Thread by @CoverosGene

DevSecOps: Essential Tooling to Enable Continuous Security by @armillz @GlobalAppSecDC

As DevOps/Agile processes push code continuously, disjoint/mysterious security teams can’t keep up. No time for slow, manual, late-cycle security. We want to be “secure enough” all the time. @armillz @GlobalAppSecDC

Application code must be assessed at multiple levels as it makes it way through the delivery lifecycle. @armillz @GlobalAppSecDC

From a pipeline and tooling standpoint, we want quality gates. Quality = Quality, Security, Maintainability, and every other -ility. Provide an overall picture of code health, stop bad code from getting through. @armillz @GlobalAppSecDC

Static Application Scanning
- static code analysis
- software composition analysis
- platform vulnerability scanning
- container scanning
@armillz @GlobalAppSecDC

Dynamic Functional Testing
- unit testing
- health tests
- API testing
- UI testing
@armillz @GlobalAppSecDC

Non-functional testing
- DAST
- performance testing
- 508 accessibility testing
- other compliance testing
@armillz @GlobalAppSecDC

Real-time monitoring
- log aggregation
- real-time container and host monitoring
- container and host scanning
- performance monitoring
Wraps into SIEM
@armillz @GlobalAppSecDC

Integrate your dev, sec, QA, ops teams to streamline your delivery process and enable success. Can’t succeed with only compliance box checkers.
Get the teams to work together.
- Security consultants, not security police
- Contributors, not naysayers
@armillz @GlobalAppSecDC

You will never have enough security engineers for every team. Need cross-team functions (vs. just cross-functional teams)
@armillz @GlobalAppSecDC

Strive for continuous assessment. Develop a culture of security.
Start small, possibly free.
@armillz @GlobalAppSecDC

Use time budgets to arrange your security tests and scans. Do a lightweight scan up front, then move deeper scans later (overnight, weekends). Break it up in smaller chunks (one advantage of microservices).
@armillz @GlobalAppSecDC

It is hard/impossible to keep up with all the new tools. Find something the works. You don’t need the perfect tool, you just need a tool. Try free, then once you learn more you might find that the expensive commercial tool saves you money in hours.
@armillz @GlobalAppSecDC

I guess a few people were interested in @armillz’s talk @GlobalAppSecDC

Split up your security tasks to spread them throughout your sprint-ly activities. E.g., 20 minutes of threat modeling during each story planning, not 3 days of threat modeling once a release.
@armillz @GlobalAppSecDC