does agile make us less secure
play

Does agile make us less secure? Security in a post devops world - PowerPoint PPT Presentation

Sep 20, 2023 •319 likes •1.71k views

Does agile make us less secure? Security in a post devops world YOW! Sydney 2019 Michael Brunton-Spall Bruntonspall Ltd Michael Brunton-Spall He/His/Him michael@bruntonspall.com Michael Brunton-Spall Bruntonspall Ltd The second most

  1. Does agile make us less secure? Security in a post devops world YOW! Sydney 2019 Michael Brunton-Spall Bruntonspall Ltd

  2. Michael Brunton-Spall He/His/Him michael@bruntonspall.com Michael Brunton-Spall Bruntonspall Ltd

  3. The second most scariest words in the English language Michael Brunton-Spall Bruntonspall Ltd

  4. The second most scariest words in the English language “Hi, I’m from the Government and I’m here to help” Michael Brunton-Spall Bruntonspall Ltd

  5. The scariest words in the English language? Michael Brunton-Spall Bruntonspall Ltd

  6. The scariest words in the English language? “Hi, I’m from security and I’m here to help” Michael Brunton-Spall Bruntonspall Ltd

  7. Michael Brunton-Spall Bruntonspall Ltd

  8. https://cyberweekly.net Michael Brunton-Spall Bruntonspall Ltd

  9. Why is security evolving Where we’ve come from Where we are going Michael Brunton-Spall Bruntonspall Ltd

  10. How to rethink security practices in organisations Michael Brunton-Spall Bruntonspall Ltd

  11. Some Context Michael Brunton-Spall Bruntonspall Ltd

  12. 2006 Michael Brunton-Spall Bruntonspall Ltd 06/12/2019 12

  13. 2010 Michael Brunton-Spall Bruntonspall Ltd 06/12/2019 13

  14. 2013 Michael Brunton-Spall Bruntonspall Ltd 06/12/2019 14

  15. 2015 Michael Brunton-Spall Bruntonspall Ltd 06/12/2019 15

  16. 2019 Michael Brunton-Spall Bruntonspall Ltd 06/12/2019 16

  17. Michael Brunton-Spall Bruntonspall Ltd

  18. Michael Brunton-Spall Bruntonspall Ltd

  19. Michael Brunton-Spall Bruntonspall Ltd

  20. Michael Brunton-Spall Bruntonspall Ltd

  21. Michael Brunton-Spall Bruntonspall Ltd 06/12/2019 21

  22. Michael Brunton-Spall Bruntonspall Ltd 06/12/2019 22

  23. Michael Brunton-Spall Bruntonspall Ltd 06/12/2019 23

  24. Michael Brunton-Spall Bruntonspall Ltd 06/12/2019 24

  25. Michael Brunton-Spall Bruntonspall Ltd

  26. Maginot Line

  27. 1930 France Michael Brunton-Spall Bruntonspall Ltd

  28. “We’d really like Germany not to invade us” Michael Brunton-Spall Bruntonspall Ltd

  29. In WW1, they came slowly overland and built trenches Michael Brunton-Spall Bruntonspall Ltd

  30. Michael Brunton-Spall Bruntonspall Ltd

  31. Michael Brunton-Spall Bruntonspall Ltd

  32. Michael Brunton-Spall Bruntonspall Ltd

  33. The Germans had invented Blitzkrieg “Lightning Strike” which simply went around Michael Brunton-Spall Bruntonspall Ltd

  34. Michael Brunton-Spall Bruntonspall Ltd

  35. The French were fighting a war from 1920 against an adversary using 1939 techniques Michael Brunton-Spall Bruntonspall Ltd

  36. Evolution

  37. Michael Brunton-Spall Bruntonspall Ltd

  38. Custom built minicomputer Michael Brunton-Spall Bruntonspall Ltd

  39. Servers in data center Michael Brunton-Spall Bruntonspall Ltd

  40. Colocated servers Michael Brunton-Spall Bruntonspall Ltd

  41. Virtual private servers Michael Brunton-Spall Bruntonspall Ltd

  42. Virtual machines at scale Michael Brunton-Spall Bruntonspall Ltd

  43. Michael Brunton-Spall Bruntonspall Ltd

  44. Michael Brunton-Spall Bruntonspall Ltd

  45. Why Wardley Maps? Michael Brunton-Spall Bruntonspall Ltd

  46. We can see changing landscapes Michael Brunton-Spall Bruntonspall Ltd

  47. We can discuss strategies Michael Brunton-Spall Bruntonspall Ltd

  48. A map isn’t reality, it’s just an abstraction Michael Brunton-Spall Bruntonspall Ltd

  49. Things evolve Michael Brunton-Spall Bruntonspall Ltd

  50. As servers move from physical to virtual, single to multiple, practice evolves Michael Brunton-Spall Bruntonspall Ltd

  51. Coevolution of product and practice

  52. Michael Brunton-Spall Bruntonspall Ltd

  53. Michael Brunton-Spall Bruntonspall Ltd

  54. Michael Brunton-Spall Bruntonspall Ltd

  55. How do we administer servers? Michael Brunton-Spall Bruntonspall Ltd

  56. Worries about hard drives, CPU’s, power etc Michael Brunton-Spall Bruntonspall Ltd

  57. Cloud providers give us abstractions Michael Brunton-Spall Bruntonspall Ltd

  58. Michael Brunton-Spall Bruntonspall Ltd

  59. We stop worrying about whether a hard drive fails in a server Michael Brunton-Spall Bruntonspall Ltd

  60. This results in changing operations practice Michael Brunton-Spall Bruntonspall Ltd

  61. DevOps, SRE Michael Brunton-Spall Bruntonspall Ltd

  62. This results in different developer consumption of operations Michael Brunton-Spall Bruntonspall Ltd

  63. Kubernetes, Serverless Michael Brunton-Spall Bruntonspall Ltd

  64. Michael Brunton-Spall Bruntonspall Ltd

  65. What does this mean for security? Michael Brunton-Spall Bruntonspall Ltd

  66. How we think about security has to change Michael Brunton-Spall Bruntonspall Ltd

  67. Security practices have to evolve Michael Brunton-Spall Bruntonspall Ltd

  68. Michael Brunton-Spall Bruntonspall Ltd

  69. Traditional security is about assurance Michael Brunton-Spall Bruntonspall Ltd

  70. Where will my data sit Michael Brunton-Spall Bruntonspall Ltd

  71. Where does the data go Michael Brunton-Spall Bruntonspall Ltd

  72. Michael Brunton-Spall Bruntonspall Ltd

  73. This works when you have individual servers Michael Brunton-Spall Bruntonspall Ltd

  74. This doesn’t work with modern cloud Michael Brunton-Spall Bruntonspall Ltd

  75. This doesn’t work th the e same same with modern cloud Michael Brunton-Spall Bruntonspall Ltd

  76. Security is currently fighting a war from a decade ago Michael Brunton-Spall Bruntonspall Ltd

  77. Mapping Security

  78. Michael Brunton-Spall Bruntonspall Ltd

  79. “Skate to where the puck is going, not where it has been” Wayne Gretsky Michael Brunton-Spall Bruntonspall Ltd

  80. Where the puck was yesterday Michael Brunton-Spall Bruntonspall Ltd

  81. What are solved problems? Michael Brunton-Spall Bruntonspall Ltd

  82. Commonly solved the same way Michael Brunton-Spall Bruntonspall Ltd

  83. Productionised processes Michael Brunton-Spall Bruntonspall Ltd

  84. Michael Brunton-Spall Bruntonspall Ltd

  85. SDLC, Assurance of suppliers, network assurance, hardware assurance Michael Brunton-Spall Bruntonspall Ltd

  86. All cloud customers have similar concerns in this area Michael Brunton-Spall Bruntonspall Ltd

  87. Buy don’t Build Michael Brunton-Spall Bruntonspall Ltd

  88. Compliance via certificates ISO27001, CSA, ISO27017, SOC, FISMA, HIPAA … Michael Brunton-Spall Bruntonspall Ltd

  89. Where the puck is today Michael Brunton-Spall Bruntonspall Ltd

  90. Michael Brunton-Spall Bruntonspall Ltd

  91. Continuous Integration, Continuous Deployment, DevOps Michael Brunton-Spall Bruntonspall Ltd

  92. Patching Michael Brunton-Spall Bruntonspall Ltd

  93. How quickly can you patch? Michael Brunton-Spall Bruntonspall Ltd

  94. DevOps Michael Brunton-Spall Bruntonspall Ltd

  95. How secure is your code? Michael Brunton-Spall Bruntonspall Ltd

  96. Code review and Pull requests Michael Brunton-Spall Bruntonspall Ltd

  97. Staff identity and single sign on Michael Brunton-Spall Bruntonspall Ltd

  98. Zero Trust Networking Michael Brunton-Spall Bruntonspall Ltd

  99. Michael Brunton-Spall Bruntonspall Ltd

  100. But where is the puck going? Michael Brunton-Spall Bruntonspall Ltd

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

Secure Agile Development With FISMA Compliance https://www.fyrmassociates.com/ FYRM Overview

Secure Agile Development With FISMA Compliance https://www.fyrmassociates.com/ FYRM Overview

Secure Agile Development With FISMA Compliance https://www.fyrmassociates.com/ FYRM Overview Qualifications Performance Strategy Experience CPAR 4/4 Secure Agile Respected Partner CMS, DOE Knowledge Sharing FedRAMP

197 views • 16 slides
KB GOING AGILE HOW TO MAKE THE CHANGE WORK? S E P T E M B E R 1 0 - 1 1 , 2 0 1 8 WHY

KB GOING AGILE HOW TO MAKE THE CHANGE WORK? S E P T E M B E R 1 0 - 1 1 , 2 0 1 8 WHY

KB GOING AGILE HOW TO MAKE THE CHANGE WORK? S E P T E M B E R 1 0 - 1 1 , 2 0 1 8 WHY AGILE@KB? OUR ENVIRONMENT IS CHARACTERIZED BY INCREASING COMPETITIVE PRESSURE AND CUSTOMER DEMANDS On the other hand, our former operating model was not

644 views • 16 slides
The Joy of Open, Agile Government Security Compliance Using F/LOSS, Agile and DevSecOps to help

The Joy of Open, Agile Government Security Compliance Using F/LOSS, Agile and DevSecOps to help

The Joy of Open, Agile Government Security Compliance Using F/LOSS, Agile and DevSecOps to help make compliance secure Fen Labalme TOC How did I get here What is CivicActions What is compliance Making compliance fun Culture

1.24k views • 89 slides
(11-14) How much do you know about the internet? Make sure you stay SAFE AND SECURE ONLINE YOU

(11-14) How much do you know about the internet? Make sure you stay SAFE AND SECURE ONLINE YOU

(11-14) How much do you know about the internet? Make sure you stay SAFE AND SECURE ONLINE YOU KNOW EMAIL YOU KNOW SOCIAL NETWORKING YOU KNOW INSTANT MESSAGING YOU KNOW DOWNLOADS YOU KNOW GAMING MAKE SURE YOU Know Your World Make the

781 views • 28 slides
SELLING AGILE V E S A PA L M U @ W U N D E R . U K B U S I N E S S A N D S T R AT E G Y T R

SELLING AGILE V E S A PA L M U @ W U N D E R . U K B U S I N E S S A N D S T R AT E G Y T R

SELLING AGILE V E S A PA L M U @ W U N D E R . U K B U S I N E S S A N D S T R AT E G Y T R A C K Vendor? Customer? In-house team? New to agile? Some agile? 100% agile? Questions, feedback on Twitter #SellingAgile The Story 1.

918 views • 54 slides
The AGILE Data Center and the First AGILE Catalog Carlotta Pittori, on behalf of the AGILE

The AGILE Data Center and the First AGILE Catalog Carlotta Pittori, on behalf of the AGILE

The AGILE Data Center and the First AGILE Catalog Carlotta Pittori, on behalf of the AGILE Collaboration 2009 Fermi Symposium 2 - 5 November 2009, Washington AGILE on PSLV-C8 Sriharikota, India The AGILE April 15, 2007 Payload: the most

853 views • 38 slides
Security DevOps staying secure in agile projects Christian Schneider @cschneider4711 mail@

Security DevOps staying secure in agile projects Christian Schneider @cschneider4711 mail@

Security DevOps staying secure in agile projects Christian Schneider @cschneider4711 mail@ www. `whoami` Christian-Schneider.net Software Developer, Whitehat Hacker & Trainer Freelancer since 1997 Focus on JavaEE &

773 views • 59 slides
Bibliography [Agile Alliance2001] Agile Alliance, Principles: The Agile Alliance (2001),

Bibliography [Agile Alliance2001] Agile Alliance, Principles: The Agile Alliance (2001),

Bibliography [Agile Alliance2001] Agile Alliance, Principles: The Agile Alliance (2001), http://www.agilealliance.org/ . [Alexander2002] I. Alexander, Initial Industrial Experience of Misuse Cases in Trade-Off Analysis, pp. 1113 in

503 views • 12 slides
S t r e t c h i n g the Agile Envelope Agile Software Development Meets Corporate Deployment

S t r e t c h i n g the Agile Envelope Agile Software Development Meets Corporate Deployment

XP07 S t r e t c h i n g the Agile Envelope Agile Software Development Meets Corporate Deployment Procedures: Stretching the Agile Envelope David Leip Olly Gotel ibm.com Chief Innovation Dude Department of Computer Science Agile Methods

123 views • 10 slides
Scaling Agile to the Enterprise Enabling the Agile Enterprise Strategically Aligned, Throughput

Scaling Agile to the Enterprise Enabling the Agile Enterprise Strategically Aligned, Throughput

Scaling Agile to the Enterprise Enabling the Agile Enterprise Strategically Aligned, Throughput Focused, Human Powered Dennis Stevens Enterprise Agile Coach www.leadingagile.com OPM3: Deputy Project Manager www.dennisstevens.com PMI Agile

851 views • 71 slides
Agile Development emmet labs David Verba david@adaptivepath.com Agile Introduction Agile

Agile Development emmet labs David Verba david@adaptivepath.com Agile Introduction Agile

Agile Development emmet labs David Verba david@adaptivepath.com Agile Introduction Agile Manifesto Individuals and interactions over processes and tools Working software over comprehensive documentation Customer collaboration over contract

582 views • 31 slides
Secure Drupal Development Steven Van den Hout Steven Van den Hout

Secure Drupal Development Steven Van den Hout Steven Van den Hout

Secure Drupal Development Steven Van den Hout Steven Van den Hout @stevenvdhout http://dgo.to/@svdhout SECURE? 1 IS D DRUPAL AL S IS OPEN SOURCE SECURE? MANY EYES MAKE FOR SECURE CODE - Security by obscurity - Open

641 views • 51 slides
Duke Workshop PnT Agile Practice pnt-agile@redhat.com RED HAT CONFIDENTIAL - INTERNAL USE ONLY

Duke Workshop PnT Agile Practice pnt-agile@redhat.com RED HAT CONFIDENTIAL - INTERNAL USE ONLY

Duke Workshop PnT Agile Practice pnt-agile@redhat.com RED HAT CONFIDENTIAL - INTERNAL USE ONLY AGENDA What is Agile Why Metrics ? Agile Report explanations RED HAT CONFIDENTIAL - INTERNAL USE ONLY THE HISTORY OF AGILE RED

774 views • 44 slides
Agile Software Development 1 / 26 Agile Processes Agile Manifesto (http://agilemanifesto.org/)

Agile Software Development 1 / 26 Agile Processes Agile Manifesto (http://agilemanifesto.org/)

Agile Software Development 1 / 26 Agile Processes Agile Manifesto (http://agilemanifesto.org/) value: Individuals and interactions over processes and tools Working software over comprehensive documentation Customer collaboration over

694 views • 26 slides
Small, Modular, Agile, Secure: Pick 4 Many components makes light work Andrew Sullivan at ICANN

Small, Modular, Agile, Secure: Pick 4 Many components makes light work Andrew Sullivan at ICANN

Small, Modular, Agile, Secure: Pick 4 Many components makes light work Andrew Sullivan at ICANN 55 March 7, 2016 asullivan@dyn.com Anycast @ ICANN 55 asullivan@dyn.com Anycast is just good Good to sink traffic topologically close to

449 views • 18 slides
The Agile PMP: Teaching an Old Dog New Tricks The Agile PMP: Teaching an Old Dog New Tricks

The Agile PMP: Teaching an Old Dog New Tricks The Agile PMP: Teaching an Old Dog New Tricks

W8 Concurrent Session Wednesday 11/12/2008 12:45 PM 2:15 PM The Agile PMP: Teaching an Old Dog New Tricks The Agile PMP: Teaching an Old Dog New Tricks Presented by: Mike Cottmeyer VersionOne Presented at: Agile Development Practices

646 views • 60 slides
CS324e - Elements of Graphics and Visualization Java GUIs - Frames and Panels Intro to Java GUIs

CS324e - Elements of Graphics and Visualization Java GUIs - Frames and Panels Intro to Java GUIs

CS324e - Elements of Graphics and Visualization Java GUIs - Frames and Panels Intro to Java GUIs First, a little history Vol Libre. Made by Loren Carpenter in 1979 - 1980. http://vimeo.com/5810737 Shown at SIGGRAPH Vol Libre

377 views • 20 slides
t -tests STAT 587 (Engineering) Iowa State University October 2, 2020 Statistical hypothesis

t -tests STAT 587 (Engineering) Iowa State University October 2, 2020 Statistical hypothesis

t -tests STAT 587 (Engineering) Iowa State University October 2, 2020 Statistical hypothesis testing Statistical hypothesis testing A hypothesis test consists of two hypotheses: null hypothesis ( H 0 ) and an alternative hypothesis ( H A )

325 views • 10 slides
Memories and SRAM 1 Silicon Memories Why store things in silicon? Its fast!!!

Memories and SRAM 1 Silicon Memories Why store things in silicon? Its fast!!!

Memories and SRAM 1 Silicon Memories Why store things in silicon? Its fast!!! Compatible with logic devices (mostly) The main goal is to be cheap Dense -- The smaller the bits, the less area you need, and the more bits you

456 views • 21 slides
DATA MINING INTRO LECTURE Introduction Instructors Aris (Aris Anagnostopoulos) Mara (Mara

DATA MINING INTRO LECTURE Introduction Instructors Aris (Aris Anagnostopoulos) Mara (Mara

DATA MINING INTRO LECTURE Introduction Instructors Aris (Aris Anagnostopoulos) Mara (Mara Sorella, teaching assistant TA) Logistics Register your email (ask the instructor) Web page Class hours Office hours What do you

765 views • 50 slides
Computers and Programs ICS3U: Introduction to Computer Science Originally, computing machines

Computers and Programs ICS3U: Introduction to Computer Science Originally, computing machines

c o m p u t e r h a r d w a r e a n d d a t a r e p r e s e n t a t i o n c o m p u t e r h a r d w a r e a n d d a t a r e p r e s e n t a t i o n Computers and Programs ICS3U: Introduction to Computer Science Originally, computing machines

49 views • 3 slides
CISC 3595 Operating Systems Introduction Tuesday / Friday 11:00-12:45am

CISC 3595 Operating Systems Introduction Tuesday / Friday 11:00-12:45am

CISC 3595 Operating Systems Introduction Tuesday / Friday 11:00-12:45am Outline What is operating system? Necessary background: computer hardware organization Basic Elements Processor: Instruction

605 views • 45 slides
About Me Red Hat Cloud Evangelist Twitter: @ghaff Google+: Gordon Haff Email: ghaff@redhat.com

About Me Red Hat Cloud Evangelist Twitter: @ghaff Google+: Gordon Haff Email: ghaff@redhat.com

About Me Red Hat Cloud Evangelist Twitter: @ghaff Google+: Gordon Haff Email: ghaff@redhat.com Blog: http:// bitmason.blogspot.com Formerly: Illuminata (industry analyst), Data General (minicomputers/Unix/NUMA/ etc.) Agenda Where

610 views • 49 slides
CDBG/SSG CDBG/SSG Pr Pre-Applica pplication tion Meeting Meeting August 24, 2017 Gr

CDBG/SSG CDBG/SSG Pr Pre-Applica pplication tion Meeting Meeting August 24, 2017 Gr

CDBG/SSG CDBG/SSG Pr Pre-Applica pplication tion Meeting Meeting August 24, 2017 Gr Grants ants Bac Backg kground ound CDBG Community Development Block Grant Sponsored by HUD City annual allocations - Estimated at ~$450,000

775 views • 25 slides

More recommend