scribd logo
1  sur  57
Télécharger pour lire hors ligne
Devops, Secops, Opsec,Devops, Secops, Opsec,
DevSec *ops *.* ?DevSec *ops *.* ?
Kris Buytaert
Brussels , February 2016
Kris BuytaertKris Buytaert
● I used to be a Dev,I used to be a Dev,
● Then Became an OpThen Became an Op
● Even did Security (OSSTM)Even did Security (OSSTM)
● Chief Trolling Officer and Open SourceChief Trolling Officer and Open Source
Consultant @inuits.euConsultant @inuits.eu
● Everything is an effing DNS ProblemEverything is an effing DNS Problem
● Building Clouds since before the bookstoreBuilding Clouds since before the bookstore
● Some books, some papers, some blogsSome books, some papers, some blogs
● Too many conferences.Too many conferences.
Who is runningWho is running
● DrupalDrupal
● OpenSSLOpenSSL
● BashBash
Who is runningWho is running
● Drupal < 7.38Drupal < 7.38
● OpenSSL 1.0.1 → 1.0.1fOpenSSL 1.0.1 → 1.0.1f
● Bash < 4.3...Bash < 4.3...
Who has them upgraded over the pastWho has them upgraded over the past
12 months ?12 months ?
What's this Devops thing really about ?What's this Devops thing really about ?
World , 200X-2009World , 200X-2009
Patrick Debois, Gildas Le Nadan, Andrew Clay Shafer, Kris Buytaert, JezzPatrick Debois, Gildas Le Nadan, Andrew Clay Shafer, Kris Buytaert, Jezz
Humble, Lindsay Holmwood, John Willis, Chris Read, Julian Simpson, andHumble, Lindsay Holmwood, John Willis, Chris Read, Julian Simpson, and
lots of others ..lots of others ..
Gent , October 2009Gent , October 2009
Mountain View , June 2010Mountain View , June 2010
Hamburg , October 2010Hamburg , October 2010
Boston, March 2011Boston, March 2011
Mountain View, June 2011Mountain View, June 2011
Bangalore, Melbourne,Bangalore, Melbourne,
Goteborg , October 2011Goteborg , October 2011
C(L)AMSC(L)AMS
● CultureCulture
● (Lean)(Lean)
● AutomationAutomation
● MeasurementMeasurement
● SecuritySecurity
Damon Edwards and John WillisDamon Edwards and John Willis
Frank BreedijkFrank Breedijk
@seccubus@seccubus
● Http → httpsHttp → https
● Imap → imapsImap → imaps
● Pop3 → pop3sPop3 → pop3s
● Devop → devopSDevop → devopS
““DevOps is a cultural andDevOps is a cultural and
professional movement”professional movement”
Adam JacobAdam Jacob
How did we get here ?How did we get here ?
The Old DaysThe Old Days
● ““Put this Code Live, here's a tarball” NOW!Put this Code Live, here's a tarball” NOW!
● What dependencies ?What dependencies ?
● No machines available ?No machines available ?
● What database ?What database ?
● Security ?Security ?
● High Availability ?High Availability ?
● Scalability ?Scalability ?
● My computer can't install this ?My computer can't install this ?
Devs vs OpsDevs vs Ops
People hate SysadminsPeople hate Sysadmins
BecauseBecause
•They slow stuff downThey slow stuff down
•The say noThe say no
•They say no againThey say no again
•They refuse to break stuffThey refuse to break stuff
•They care about uptimeThey care about uptime
•They don't care about fancy new featuresThey don't care about fancy new features
Dev secops opsec, devsec, devops ?
People hate SecurityPeople hate Security
OfficersOfficers
BecauseBecause
•They slow stuff downThey slow stuff down
•The say noThe say no
•They say no againThey say no again
•They refuse to leave holes openThey refuse to leave holes open
•They care about securityThey care about security
•They don't care about fancy new featuresThey don't care about fancy new features
•Security Officers have an expiry dateSecurity Officers have an expiry date
Dev secops opsec, devsec, devops ?
10 days into operation10 days into operation
● What High Load ? What Memory usage ?What High Load ? What Memory usage ?
● Are these Logs ? Or this is actualy customerAre these Logs ? Or this is actualy customer
data ?data ?
● How many users are there , should they launchHow many users are there , should they launch
100 queries each ?? Oh we're having 10K100 queries each ?? Oh we're having 10K
usersusers
● Why is debugging enabled ?Why is debugging enabled ?
● Who wrote this ?Who wrote this ?
11 days into operations11 days into operations
12 days into operations12 days into operations
13 days into operations13 days into operations
We can solve this !We can solve this !
● We are not here toWe are not here to
blockblock
● Some people thinkSome people think
the Security /the Security /
Operations workOperations work
starts on deploymentstarts on deployment
● It starts much earlierIt starts much earlier
● Start talking asapStart talking asap
Culture,Culture,
automation,automation,
Measturement,Measturement,
sharingsharing
Breaking the SilosBreaking the Silos
Getting AlongGetting AlongOpsOpsDevsDevs
● Who is in charge of security ?Who is in charge of security ?
● What do your developers think about security ?What do your developers think about security ?
● When do you think about securityWhen do you think about security
● The problem with security is it doesn'tThe problem with security is it doesn't
generate revenuegenerate revenue
● Security needs to become part of your DNA.Security needs to become part of your DNA.
Build TrustBuild Trust
● ExperimentExperiment
•
DevDev
•
TestTest
● ProdProd
● Automate all theAutomate all the
thingsthings
● Measure successMeasure success
● Measure FailureMeasure Failure
With great power ...With great power ...
Your code will go to production..Your code will go to production..
You will be able to fix it ..You will be able to fix it ..
You will have access to the logsYou will have access to the logs
Access to the metrics...Access to the metrics...
Dev secops opsec, devsec, devops ?
Dev secops opsec, devsec, devops ?
Devops is a ReorgDevops is a Reorg
● New role for Change ManagementNew role for Change Management
● New role for Security OfficersNew role for Security Officers
● Added roles for TestersAdded roles for Testers
Dev secops opsec, devsec, devops ?
Culture,Culture,
Automation,Automation,
Measurement,Measurement,
SharingSharing
" Our job as engineers (and ops, dev-ops, QA," Our job as engineers (and ops, dev-ops, QA,
support, everyone in the company actually) is tosupport, everyone in the company actually) is to
enable the business goals. We strongly feel thatenable the business goals. We strongly feel that
in order to do that you must havein order to do that you must have the ability tothe ability to
deploy code quickly and safelydeploy code quickly and safely. Even if the. Even if the
business goals are to deploy strongly QA’d codebusiness goals are to deploy strongly QA’d code
once a month at 3am (it’s not for us, we push allonce a month at 3am (it’s not for us, we push all
the time), having a reliable and easythe time), having a reliable and easy
deployment should bedeployment should be non-negotiablenon-negotiable."."
Etsy Blog upon releasing DeployinatorEtsy Blog upon releasing Deployinator
http://codeascraft.etsy.com/2010/05/20/quantum-of-deployment/http://codeascraft.etsy.com/2010/05/20/quantum-of-deployment/
Continuous Delivery is aContinuous Delivery is a
Security RequirementSecurity Requirement
How do we get there ?How do we get there ?
Use Version ControlUse Version Control
No ExcusesNo Excuses
Also for scripts/config/cookbooks,manifests,etcAlso for scripts/config/cookbooks,manifests,etc
CI ToolsCI Tools
● HudsonHudson
● JenkinsJenkins
•A zillion pluginsA zillion plugins
● Make your builds reproducible !Make your builds reproducible !
● Test your (Puppet/Chef/CFengine)Test your (Puppet/Chef/CFengine)
Build PipelinesBuild Pipelines
Test AutomationTest Automation
● Unit testsUnit tests
● Regression testsRegression tests
● SeleniumSelenium
● CucumberCucumber
● TDDTDD
● BDDBDD
Dev secops opsec, devsec, devops ?
What's in your Pipeline ?What's in your Pipeline ?
A pipelineA pipeline
● Checkout codeCheckout code
● SyntaxSyntax
● StyleStyle
● Code CoverageCode Coverage
● TestsTests
● BuildBuild
● More TestsMore Tests
● PackagePackage
● Upload to RepoUpload to Repo
A pipeline++A pipeline++
● Checkout codeCheckout code
● SyntaxSyntax
● StyleStyle
● Code CoverageCode Coverage
● TestsTests
● BuildBuild
● More TestsMore Tests
● PackagePackage
● Upload to RepoUpload to Repo
● Deploy on TestDeploy on Test
● ……
● Insert SECURITYInsert SECURITY
TESTS !TESTS !
Attack yourselve onAttack yourselve on
every buildevery build
● Gauntlt , write security testsGauntlt , write security tests
● Vulnerability scans (Arachni)Vulnerability scans (Arachni)
● Content Scanner (DIRB)Content Scanner (DIRB)
● ……
● https://github.com/garethr/pentesting-playgrouhttps://github.com/garethr/pentesting-playgrou
ndnd
Infrastructure as CodeInfrastructure as Code
● Configure 1000 nodes,Configure 1000 nodes,
● Modify 2000 files,Modify 2000 files,
● TogetherTogether
● Think :Think :
•Cfengine,Puppet, ChefCfengine,Puppet, Chef
● Put configs under version controlPut configs under version control
● Please don't roll your own ...Please don't roll your own ...
Puppet in ActionPuppet in Action
OrchestrationOrchestration
● Fix security issues with 1 commandFix security issues with 1 command
● Mco package bind upgradeMco package bind upgrade
● Write Ansible role to upgradeWrite Ansible role to upgrade
Culture,Culture,
Automation,Automation,
Measurement :Measurement :
measure all the thingsmeasure all the things
SharingSharing
Logstash in ActionLogstash in Action
Dev secops opsec, devsec, devops ?
Dev secops opsec, devsec, devops ?
Security in devops ?Security in devops ?
● Version control => AuditingVersion control => Auditing
● CI => Add security IN the pipelineCI => Add security IN the pipeline
● Configuration MgmtConfiguration Mgmt
•Policy DefinitionPolicy Definition
•Auditing & EnforcingAuditing & Enforcing
● MonitoringMonitoring
Debunking the CriticsDebunking the Critics
Security not included ?Security not included ? Everyone is Included:Everyone is Included:
security, dba, devs,security, dba, devs,
ops, designer, analysts,ops, designer, analysts,
We are solving a busines problem,We are solving a busines problem,
Not a technology problemNot a technology problem
*ops*ops
*.**.*
It's not about the toolsIt's not about the tools
It's about changeIt's about change
It's about the peopleIt's about the people
{devops security }{devops security }
is not a product you can buy,is not a product you can buy,
It's a lifestyleIt's a lifestyle
ContactContact
Kris Buytaert Kris.Buytaert@inuits.euKris Buytaert Kris.Buytaert@inuits.eu
Further ReadingFurther Reading
@krisbuytaert@krisbuytaert
http://www.krisbuytaert.be/blog/http://www.krisbuytaert.be/blog/
http://www.inuits.eu/http://www.inuits.eu/
InuitsInuits
Essensesteenweg 31Essensesteenweg 31
2930 Brasschaat2930 Brasschaat
BelgiumBelgium
891.514.231891.514.231
+32 475 961221+32 475 961221

Contenu connexe

Tendances

Adopting Devops , Stories from the trenches
Adopting Devops , Stories from the trenchesAdopting Devops , Stories from the trenches
Adopting Devops , Stories from the trenchesKris Buytaert
 
Devops 101 QA with Kris Buytaert
Devops 101 QA  with Kris BuytaertDevops 101 QA  with Kris Buytaert
Devops 101 QA with Kris BuytaertKris Buytaert
 
The Return of the Dull Stack Engineer
The Return of the Dull Stack EngineerThe Return of the Dull Stack Engineer
The Return of the Dull Stack EngineerKris Buytaert
 
Moby is killing your devops efforts
Moby is killing your devops effortsMoby is killing your devops efforts
Moby is killing your devops effortsKris Buytaert
 
Monitoring Drupal In an Infrastructure as Code Age
Monitoring Drupal In an Infrastructure as Code AgeMonitoring Drupal In an Infrastructure as Code Age
Monitoring Drupal In an Infrastructure as Code AgeKris Buytaert
 
Nightmare on Docker street
Nightmare on Docker streetNightmare on Docker street
Nightmare on Docker streetKris Buytaert
 
Devops is dead, Long Live Devops
Devops is dead, Long Live DevopsDevops is dead, Long Live Devops
Devops is dead, Long Live DevopsKris Buytaert
 
From devoops to devops
From devoops to devopsFrom devoops to devops
From devoops to devopsKris Buytaert
 
Docker is killing your #devops Efforts
Docker is killing your #devops EffortsDocker is killing your #devops Efforts
Docker is killing your #devops EffortsKris Buytaert
 
Devops is not about Tooling
Devops is not about ToolingDevops is not about Tooling
Devops is not about ToolingKris Buytaert
 
Devops, The future is here, it's just not evenly distributed
Devops, The future is here, it's just not evenly distributedDevops, The future is here, it's just not evenly distributed
Devops, The future is here, it's just not evenly distributedKris Buytaert
 
Can we fix dev-oops ?
Can we fix dev-oops ?Can we fix dev-oops ?
Can we fix dev-oops ?Kris Buytaert
 
Is there a future for devops ?
Is there a future for devops ?Is there a future for devops ?
Is there a future for devops ?Kris Buytaert
 
Continous Delivery of your Infrastructure
Continous Delivery of your InfrastructureContinous Delivery of your Infrastructure
Continous Delivery of your InfrastructureKris Buytaert
 
Continuous Infrastructure First
Continuous Infrastructure FirstContinuous Infrastructure First
Continuous Infrastructure FirstKris Buytaert
 
Devopsdays Amsterdam 2017 Keynote, looking back at 5 years of AMS
Devopsdays Amsterdam 2017 Keynote, looking back at 5 years of AMSDevopsdays Amsterdam 2017 Keynote, looking back at 5 years of AMS
Devopsdays Amsterdam 2017 Keynote, looking back at 5 years of AMSKris Buytaert
 
Another 7 tools for your #devops stack
Another 7 tools for your #devops stackAnother 7 tools for your #devops stack
Another 7 tools for your #devops stackKris Buytaert
 
Open Source Monitoring in 2015
Open Source Monitoring in 2015Open Source Monitoring in 2015
Open Source Monitoring in 2015Kris Buytaert
 
No, we can't do continuous delivery
No, we can't do continuous deliveryNo, we can't do continuous delivery
No, we can't do continuous deliveryKris Buytaert
 
Looking back at 6.5 years of #devopsdays
Looking back at 6.5 years of #devopsdaysLooking back at 6.5 years of #devopsdays
Looking back at 6.5 years of #devopsdaysKris Buytaert
 

Tendances (20)

Adopting Devops , Stories from the trenches
Adopting Devops , Stories from the trenchesAdopting Devops , Stories from the trenches
Adopting Devops , Stories from the trenches
 
Devops 101 QA with Kris Buytaert
Devops 101 QA  with Kris BuytaertDevops 101 QA  with Kris Buytaert
Devops 101 QA with Kris Buytaert
 
The Return of the Dull Stack Engineer
The Return of the Dull Stack EngineerThe Return of the Dull Stack Engineer
The Return of the Dull Stack Engineer
 
Moby is killing your devops efforts
Moby is killing your devops effortsMoby is killing your devops efforts
Moby is killing your devops efforts
 
Monitoring Drupal In an Infrastructure as Code Age
Monitoring Drupal In an Infrastructure as Code AgeMonitoring Drupal In an Infrastructure as Code Age
Monitoring Drupal In an Infrastructure as Code Age
 
Nightmare on Docker street
Nightmare on Docker streetNightmare on Docker street
Nightmare on Docker street
 
Devops is dead, Long Live Devops
Devops is dead, Long Live DevopsDevops is dead, Long Live Devops
Devops is dead, Long Live Devops
 
From devoops to devops
From devoops to devopsFrom devoops to devops
From devoops to devops
 
Docker is killing your #devops Efforts
Docker is killing your #devops EffortsDocker is killing your #devops Efforts
Docker is killing your #devops Efforts
 
Devops is not about Tooling
Devops is not about ToolingDevops is not about Tooling
Devops is not about Tooling
 
Devops, The future is here, it's just not evenly distributed
Devops, The future is here, it's just not evenly distributedDevops, The future is here, it's just not evenly distributed
Devops, The future is here, it's just not evenly distributed
 
Can we fix dev-oops ?
Can we fix dev-oops ?Can we fix dev-oops ?
Can we fix dev-oops ?
 
Is there a future for devops ?
Is there a future for devops ?Is there a future for devops ?
Is there a future for devops ?
 
Continous Delivery of your Infrastructure
Continous Delivery of your InfrastructureContinous Delivery of your Infrastructure
Continous Delivery of your Infrastructure
 
Continuous Infrastructure First
Continuous Infrastructure FirstContinuous Infrastructure First
Continuous Infrastructure First
 
Devopsdays Amsterdam 2017 Keynote, looking back at 5 years of AMS
Devopsdays Amsterdam 2017 Keynote, looking back at 5 years of AMSDevopsdays Amsterdam 2017 Keynote, looking back at 5 years of AMS
Devopsdays Amsterdam 2017 Keynote, looking back at 5 years of AMS
 
Another 7 tools for your #devops stack
Another 7 tools for your #devops stackAnother 7 tools for your #devops stack
Another 7 tools for your #devops stack
 
Open Source Monitoring in 2015
Open Source Monitoring in 2015Open Source Monitoring in 2015
Open Source Monitoring in 2015
 
No, we can't do continuous delivery
No, we can't do continuous deliveryNo, we can't do continuous delivery
No, we can't do continuous delivery
 
Looking back at 6.5 years of #devopsdays
Looking back at 6.5 years of #devopsdaysLooking back at 6.5 years of #devopsdays
Looking back at 6.5 years of #devopsdays
 

Similaire à Dev secops opsec, devsec, devops ?

Devops is a Security Requirement
Devops is a Security RequirementDevops is a Security Requirement
Devops is a Security RequirementKris Buytaert
 
Continuous Delivery of (y)our infrastructure.
Continuous Delivery of (y)our infrastructure.Continuous Delivery of (y)our infrastructure.
Continuous Delivery of (y)our infrastructure.Kris Buytaert
 
From Config Management Sucks to #cfgmgmtlove
From Config Management Sucks to #cfgmgmtlove From Config Management Sucks to #cfgmgmtlove
From Config Management Sucks to #cfgmgmtlove Kris Buytaert
 
OSMC 2017 | Groovy There is a Docker in my Dashing Pipeline by Kris Buytaert
OSMC 2017 | Groovy There is a Docker in my Dashing Pipeline by Kris Buytaert OSMC 2017 | Groovy There is a Docker in my Dashing Pipeline by Kris Buytaert
OSMC 2017 | Groovy There is a Docker in my Dashing Pipeline by Kris Buytaert NETWAYS
 
Pipeline as code for your infrastructure as Code
Pipeline as code for your infrastructure as CodePipeline as code for your infrastructure as Code
Pipeline as code for your infrastructure as CodeKris Buytaert
 
Run stuff, Deploy Stuff, Jax London 2017 Edition
Run stuff, Deploy Stuff, Jax London 2017 EditionRun stuff, Deploy Stuff, Jax London 2017 Edition
Run stuff, Deploy Stuff, Jax London 2017 EditionKris Buytaert
 
Automating MySQL operations with Puppet
Automating MySQL operations with PuppetAutomating MySQL operations with Puppet
Automating MySQL operations with PuppetKris Buytaert
 
Its not about the tooling
Its not about the toolingIts not about the tooling
Its not about the toolingBram Vogelaar
 
Let's bring the teams back together
Let's bring the teams back togetherLet's bring the teams back together
Let's bring the teams back togetherKris Buytaert
 
OSDC 2015: Kris Buytaert | From ConfigManagementSucks to ConfigManagementLove
OSDC 2015: Kris Buytaert | From ConfigManagementSucks to ConfigManagementLoveOSDC 2015: Kris Buytaert | From ConfigManagementSucks to ConfigManagementLove
OSDC 2015: Kris Buytaert | From ConfigManagementSucks to ConfigManagementLoveNETWAYS
 
OSDC 2016 - Another 7 Tools for your #devops Stack by Kris Buytaert
OSDC 2016 - Another 7 Tools for your #devops Stack by Kris BuytaertOSDC 2016 - Another 7 Tools for your #devops Stack by Kris Buytaert
OSDC 2016 - Another 7 Tools for your #devops Stack by Kris BuytaertNETWAYS
 
Deploying your SaaS stack OnPrem
Deploying your SaaS stack OnPremDeploying your SaaS stack OnPrem
Deploying your SaaS stack OnPremKris Buytaert
 
Icinga Camp Amsterdam - Infrastructure as Code
Icinga Camp Amsterdam - Infrastructure as CodeIcinga Camp Amsterdam - Infrastructure as Code
Icinga Camp Amsterdam - Infrastructure as CodeIcinga
 
Continuous Infrastructure First Ignite Edition
Continuous Infrastructure First  Ignite EditionContinuous Infrastructure First  Ignite Edition
Continuous Infrastructure First Ignite EditionKris Buytaert
 
DevOps Days Kyiv 2019 -- continuous Infrafirstructure First //Kris buytaert
DevOps Days Kyiv 2019 -- continuous Infrafirstructure First //Kris buytaertDevOps Days Kyiv 2019 -- continuous Infrafirstructure First //Kris buytaert
DevOps Days Kyiv 2019 -- continuous Infrafirstructure First //Kris buytaertMykola Marzhan
 
Monitoring in an Infrastructure as Code Age
Monitoring in an Infrastructure as Code AgeMonitoring in an Infrastructure as Code Age
Monitoring in an Infrastructure as Code AgePuppet
 
Devops its not about the tooling
Devops its not about the toolingDevops its not about the tooling
Devops its not about the toolingBram Vogelaar
 
Years of (not) learning , from devops to devoops
Years of (not) learning , from devops to devoopsYears of (not) learning , from devops to devoops
Years of (not) learning , from devops to devoopsKris Buytaert
 
Open Source Monitoring in 2019
Open Source Monitoring in 2019 Open Source Monitoring in 2019
Open Source Monitoring in 2019 Kris Buytaert
 
Devops Devops Devops, at Froscon
Devops Devops Devops, at FrosconDevops Devops Devops, at Froscon
Devops Devops Devops, at FrosconKris Buytaert
 

Similaire à Dev secops opsec, devsec, devops ? (20)

Devops is a Security Requirement
Devops is a Security RequirementDevops is a Security Requirement
Devops is a Security Requirement
 
Continuous Delivery of (y)our infrastructure.
Continuous Delivery of (y)our infrastructure.Continuous Delivery of (y)our infrastructure.
Continuous Delivery of (y)our infrastructure.
 
From Config Management Sucks to #cfgmgmtlove
From Config Management Sucks to #cfgmgmtlove From Config Management Sucks to #cfgmgmtlove
From Config Management Sucks to #cfgmgmtlove
 
OSMC 2017 | Groovy There is a Docker in my Dashing Pipeline by Kris Buytaert
OSMC 2017 | Groovy There is a Docker in my Dashing Pipeline by Kris Buytaert OSMC 2017 | Groovy There is a Docker in my Dashing Pipeline by Kris Buytaert
OSMC 2017 | Groovy There is a Docker in my Dashing Pipeline by Kris Buytaert
 
Pipeline as code for your infrastructure as Code
Pipeline as code for your infrastructure as CodePipeline as code for your infrastructure as Code
Pipeline as code for your infrastructure as Code
 
Run stuff, Deploy Stuff, Jax London 2017 Edition
Run stuff, Deploy Stuff, Jax London 2017 EditionRun stuff, Deploy Stuff, Jax London 2017 Edition
Run stuff, Deploy Stuff, Jax London 2017 Edition
 
Automating MySQL operations with Puppet
Automating MySQL operations with PuppetAutomating MySQL operations with Puppet
Automating MySQL operations with Puppet
 
Its not about the tooling
Its not about the toolingIts not about the tooling
Its not about the tooling
 
Let's bring the teams back together
Let's bring the teams back togetherLet's bring the teams back together
Let's bring the teams back together
 
OSDC 2015: Kris Buytaert | From ConfigManagementSucks to ConfigManagementLove
OSDC 2015: Kris Buytaert | From ConfigManagementSucks to ConfigManagementLoveOSDC 2015: Kris Buytaert | From ConfigManagementSucks to ConfigManagementLove
OSDC 2015: Kris Buytaert | From ConfigManagementSucks to ConfigManagementLove
 
OSDC 2016 - Another 7 Tools for your #devops Stack by Kris Buytaert
OSDC 2016 - Another 7 Tools for your #devops Stack by Kris BuytaertOSDC 2016 - Another 7 Tools for your #devops Stack by Kris Buytaert
OSDC 2016 - Another 7 Tools for your #devops Stack by Kris Buytaert
 
Deploying your SaaS stack OnPrem
Deploying your SaaS stack OnPremDeploying your SaaS stack OnPrem
Deploying your SaaS stack OnPrem
 
Icinga Camp Amsterdam - Infrastructure as Code
Icinga Camp Amsterdam - Infrastructure as CodeIcinga Camp Amsterdam - Infrastructure as Code
Icinga Camp Amsterdam - Infrastructure as Code
 
Continuous Infrastructure First Ignite Edition
Continuous Infrastructure First  Ignite EditionContinuous Infrastructure First  Ignite Edition
Continuous Infrastructure First Ignite Edition
 
DevOps Days Kyiv 2019 -- continuous Infrafirstructure First //Kris buytaert
DevOps Days Kyiv 2019 -- continuous Infrafirstructure First //Kris buytaertDevOps Days Kyiv 2019 -- continuous Infrafirstructure First //Kris buytaert
DevOps Days Kyiv 2019 -- continuous Infrafirstructure First //Kris buytaert
 
Monitoring in an Infrastructure as Code Age
Monitoring in an Infrastructure as Code AgeMonitoring in an Infrastructure as Code Age
Monitoring in an Infrastructure as Code Age
 
Devops its not about the tooling
Devops its not about the toolingDevops its not about the tooling
Devops its not about the tooling
 
Years of (not) learning , from devops to devoops
Years of (not) learning , from devops to devoopsYears of (not) learning , from devops to devoops
Years of (not) learning , from devops to devoops
 
Open Source Monitoring in 2019
Open Source Monitoring in 2019 Open Source Monitoring in 2019
Open Source Monitoring in 2019
 
Devops Devops Devops, at Froscon
Devops Devops Devops, at FrosconDevops Devops Devops, at Froscon
Devops Devops Devops, at Froscon
 

Plus de Kris Buytaert

Observability will not fix your Broken Monitoring ,Ignite
Observability will not fix your Broken Monitoring ,IgniteObservability will not fix your Broken Monitoring ,Ignite
Observability will not fix your Broken Monitoring ,IgniteKris Buytaert
 
Infrastructure as Code Patterns
Infrastructure as Code PatternsInfrastructure as Code Patterns
Infrastructure as Code PatternsKris Buytaert
 
From devoops to devops 13 years of (not) learning
From devoops to devops 13 years of (not) learningFrom devoops to devops 13 years of (not) learning
From devoops to devops 13 years of (not) learningKris Buytaert
 
Pipeline all the Dashboards as Code
Pipeline all the Dashboards as CodePipeline all the Dashboards as Code
Pipeline all the Dashboards as CodeKris Buytaert
 
Help , My Datacenter is on fire
Help , My Datacenter is on fireHelp , My Datacenter is on fire
Help , My Datacenter is on fireKris Buytaert
 
Devops is Dead, Long live Devops
Devops is Dead, Long live DevopsDevops is Dead, Long live Devops
Devops is Dead, Long live DevopsKris Buytaert
 
10 years of #devopsdays, but what have we really learned ?
10 years of #devopsdays, but what have we really learned ? 10 years of #devopsdays, but what have we really learned ?
10 years of #devopsdays, but what have we really learned ? Kris Buytaert
 
Is there a Future for devops ?
Is there a Future for devops   ? Is there a Future for devops   ?
Is there a Future for devops ? Kris Buytaert
 
10 Years of #devopsdays weirdness
10 Years of #devopsdays weirdness10 Years of #devopsdays weirdness
10 Years of #devopsdays weirdnessKris Buytaert
 
ADDO 2019: Looking back at over 10 years of Devops
ADDO 2019:    Looking back at over 10 years of DevopsADDO 2019:    Looking back at over 10 years of Devops
ADDO 2019: Looking back at over 10 years of DevopsKris Buytaert
 
Migrating to Puppet 5
Migrating to Puppet 5Migrating to Puppet 5
Migrating to Puppet 5Kris Buytaert
 
Repositories as Code
Repositories as CodeRepositories as Code
Repositories as CodeKris Buytaert
 
Looking back at 5 years of #cfgmgmtcamp
Looking back at 5 years of #cfgmgmtcampLooking back at 5 years of #cfgmgmtcamp
Looking back at 5 years of #cfgmgmtcampKris Buytaert
 
Looking back at 7.5 years of Devopsdays , DOd PDX
Looking back at 7.5 years of Devopsdays , DOd PDXLooking back at 7.5 years of Devopsdays , DOd PDX
Looking back at 7.5 years of Devopsdays , DOd PDXKris Buytaert
 

Plus de Kris Buytaert (16)

Observability will not fix your Broken Monitoring ,Ignite
Observability will not fix your Broken Monitoring ,IgniteObservability will not fix your Broken Monitoring ,Ignite
Observability will not fix your Broken Monitoring ,Ignite
 
Infrastructure as Code Patterns
Infrastructure as Code PatternsInfrastructure as Code Patterns
Infrastructure as Code Patterns
 
From devoops to devops 13 years of (not) learning
From devoops to devops 13 years of (not) learningFrom devoops to devops 13 years of (not) learning
From devoops to devops 13 years of (not) learning
 
Pipeline all the Dashboards as Code
Pipeline all the Dashboards as CodePipeline all the Dashboards as Code
Pipeline all the Dashboards as Code
 
Help , My Datacenter is on fire
Help , My Datacenter is on fireHelp , My Datacenter is on fire
Help , My Datacenter is on fire
 
GitOps , done Right
GitOps , done RightGitOps , done Right
GitOps , done Right
 
Devops is Dead, Long live Devops
Devops is Dead, Long live DevopsDevops is Dead, Long live Devops
Devops is Dead, Long live Devops
 
10 years of #devopsdays, but what have we really learned ?
10 years of #devopsdays, but what have we really learned ? 10 years of #devopsdays, but what have we really learned ?
10 years of #devopsdays, but what have we really learned ?
 
Is there a Future for devops ?
Is there a Future for devops   ? Is there a Future for devops   ?
Is there a Future for devops ?
 
10 Years of #devopsdays weirdness
10 Years of #devopsdays weirdness10 Years of #devopsdays weirdness
10 Years of #devopsdays weirdness
 
ADDO 2019: Looking back at over 10 years of Devops
ADDO 2019:    Looking back at over 10 years of DevopsADDO 2019:    Looking back at over 10 years of Devops
ADDO 2019: Looking back at over 10 years of Devops
 
Migrating to Puppet 5
Migrating to Puppet 5Migrating to Puppet 5
Migrating to Puppet 5
 
Repositories as Code
Repositories as CodeRepositories as Code
Repositories as Code
 
Looking back at 5 years of #cfgmgmtcamp
Looking back at 5 years of #cfgmgmtcampLooking back at 5 years of #cfgmgmtcamp
Looking back at 5 years of #cfgmgmtcamp
 
Pipeline as Code
Pipeline as CodePipeline as Code
Pipeline as Code
 
Looking back at 7.5 years of Devopsdays , DOd PDX
Looking back at 7.5 years of Devopsdays , DOd PDXLooking back at 7.5 years of Devopsdays , DOd PDX
Looking back at 7.5 years of Devopsdays , DOd PDX
 

Dernier

Salesforce Miami User Group Event - 1st Quarter 2024
Salesforce Miami User Group Event - 1st Quarter 2024Salesforce Miami User Group Event - 1st Quarter 2024
Salesforce Miami User Group Event - 1st Quarter 2024SkyPlanner
 
KubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCost
KubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCostKubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCost
KubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCostMatt Ray
 
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019IES VE
 
COMPUTER 10 Lesson 8 - Building a Website
COMPUTER 10 Lesson 8 - Building a WebsiteCOMPUTER 10 Lesson 8 - Building a Website
COMPUTER 10 Lesson 8 - Building a Websitedgelyza
 
UiPath Solutions Management Preview - Northern CA Chapter - March 22.pdf
UiPath Solutions Management Preview - Northern CA Chapter - March 22.pdfUiPath Solutions Management Preview - Northern CA Chapter - March 22.pdf
UiPath Solutions Management Preview - Northern CA Chapter - March 22.pdfDianaGray10
 
Igniting Next Level Productivity with AI-Infused Data Integration Workflows
Igniting Next Level Productivity with AI-Infused Data Integration WorkflowsIgniting Next Level Productivity with AI-Infused Data Integration Workflows
Igniting Next Level Productivity with AI-Infused Data Integration WorkflowsSafe Software
 
VoIP Service and Marketing using Odoo and Asterisk PBX
VoIP Service and Marketing using Odoo and Asterisk PBXVoIP Service and Marketing using Odoo and Asterisk PBX
VoIP Service and Marketing using Odoo and Asterisk PBXTarek Kalaji
 
AI You Can Trust - Ensuring Success with Data Integrity Webinar
AI You Can Trust - Ensuring Success with Data Integrity WebinarAI You Can Trust - Ensuring Success with Data Integrity Webinar
AI You Can Trust - Ensuring Success with Data Integrity WebinarPrecisely
 
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPA
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPAAnypoint Code Builder , Google Pub sub connector and MuleSoft RPA
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPAshyamraj55
 
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...Will Schroeder
 
Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)Commit University
 
Empowering Africa's Next Generation: The AI Leadership Blueprint
Empowering Africa's Next Generation: The AI Leadership BlueprintEmpowering Africa's Next Generation: The AI Leadership Blueprint
Empowering Africa's Next Generation: The AI Leadership BlueprintMahmoud Rabie
 
UiPath Studio Web workshop series - Day 8
UiPath Studio Web workshop series - Day 8UiPath Studio Web workshop series - Day 8
UiPath Studio Web workshop series - Day 8DianaGray10
 
Building Your Own AI Instance (TBLC AI )
Building Your Own AI Instance (TBLC AI )Building Your Own AI Instance (TBLC AI )
Building Your Own AI Instance (TBLC AI )Brian Pichman
 
activity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdf
activity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdf
activity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdfJamie (Taka) Wang
 
Basic Building Blocks of Internet of Things.
Basic Building Blocks of Internet of Things.Basic Building Blocks of Internet of Things.
Basic Building Blocks of Internet of Things.YounusS2
 
9 Steps For Building Winning Founding Team
9 Steps For Building Winning Founding Team9 Steps For Building Winning Founding Team
9 Steps For Building Winning Founding TeamAdam Moalla
 
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdfIaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdfDaniel Santiago Silva Capera
 

Dernier (20)

20230104 - machine vision
20230104 - machine vision20230104 - machine vision
20230104 - machine vision
 
Salesforce Miami User Group Event - 1st Quarter 2024
Salesforce Miami User Group Event - 1st Quarter 2024Salesforce Miami User Group Event - 1st Quarter 2024
Salesforce Miami User Group Event - 1st Quarter 2024
 
KubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCost
KubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCostKubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCost
KubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCost
 
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
 
COMPUTER 10 Lesson 8 - Building a Website
COMPUTER 10 Lesson 8 - Building a WebsiteCOMPUTER 10 Lesson 8 - Building a Website
COMPUTER 10 Lesson 8 - Building a Website
 
20150722 - AGV
20150722 - AGV20150722 - AGV
20150722 - AGV
 
UiPath Solutions Management Preview - Northern CA Chapter - March 22.pdf
UiPath Solutions Management Preview - Northern CA Chapter - March 22.pdfUiPath Solutions Management Preview - Northern CA Chapter - March 22.pdf
UiPath Solutions Management Preview - Northern CA Chapter - March 22.pdf
 
Igniting Next Level Productivity with AI-Infused Data Integration Workflows
Igniting Next Level Productivity with AI-Infused Data Integration WorkflowsIgniting Next Level Productivity with AI-Infused Data Integration Workflows
Igniting Next Level Productivity with AI-Infused Data Integration Workflows
 
VoIP Service and Marketing using Odoo and Asterisk PBX
VoIP Service and Marketing using Odoo and Asterisk PBXVoIP Service and Marketing using Odoo and Asterisk PBX
VoIP Service and Marketing using Odoo and Asterisk PBX
 
AI You Can Trust - Ensuring Success with Data Integrity Webinar
AI You Can Trust - Ensuring Success with Data Integrity WebinarAI You Can Trust - Ensuring Success with Data Integrity Webinar
AI You Can Trust - Ensuring Success with Data Integrity Webinar
 
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPA
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPAAnypoint Code Builder , Google Pub sub connector and MuleSoft RPA
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPA
 
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
 
Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)Crea il tuo assistente AI con lo Stregatto (open source python framework)
Crea il tuo assistente AI con lo Stregatto (open source python framework)
 
Empowering Africa's Next Generation: The AI Leadership Blueprint
Empowering Africa's Next Generation: The AI Leadership BlueprintEmpowering Africa's Next Generation: The AI Leadership Blueprint
Empowering Africa's Next Generation: The AI Leadership Blueprint
 
UiPath Studio Web workshop series - Day 8
UiPath Studio Web workshop series - Day 8UiPath Studio Web workshop series - Day 8
UiPath Studio Web workshop series - Day 8
 
Building Your Own AI Instance (TBLC AI )
Building Your Own AI Instance (TBLC AI )Building Your Own AI Instance (TBLC AI )
Building Your Own AI Instance (TBLC AI )
 
activity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdf
activity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdf
activity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdf
 
Basic Building Blocks of Internet of Things.
Basic Building Blocks of Internet of Things.Basic Building Blocks of Internet of Things.
Basic Building Blocks of Internet of Things.
 
9 Steps For Building Winning Founding Team
9 Steps For Building Winning Founding Team9 Steps For Building Winning Founding Team
9 Steps For Building Winning Founding Team
 
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdfIaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
IaC & GitOps in a Nutshell - a FridayInANuthshell Episode.pdf
 

Dev secops opsec, devsec, devops ?

  • 1. Devops, Secops, Opsec,Devops, Secops, Opsec, DevSec *ops *.* ?DevSec *ops *.* ? Kris Buytaert Brussels , February 2016
  • 2. Kris BuytaertKris Buytaert ● I used to be a Dev,I used to be a Dev, ● Then Became an OpThen Became an Op ● Even did Security (OSSTM)Even did Security (OSSTM) ● Chief Trolling Officer and Open SourceChief Trolling Officer and Open Source Consultant @inuits.euConsultant @inuits.eu ● Everything is an effing DNS ProblemEverything is an effing DNS Problem ● Building Clouds since before the bookstoreBuilding Clouds since before the bookstore ● Some books, some papers, some blogsSome books, some papers, some blogs ● Too many conferences.Too many conferences.
  • 3. Who is runningWho is running ● DrupalDrupal ● OpenSSLOpenSSL ● BashBash
  • 4. Who is runningWho is running ● Drupal < 7.38Drupal < 7.38 ● OpenSSL 1.0.1 → 1.0.1fOpenSSL 1.0.1 → 1.0.1f ● Bash < 4.3...Bash < 4.3...
  • 5. Who has them upgraded over the pastWho has them upgraded over the past 12 months ?12 months ?
  • 6. What's this Devops thing really about ?What's this Devops thing really about ?
  • 7. World , 200X-2009World , 200X-2009 Patrick Debois, Gildas Le Nadan, Andrew Clay Shafer, Kris Buytaert, JezzPatrick Debois, Gildas Le Nadan, Andrew Clay Shafer, Kris Buytaert, Jezz Humble, Lindsay Holmwood, John Willis, Chris Read, Julian Simpson, andHumble, Lindsay Holmwood, John Willis, Chris Read, Julian Simpson, and lots of others ..lots of others .. Gent , October 2009Gent , October 2009 Mountain View , June 2010Mountain View , June 2010 Hamburg , October 2010Hamburg , October 2010 Boston, March 2011Boston, March 2011 Mountain View, June 2011Mountain View, June 2011 Bangalore, Melbourne,Bangalore, Melbourne, Goteborg , October 2011Goteborg , October 2011
  • 8. C(L)AMSC(L)AMS ● CultureCulture ● (Lean)(Lean) ● AutomationAutomation ● MeasurementMeasurement ● SecuritySecurity Damon Edwards and John WillisDamon Edwards and John Willis
  • 9. Frank BreedijkFrank Breedijk @seccubus@seccubus ● Http → httpsHttp → https ● Imap → imapsImap → imaps ● Pop3 → pop3sPop3 → pop3s ● Devop → devopSDevop → devopS
  • 10. ““DevOps is a cultural andDevOps is a cultural and professional movement”professional movement” Adam JacobAdam Jacob
  • 11. How did we get here ?How did we get here ?
  • 12. The Old DaysThe Old Days ● ““Put this Code Live, here's a tarball” NOW!Put this Code Live, here's a tarball” NOW! ● What dependencies ?What dependencies ? ● No machines available ?No machines available ? ● What database ?What database ? ● Security ?Security ? ● High Availability ?High Availability ? ● Scalability ?Scalability ? ● My computer can't install this ?My computer can't install this ?
  • 13. Devs vs OpsDevs vs Ops
  • 14. People hate SysadminsPeople hate Sysadmins BecauseBecause •They slow stuff downThey slow stuff down •The say noThe say no •They say no againThey say no again •They refuse to break stuffThey refuse to break stuff •They care about uptimeThey care about uptime •They don't care about fancy new featuresThey don't care about fancy new features
  • 16. People hate SecurityPeople hate Security OfficersOfficers BecauseBecause •They slow stuff downThey slow stuff down •The say noThe say no •They say no againThey say no again •They refuse to leave holes openThey refuse to leave holes open •They care about securityThey care about security •They don't care about fancy new featuresThey don't care about fancy new features •Security Officers have an expiry dateSecurity Officers have an expiry date
  • 18. 10 days into operation10 days into operation ● What High Load ? What Memory usage ?What High Load ? What Memory usage ? ● Are these Logs ? Or this is actualy customerAre these Logs ? Or this is actualy customer data ?data ? ● How many users are there , should they launchHow many users are there , should they launch 100 queries each ?? Oh we're having 10K100 queries each ?? Oh we're having 10K usersusers ● Why is debugging enabled ?Why is debugging enabled ? ● Who wrote this ?Who wrote this ?
  • 19. 11 days into operations11 days into operations
  • 20. 12 days into operations12 days into operations
  • 21. 13 days into operations13 days into operations
  • 22. We can solve this !We can solve this ! ● We are not here toWe are not here to blockblock ● Some people thinkSome people think the Security /the Security / Operations workOperations work starts on deploymentstarts on deployment ● It starts much earlierIt starts much earlier ● Start talking asapStart talking asap
  • 24. Breaking the SilosBreaking the Silos Getting AlongGetting AlongOpsOpsDevsDevs
  • 25. ● Who is in charge of security ?Who is in charge of security ? ● What do your developers think about security ?What do your developers think about security ? ● When do you think about securityWhen do you think about security ● The problem with security is it doesn'tThe problem with security is it doesn't generate revenuegenerate revenue ● Security needs to become part of your DNA.Security needs to become part of your DNA.
  • 26. Build TrustBuild Trust ● ExperimentExperiment • DevDev • TestTest ● ProdProd ● Automate all theAutomate all the thingsthings ● Measure successMeasure success ● Measure FailureMeasure Failure
  • 27. With great power ...With great power ... Your code will go to production..Your code will go to production.. You will be able to fix it ..You will be able to fix it .. You will have access to the logsYou will have access to the logs Access to the metrics...Access to the metrics...
  • 30. Devops is a ReorgDevops is a Reorg ● New role for Change ManagementNew role for Change Management ● New role for Security OfficersNew role for Security Officers ● Added roles for TestersAdded roles for Testers
  • 33. " Our job as engineers (and ops, dev-ops, QA," Our job as engineers (and ops, dev-ops, QA, support, everyone in the company actually) is tosupport, everyone in the company actually) is to enable the business goals. We strongly feel thatenable the business goals. We strongly feel that in order to do that you must havein order to do that you must have the ability tothe ability to deploy code quickly and safelydeploy code quickly and safely. Even if the. Even if the business goals are to deploy strongly QA’d codebusiness goals are to deploy strongly QA’d code once a month at 3am (it’s not for us, we push allonce a month at 3am (it’s not for us, we push all the time), having a reliable and easythe time), having a reliable and easy deployment should bedeployment should be non-negotiablenon-negotiable."." Etsy Blog upon releasing DeployinatorEtsy Blog upon releasing Deployinator http://codeascraft.etsy.com/2010/05/20/quantum-of-deployment/http://codeascraft.etsy.com/2010/05/20/quantum-of-deployment/
  • 34. Continuous Delivery is aContinuous Delivery is a Security RequirementSecurity Requirement
  • 35. How do we get there ?How do we get there ?
  • 36. Use Version ControlUse Version Control No ExcusesNo Excuses Also for scripts/config/cookbooks,manifests,etcAlso for scripts/config/cookbooks,manifests,etc
  • 37. CI ToolsCI Tools ● HudsonHudson ● JenkinsJenkins •A zillion pluginsA zillion plugins ● Make your builds reproducible !Make your builds reproducible ! ● Test your (Puppet/Chef/CFengine)Test your (Puppet/Chef/CFengine)
  • 39. Test AutomationTest Automation ● Unit testsUnit tests ● Regression testsRegression tests ● SeleniumSelenium ● CucumberCucumber ● TDDTDD ● BDDBDD
  • 41. What's in your Pipeline ?What's in your Pipeline ?
  • 42. A pipelineA pipeline ● Checkout codeCheckout code ● SyntaxSyntax ● StyleStyle ● Code CoverageCode Coverage ● TestsTests ● BuildBuild ● More TestsMore Tests ● PackagePackage ● Upload to RepoUpload to Repo
  • 43. A pipeline++A pipeline++ ● Checkout codeCheckout code ● SyntaxSyntax ● StyleStyle ● Code CoverageCode Coverage ● TestsTests ● BuildBuild ● More TestsMore Tests ● PackagePackage ● Upload to RepoUpload to Repo ● Deploy on TestDeploy on Test ● …… ● Insert SECURITYInsert SECURITY TESTS !TESTS !
  • 44. Attack yourselve onAttack yourselve on every buildevery build ● Gauntlt , write security testsGauntlt , write security tests ● Vulnerability scans (Arachni)Vulnerability scans (Arachni) ● Content Scanner (DIRB)Content Scanner (DIRB) ● …… ● https://github.com/garethr/pentesting-playgrouhttps://github.com/garethr/pentesting-playgrou ndnd
  • 45. Infrastructure as CodeInfrastructure as Code ● Configure 1000 nodes,Configure 1000 nodes, ● Modify 2000 files,Modify 2000 files, ● TogetherTogether ● Think :Think : •Cfengine,Puppet, ChefCfengine,Puppet, Chef ● Put configs under version controlPut configs under version control ● Please don't roll your own ...Please don't roll your own ...
  • 47. OrchestrationOrchestration ● Fix security issues with 1 commandFix security issues with 1 command ● Mco package bind upgradeMco package bind upgrade ● Write Ansible role to upgradeWrite Ansible role to upgrade
  • 48. Culture,Culture, Automation,Automation, Measurement :Measurement : measure all the thingsmeasure all the things SharingSharing
  • 52. Security in devops ?Security in devops ? ● Version control => AuditingVersion control => Auditing ● CI => Add security IN the pipelineCI => Add security IN the pipeline ● Configuration MgmtConfiguration Mgmt •Policy DefinitionPolicy Definition •Auditing & EnforcingAuditing & Enforcing ● MonitoringMonitoring
  • 53. Debunking the CriticsDebunking the Critics Security not included ?Security not included ? Everyone is Included:Everyone is Included: security, dba, devs,security, dba, devs, ops, designer, analysts,ops, designer, analysts, We are solving a busines problem,We are solving a busines problem, Not a technology problemNot a technology problem
  • 55. It's not about the toolsIt's not about the tools It's about changeIt's about change It's about the peopleIt's about the people
  • 56. {devops security }{devops security } is not a product you can buy,is not a product you can buy, It's a lifestyleIt's a lifestyle
  • 57. ContactContact Kris Buytaert Kris.Buytaert@inuits.euKris Buytaert Kris.Buytaert@inuits.eu Further ReadingFurther Reading @krisbuytaert@krisbuytaert http://www.krisbuytaert.be/blog/http://www.krisbuytaert.be/blog/ http://www.inuits.eu/http://www.inuits.eu/ InuitsInuits Essensesteenweg 31Essensesteenweg 31 2930 Brasschaat2930 Brasschaat BelgiumBelgium 891.514.231891.514.231 +32 475 961221+32 475 961221