A 200-Year-Old Company Inside Out or how we implemented security - - PowerPoint PPT Presentation

▶
a 200 year old company
SMART_READER_LITE
LIVE PREVIEW

A 200-Year-Old Company Inside Out or how we implemented security - - PowerPoint PPT Presentation

Dec 15, 2023 200 likes •627 views

A 200-Year-Old Company Inside Out or how we implemented security into software development 200 years ago ... Waterfall Problems Not Adopting to Change Once a plan is made, the waterfall follows that plan no matter what. No Feedback

slide-1
SLIDE 1

A 200-Year-Old Company Inside Out

  • r how we implemented security into software development
slide-2
SLIDE 2
slide-3
SLIDE 3
slide-4
SLIDE 4

200 years ago ...

slide-5
SLIDE 5
slide-6
SLIDE 6
slide-7
SLIDE 7
slide-8
SLIDE 8
slide-9
SLIDE 9
slide-10
SLIDE 10
slide-11
SLIDE 11
slide-12
SLIDE 12
slide-13
SLIDE 13
  • Not Adopting to Change

Once a plan is made, the waterfall follows that plan no matter what.

  • No Feedback from Downstream Stages

The implementation phase does not get any feedback from the testing phase

  • Testing Only at the End

The testing phase is one of the last phases. So the whole system is most probably built on a pile of bugs

Waterfall Problems

slide-14
SLIDE 14
slide-15
SLIDE 15
  • Mini Waterfall Sprint
  • Sprint Lengths are Arbitrary
  • Operations is not Calculated for

Scrum Problems

slide-16
SLIDE 16

Kanban

slide-17
SLIDE 17
  • Open
  • No Arbitrary Sprints
  • Operations Built-In

Why Kanban?

slide-18
SLIDE 18
slide-19
SLIDE 19
slide-20
SLIDE 20

The Three Ways

System Thinking Fast Feedback Continuous Improvement

slide-21
SLIDE 21

Security?

slide-22
SLIDE 22
slide-23
SLIDE 23

We Need More Security!

slide-24
SLIDE 24

100 10 1 Dev Ops Sec

slide-25
SLIDE 25
slide-26
SLIDE 26
slide-27
SLIDE 27
slide-28
SLIDE 28
slide-29
SLIDE 29

DevSecOps

slide-30
SLIDE 30

Automate the Shit out of It

slide-31
SLIDE 31

The Equifax Breach

slide-32
SLIDE 32
slide-33
SLIDE 33

20000 40000 60000 80000 100000 120000 Mar.17 Apr.17 May.17 Jun.17 Jul.17 Aug.17 Sep.17 Oct.17 Nov.17 Dec.17 Jan.18 Feb.18 Downloads

Downloads of Vulnerable Struts Versions

Struts Vulnerability announced / fixed Breach Happened Breach Discovered Breach Dislosed

slide-34
SLIDE 34

“Emphasize performance of the entire system and never pass a defect downstream.“ (Gene Kim)

slide-35
SLIDE 35

Lots of Tools

OWASP Dependency Check Sonatype Nexus Pro Jfrog Xray

slide-36
SLIDE 36

Integrate into Your Build Pipeline

slide-37
SLIDE 37

Visualize

slide-38
SLIDE 38

Break the Build

slide-39
SLIDE 39

How to Change?

slide-40
SLIDE 40
  • Get Management on Board
  • Bottom Up
  • Small Steps
  • Review Changes
  • Don‘t be afraid of Failure

How to Change?

slide-41
SLIDE 41