Does agile make us less secure? Security in a post devops world - - PowerPoint PPT Presentation

▶
does agile make us less secure
SMART_READER_LITE
LIVE PREVIEW

Does agile make us less secure? Security in a post devops world - - PowerPoint PPT Presentation

Sep 20, 2023 319 likes •1.72k views

Does agile make us less secure? Security in a post devops world YOW! Sydney 2019 Michael Brunton-Spall Bruntonspall Ltd Michael Brunton-Spall He/His/Him michael@bruntonspall.com Michael Brunton-Spall Bruntonspall Ltd The second most

slide-1
SLIDE 1

Michael Brunton-Spall Bruntonspall Ltd

Does agile make us less secure?

Security in a post devops world

YOW! Sydney 2019

slide-2
SLIDE 2

Michael Brunton-Spall Bruntonspall Ltd

Michael Brunton-Spall He/His/Him michael@bruntonspall.com

slide-3
SLIDE 3

Michael Brunton-Spall Bruntonspall Ltd

The second most scariest words in the English language

slide-4
SLIDE 4

Michael Brunton-Spall Bruntonspall Ltd

The second most scariest words in the English language “Hi, I’m from the Government and I’m here to help”

slide-5
SLIDE 5

Michael Brunton-Spall Bruntonspall Ltd

The scariest words in the English language?

slide-6
SLIDE 6

Michael Brunton-Spall Bruntonspall Ltd

The scariest words in the English language? “Hi, I’m from security and I’m here to help”

slide-7
SLIDE 7

Michael Brunton-Spall Bruntonspall Ltd

slide-8
SLIDE 8

Michael Brunton-Spall Bruntonspall Ltd

https://cyberweekly.net

slide-9
SLIDE 9

Michael Brunton-Spall Bruntonspall Ltd

Why is security evolving Where we’ve come from Where we are going

slide-10
SLIDE 10

Michael Brunton-Spall Bruntonspall Ltd

How to rethink security practices in organisations

slide-11
SLIDE 11

Michael Brunton-Spall Bruntonspall Ltd

Some Context

slide-12
SLIDE 12

06/12/2019 12

Michael Brunton-Spall Bruntonspall Ltd

2006

slide-13
SLIDE 13

06/12/2019 13

Michael Brunton-Spall Bruntonspall Ltd

2010

slide-14
SLIDE 14

06/12/2019 14

Michael Brunton-Spall Bruntonspall Ltd

2013

slide-15
SLIDE 15

06/12/2019 15

Michael Brunton-Spall Bruntonspall Ltd

2015

slide-16
SLIDE 16

06/12/2019 16

Michael Brunton-Spall Bruntonspall Ltd

2019

slide-17
SLIDE 17

Michael Brunton-Spall Bruntonspall Ltd

slide-18
SLIDE 18

Michael Brunton-Spall Bruntonspall Ltd

slide-19
SLIDE 19

Michael Brunton-Spall Bruntonspall Ltd

slide-20
SLIDE 20

Michael Brunton-Spall Bruntonspall Ltd

slide-21
SLIDE 21

06/12/2019 21

Michael Brunton-Spall Bruntonspall Ltd

slide-22
SLIDE 22

06/12/2019 22

Michael Brunton-Spall Bruntonspall Ltd

slide-23
SLIDE 23

06/12/2019 23

Michael Brunton-Spall Bruntonspall Ltd

slide-24
SLIDE 24

06/12/2019 24

Michael Brunton-Spall Bruntonspall Ltd

slide-25
SLIDE 25

Michael Brunton-Spall Bruntonspall Ltd

slide-26
SLIDE 26

Maginot Line

slide-27
SLIDE 27

Michael Brunton-Spall Bruntonspall Ltd

1930 France

slide-28
SLIDE 28

Michael Brunton-Spall Bruntonspall Ltd

“We’d really like Germany not to invade us”

slide-29
SLIDE 29

Michael Brunton-Spall Bruntonspall Ltd

In WW1, they came slowly

  • verland and built trenches
slide-30
SLIDE 30

Michael Brunton-Spall Bruntonspall Ltd

slide-31
SLIDE 31

Michael Brunton-Spall Bruntonspall Ltd

slide-32
SLIDE 32

Michael Brunton-Spall Bruntonspall Ltd

slide-33
SLIDE 33

Michael Brunton-Spall Bruntonspall Ltd

The Germans had invented Blitzkrieg “Lightning Strike” which simply went around

slide-34
SLIDE 34

Michael Brunton-Spall Bruntonspall Ltd

slide-35
SLIDE 35

Michael Brunton-Spall Bruntonspall Ltd

The French were fighting a war from 1920 against an adversary using 1939 techniques

slide-36
SLIDE 36

Evolution

slide-37
SLIDE 37

Michael Brunton-Spall Bruntonspall Ltd

slide-38
SLIDE 38

Michael Brunton-Spall Bruntonspall Ltd

Custom built minicomputer

slide-39
SLIDE 39

Michael Brunton-Spall Bruntonspall Ltd

Servers in data center

slide-40
SLIDE 40

Michael Brunton-Spall Bruntonspall Ltd

Colocated servers

slide-41
SLIDE 41

Michael Brunton-Spall Bruntonspall Ltd

Virtual private servers

slide-42
SLIDE 42

Michael Brunton-Spall Bruntonspall Ltd

Virtual machines at scale

slide-43
SLIDE 43

Michael Brunton-Spall Bruntonspall Ltd

slide-44
SLIDE 44

Michael Brunton-Spall Bruntonspall Ltd

slide-45
SLIDE 45

Michael Brunton-Spall Bruntonspall Ltd

Why Wardley Maps?

slide-46
SLIDE 46

Michael Brunton-Spall Bruntonspall Ltd

We can see changing landscapes

slide-47
SLIDE 47

Michael Brunton-Spall Bruntonspall Ltd

We can discuss strategies

slide-48
SLIDE 48

Michael Brunton-Spall Bruntonspall Ltd

A map isn’t reality, it’s just an abstraction

slide-49
SLIDE 49

Michael Brunton-Spall Bruntonspall Ltd

Things evolve

slide-50
SLIDE 50

Michael Brunton-Spall Bruntonspall Ltd

As servers move from physical to virtual, single to multiple, practice evolves

slide-51
SLIDE 51

Coevolution of product and practice

slide-52
SLIDE 52

Michael Brunton-Spall Bruntonspall Ltd

slide-53
SLIDE 53

Michael Brunton-Spall Bruntonspall Ltd

slide-54
SLIDE 54

Michael Brunton-Spall Bruntonspall Ltd

slide-55
SLIDE 55

Michael Brunton-Spall Bruntonspall Ltd

How do we administer servers?

slide-56
SLIDE 56

Michael Brunton-Spall Bruntonspall Ltd

Worries about hard drives, CPU’s, power etc

slide-57
SLIDE 57

Michael Brunton-Spall Bruntonspall Ltd

Cloud providers give us abstractions

slide-58
SLIDE 58

Michael Brunton-Spall Bruntonspall Ltd

slide-59
SLIDE 59

Michael Brunton-Spall Bruntonspall Ltd

We stop worrying about whether a hard drive fails in a server

slide-60
SLIDE 60

Michael Brunton-Spall Bruntonspall Ltd

This results in changing

  • perations practice
slide-61
SLIDE 61

Michael Brunton-Spall Bruntonspall Ltd

DevOps, SRE

slide-62
SLIDE 62

Michael Brunton-Spall Bruntonspall Ltd

This results in different developer consumption of

  • perations
slide-63
SLIDE 63

Michael Brunton-Spall Bruntonspall Ltd

Kubernetes, Serverless

slide-64
SLIDE 64

Michael Brunton-Spall Bruntonspall Ltd

slide-65
SLIDE 65

Michael Brunton-Spall Bruntonspall Ltd

What does this mean for security?

slide-66
SLIDE 66

Michael Brunton-Spall Bruntonspall Ltd

How we think about security has to change

slide-67
SLIDE 67

Michael Brunton-Spall Bruntonspall Ltd

Security practices have to evolve

slide-68
SLIDE 68

Michael Brunton-Spall Bruntonspall Ltd

slide-69
SLIDE 69

Michael Brunton-Spall Bruntonspall Ltd

Traditional security is about assurance

slide-70
SLIDE 70

Michael Brunton-Spall Bruntonspall Ltd

Where will my data sit

slide-71
SLIDE 71

Michael Brunton-Spall Bruntonspall Ltd

Where does the data go

slide-72
SLIDE 72

Michael Brunton-Spall Bruntonspall Ltd

slide-73
SLIDE 73

Michael Brunton-Spall Bruntonspall Ltd

This works when you have individual servers

slide-74
SLIDE 74

Michael Brunton-Spall Bruntonspall Ltd

This doesn’t work with modern cloud

slide-75
SLIDE 75

Michael Brunton-Spall Bruntonspall Ltd

This doesn’t work th

the e same same

with modern cloud

slide-76
SLIDE 76

Michael Brunton-Spall Bruntonspall Ltd

Security is currently fighting a war from a decade ago

slide-77
SLIDE 77

Mapping Security

slide-78
SLIDE 78

Michael Brunton-Spall Bruntonspall Ltd

slide-79
SLIDE 79

Michael Brunton-Spall Bruntonspall Ltd

“Skate to where the puck is going, not where it has been” Wayne Gretsky

slide-80
SLIDE 80

Michael Brunton-Spall Bruntonspall Ltd

Where the puck was yesterday

slide-81
SLIDE 81

Michael Brunton-Spall Bruntonspall Ltd

What are solved problems?

slide-82
SLIDE 82

Michael Brunton-Spall Bruntonspall Ltd

Commonly solved the same way

slide-83
SLIDE 83

Michael Brunton-Spall Bruntonspall Ltd

Productionised processes

slide-84
SLIDE 84

Michael Brunton-Spall Bruntonspall Ltd

slide-85
SLIDE 85

Michael Brunton-Spall Bruntonspall Ltd

SDLC, Assurance of suppliers, network assurance, hardware assurance

slide-86
SLIDE 86

Michael Brunton-Spall Bruntonspall Ltd

All cloud customers have similar concerns in this area

slide-87
SLIDE 87

Michael Brunton-Spall Bruntonspall Ltd

Buy don’t Build

slide-88
SLIDE 88

Michael Brunton-Spall Bruntonspall Ltd

Compliance via certificates ISO27001, CSA, ISO27017, SOC, FISMA, HIPAA …

slide-89
SLIDE 89

Michael Brunton-Spall Bruntonspall Ltd

Where the puck is today

slide-90
SLIDE 90

Michael Brunton-Spall Bruntonspall Ltd

slide-91
SLIDE 91

Michael Brunton-Spall Bruntonspall Ltd

Continuous Integration, Continuous Deployment, DevOps

slide-92
SLIDE 92

Michael Brunton-Spall Bruntonspall Ltd

Patching

slide-93
SLIDE 93

Michael Brunton-Spall Bruntonspall Ltd

How quickly can you patch?

slide-94
SLIDE 94

Michael Brunton-Spall Bruntonspall Ltd

DevOps

slide-95
SLIDE 95

Michael Brunton-Spall Bruntonspall Ltd

How secure is your code?

slide-96
SLIDE 96

Michael Brunton-Spall Bruntonspall Ltd

Code review and Pull requests

slide-97
SLIDE 97

Michael Brunton-Spall Bruntonspall Ltd

Staff identity and single sign

  • n
slide-98
SLIDE 98

Michael Brunton-Spall Bruntonspall Ltd

Zero Trust Networking

slide-99
SLIDE 99

Michael Brunton-Spall Bruntonspall Ltd

slide-100
SLIDE 100

Michael Brunton-Spall Bruntonspall Ltd

But where is the puck going?

slide-101
SLIDE 101

Michael Brunton-Spall Bruntonspall Ltd

slide-102
SLIDE 102

Michael Brunton-Spall Bruntonspall Ltd

The unit of delivery is the team

slide-103
SLIDE 103

Michael Brunton-Spall Bruntonspall Ltd

The unit of decision making is the team

slide-104
SLIDE 104

Michael Brunton-Spall Bruntonspall Ltd

“Appoint a suitably senior and empowered decision maker”

slide-105
SLIDE 105

Michael Brunton-Spall Bruntonspall Ltd

Attack Trees

slide-106
SLIDE 106

Michael Brunton-Spall Bruntonspall Ltd

Workshop with whole team

slide-107
SLIDE 107

Michael Brunton-Spall Bruntonspall Ltd

Workshop with whole team*

slide-108
SLIDE 108

06/12/2019 108

Michael Brunton-Spall Bruntonspall Ltd

slide-109
SLIDE 109

Michael Brunton-Spall Bruntonspall Ltd

slide-110
SLIDE 110

Michael Brunton-Spall Bruntonspall Ltd

slide-111
SLIDE 111

Michael Brunton-Spall Bruntonspall Ltd

slide-112
SLIDE 112

Michael Brunton-Spall Bruntonspall Ltd

Adversary thinking

slide-113
SLIDE 113

Michael Brunton-Spall Bruntonspall Ltd

ATT&CK Framework

slide-114
SLIDE 114

Michael Brunton-Spall Bruntonspall Ltd

Goals, Restrictions

slide-115
SLIDE 115

Michael Brunton-Spall Bruntonspall Ltd

No adversary has unlimited funds, time and energy

slide-116
SLIDE 116

06/12/2019 116

Michael Brunton-Spall Bruntonspall Ltd

slide-117
SLIDE 117

Michael Brunton-Spall Bruntonspall Ltd

Anti Personas

slide-118
SLIDE 118

Michael Brunton-Spall Bruntonspall Ltd

Han Solo

Motivation

Han Solo is motivated primarily by money, but also works with the rebel alliance. Han is capable of using common tools as well as modifying existing tools on the fly Han doesn’t want to be caught and so takes an effort to avoid head on confrontations

Capabilities

Resources: 2/5 Capability: 4/5 Bravery: 2/5 Criminal connections: 3/5

Connections

Rebel Alliance, Hutts

slide-119
SLIDE 119

Michael Brunton-Spall Bruntonspall Ltd

Red Teams

slide-120
SLIDE 120

Michael Brunton-Spall Bruntonspall Ltd

Internal pentesting

slide-121
SLIDE 121

Michael Brunton-Spall Bruntonspall Ltd

Threat Hunting

slide-122
SLIDE 122

Michael Brunton-Spall Bruntonspall Ltd

DevSecOps

slide-123
SLIDE 123

Michael Brunton-Spall Bruntonspall Ltd

Security as code

slide-124
SLIDE 124

Michael Brunton-Spall Bruntonspall Ltd

Misuse cases

slide-125
SLIDE 125

Michael Brunton-Spall Bruntonspall Ltd

slide-126
SLIDE 126

06/12/2019 126

Michael Brunton-Spall Bruntonspall Ltd

http://davidecioccia.com/?p=367

slide-127
SLIDE 127

Michael Brunton-Spall Bruntonspall Ltd

Compliance as Code

slide-128
SLIDE 128

Michael Brunton-Spall Bruntonspall Ltd

slide-129
SLIDE 129

Michael Brunton-Spall Bruntonspall Ltd

Cloud configuration as code

slide-130
SLIDE 130

Michael Brunton-Spall Bruntonspall Ltd

Pull requests = audit trail

slide-131
SLIDE 131

Michael Brunton-Spall Bruntonspall Ltd

slide-132
SLIDE 132

Michael Brunton-Spall Bruntonspall Ltd

slide-133
SLIDE 133

Michael Brunton-Spall Bruntonspall Ltd

AWS System Manager

slide-134
SLIDE 134

Michael Brunton-Spall Bruntonspall Ltd

Azure Policy

slide-135
SLIDE 135

Michael Brunton-Spall Bruntonspall Ltd

Final thoughts?

slide-136
SLIDE 136

Michael Brunton-Spall Bruntonspall Ltd

How to get value from your existing security teams?

slide-137
SLIDE 137

Michael Brunton-Spall Bruntonspall Ltd

Empathy first

slide-138
SLIDE 138

Michael Brunton-Spall Bruntonspall Ltd

“Re

Regardless of what we discover, we unde understand and t and and truly be uly belie lieve t tha hat ev everyone did the best job they ey could, giv given w en wha hat t the hey kne y knew a at t the t he time, ime, t their heir sk skills s and abiliti ties, s, th the resou sources s av available, and the situation at hand.”

slide-139
SLIDE 139

Michael Brunton-Spall Bruntonspall Ltd

Michael Brunton-Spall michael@bruntonspall.com @Bruntonspall https://cyberweekly.net