When Software Security Meet Agile (Ant) yftzeng@gmail.com - - PowerPoint PPT Presentation

▶
when software security meet agile ant yftzeng gmail com
SMART_READER_LITE
LIVE PREVIEW

When Software Security Meet Agile (Ant) yftzeng@gmail.com - - PowerPoint PPT Presentation

Feb 22, 2024 168 likes •966 views

When Software Security Meet Agile (Ant) yftzeng@gmail.com 2019-03-21 Introduction & Research interest 13 4

slide-1
SLIDE 1

當軟體安全遇上敏捷

When Software Security Meet Agile 曾義峰 (Ant)

yftzeng@gmail.com 2019-03-21

slide-2
SLIDE 2

2/78

Introduction & Research interest

13 年互聯網研發經驗， 4 年顧問資歷。 時而編程，時而沉浸於法律領域、倘洋於資訊安全世界中。 Web Security ( 網頁安全 ) Data(base) Security ( 資料安全 ) Agile Way ( 敏捷方法 ) Compliance ( 法遵 / 合規 )

slide-3
SLIDE 3

3/78

SDLC & Agile 1 Product Owner & Stakeholders 2 DevOps & Security 3 CI/CD & Pipeline 4

Agenda

引言 角色 文化 實踐

slide-4
SLIDE 4

4/78

SDLC & Agile 1 Product Owner & Stakeholders 2 DevOps & Security 3 CI/CD & Pipeline 4

Agenda

引言

slide-5
SLIDE 5

5/78 Requirements Design Code Test Deploy

Software Development Life Cycle (SDLC)

slide-6
SLIDE 6

6/78 Requirements Design Code Test Deploy

Secure Software Development Life Cycle (SSDLC)

Risk Assessment Design Review & Threat Modeling Static Analysis Code Review & Penetration Testing Secure Configuration & Security Assessment

slide-7
SLIDE 7

7/78 Requirements Design Code Test Deploy

Secure Software Development Life Cycle (SSDLC)

Risk Assessment Design Review & Threat Modeling Static Analysis Code Review & Penetration Testing Secure Configuration & Security Assessment

Wa t e r f a l l

E V E R Y T H I N G WO R K WE L L

slide-8
SLIDE 8

8/78

Agile

Credit: https://medium.com/innodev/agile-development-for-dummies-dd161da253c7

slide-9
SLIDE 9

9/78

Agile

Credit: https://www.kisspng.com/png-scrum-sprint-agile-software-development-systems-de-4949713/

Scrum

slide-10
SLIDE 10

10/78

Agile

Credit: https://sanzubusinesstraining.com/how-to-create-a-kanban-board-to-manage-your-to-do-list/

Kanban

slide-11
SLIDE 11

11/78

Agile

Credit: https://dilbert.com/strip/2007-11-26

我們將嘗試一種稱為敏捷開發的模式。 意味著不需計畫，不需文檔。只要寫程式和發牢騷就好。

slide-12
SLIDE 12

12/78

Agile

Prejudices

推動 Agile 後造成一團混亂 (Chaos) 。 Agile 過於複雜。 Agile 只是把待辦清單 (Todo) 用便利貼或數位的方式貼在牆上。 Agile 會產出不安全的軟體。 Agile 太浪費時間，例如每日站立會議、回顧 (retrospective) 。

slide-13
SLIDE 13

13/78

Agile

Prejudices

推動 Agile 後造成一團混亂 (Chaos) 。 Agile 過於複雜。 Agile 只是把待辦清單 (Todo) 用便利貼或數位的方式貼在牆上。 Agile 會產出不安全的軟體。 Agile 太浪費時間，例如每日站立會議、回顧 (retrospective) 。

slide-14
SLIDE 14

14/78

Agile

Credit: http://www.commitstrip.com/en/2017/06/19/security-too-expensive-try-a-hack/

slide-15
SLIDE 15

15/78

Agile

slide-16
SLIDE 16

16/78

Agile

A g i l e ≠ F a s t

slide-17
SLIDE 17

17/78

Agile

很多公司都有推動各種敏捷專案管理流程。 例如 Scrum 或 Kanban 。 但其中有具備資安 (Security) 思維的只有一小部分。 更不用論更大範圍的法遵 / 合規 (Compliance) ，例如 GDPR 等。

slide-18
SLIDE 18

18/78

誰說 Agile Coach 不需要懂資安 !?

Agile Injection

頻繁安插的無理需求、急件

slide-19
SLIDE 19

19/78

誰說 Agile Coach 不需要懂資安 !?

Agile XSS Injection

頻繁安插的無理需求、急件 從其他團隊來的跨組扔包

slide-20
SLIDE 20

20/78

誰說 Agile Coach 不需要懂資安 !?

Agile XSS StackOverflow Injection

頻繁安插的無理需求、急件 從其他團隊來的跨組扔包 我是 Full-Stack Developer 指的是如果再給我一個工作 我的工作 (Stack) 就會溢出

slide-21
SLIDE 21

21/78

誰說 Agile Coach 不需要懂資安 !?

Agile God Injection XSS StackOverflow Injection

頻繁安插的無理需求、急件 從其他團隊來的跨組扔包 我是 Full-Stack Developer 指的是如果再給我一個工作 我的工作 (Stack) 就會溢出 老闆一聲令下 搖身變為隕石開發法

slide-22
SLIDE 22

22/78

隕石開發法

Credit: http://eiki.hatenablog.jp/entry/meteo_fall

Waterfall

slide-23
SLIDE 23

23/78

隕石開發法

Credit: http://eiki.hatenablog.jp/entry/meteo_fall

Agile

slide-24
SLIDE 24

24/78

隕石開發法

Credit: http://eiki.hatenablog.jp/entry/meteo_fall

Agile

無論什麼方法，在神面前，

都無用

slide-25
SLIDE 25

25/78

DevOps & Security 3 CI/CD & Pipeline 4

Agenda

Product Owner & Stakeholders 2 SDLC & Agile 1

角色

slide-26
SLIDE 26

26/78

Scrum & Product Owner

“The Product Owner is the sole person responsible for managing the Product Backlog.” (Scrum guide) “ 產品負責人是負責管理產品待辦清單的唯一人員。” “The PO role is responsible for working with the customers and stakeholders to understand their needs.” “ 產品負責人負責與客戶和利益相關者合作以了解他們的需求。”

Credit: https://www.scrum.org/forum/scrum-forum/7820/product-owner-role-delegated-team

slide-27
SLIDE 27

27/78

Scrum & Product Owner

“The Product Owner is the sole person responsible for managing the Product Backlog.” (Scrum guide) “ 產品負責人是負責管理產品待辦清單的唯一人員。” “The PO role is responsible for working with the customers and stakeholders to understand their needs.” “ 產品負責人負責與客戶和利益相關者合作以了解他們的需求。”

Credit: https://www.scrum.org/forum/scrum-forum/7820/product-owner-role-delegated-team

Who are your stakeholders ？ 誰是你們的利益相關者

slide-28
SLIDE 28

28/78

Scrum & Product Owner

“The Product Owner is the sole person responsible for managing the Product Backlog.” (Scrum guide) “ 產品負責人是負責管理產品待辦清單的唯一人員。” “The PO role is responsible for working with the customers and stakeholders to understand their needs.” “ 產品負責人負責與客戶和利益相關者合作以了解他們的需求。”

Credit: https://www.scrum.org/forum/scrum-forum/7820/product-owner-role-delegated-team

Security officer should start taking up the role of security stakeholders 資安官應該開始擔任利益相關者的角色

slide-29
SLIDE 29

29/78

Product Backlog

Product Backlog Item (PBI) ：

  • Features
  • Bugs
  • Refactoring
  • Spike
  • …
  • Security Features
  • Security Stories
  • Attacker Stories
  • Ab-Use User Stories
slide-30
SLIDE 30

30/78

Product Backlog

Scenario: User are able to register Given the user is on “/users/register” When the user types the email “yftzeng@gmail.com” When the user types the password “xxx” When the user clicks the register button Then the response should contains “Password must be at least 8 characters long” ...

BDD

slide-31
SLIDE 31

31/78

Product Backlog

Scenario: The application should not contain SQL injection vulnerabilities And the SQL-Injection policy is enabled And the attack strength is set to High And the alert threshold is set to Low When the scanner is run And the following false positives are removed | url | parameter | cweId | wascId | And the XML report is written to the file output/security/sql_injection.xml Then no Medium or Higher risk vulnerabilities should be present

Credit: https://continuumsecurity.net/bdd-security/

BDD

slide-32
SLIDE 32

32/78

Product Backlog

Scenario: Present the login form itself over an HTTPS connection Given a new browser instance And the client/browser is configured to use an intercepting proxy And the proxy logs are cleared And the login page is displayed And the HTTP request-response containing the login form Then the protocol should be HTTPS And ...

Credit: https://continuumsecurity.net/bdd-security/

BDD

slide-33
SLIDE 33

33/78

Tools

  • SpecFlow (.NET)
  • Cucumber (Ruby)
  • JBehave (Java)
  • Behat (PHP)
  • Jest (JavaScript)
  • Godog (Go)
  • …

BDD

slide-34
SLIDE 34

34/78

CI/CD & Pipeline 4

Agenda

SDLC & Agile 1 DevOps & Security 3 Product Owner & Stakeholders 2

文化

slide-35
SLIDE 35

35/78

DevOps & Security

《 Dev Ops ⋅ 》 同 Agile / Lean ，具備自身核心，更快的執行速度和更快的學習速度。 這就是為什麼它經常被描述為一種文化。

從 DevOps 視角，探討 Security

slide-36
SLIDE 36

36/78

DevOps & Security

《 Dev Ops ⋅ 》 同 Agile / Lean ，具備自身核心，更快的執行速度和更快的學習速度。 這就是為什麼它經常被描述為一種文化。

slide-37
SLIDE 37

37/78

DevOps & Security

slide-38
SLIDE 38

38/78

DevOps & Security

SecDevOps—sometimes called “Rugged DevOps” or “security at speed”—as a set of best practices designed to help

  • rganizations implant secure coding deep in the heart of

their DevOps development and deployment processes. The goal is to automate secure coding and security tests and fixes within the workflow, making secure software an inherent

  • utcome of DevOps approaches.

Credit: https://blog.newrelic.com/2015/08/27/secdevops-rugged-devops/

slide-39
SLIDE 39

39/78

DevOps & Security

SecDevOps—sometimes called “Rugged DevOps” or “security at speed”—as a set of best practices designed to help

  • rganizations implant secure coding deep in the heart of

their DevOps development and deployment processes. The goal is to automate secure coding and security tests and fixes within the workflow, making secure software an inherent

  • utcome of DevOps approaches.

“SecDevOps seeks to embed security inside the development process as deeply as DevOps has done with operations” (SecDevOps 旨在將開發過程中的資訊安全深入到 DevOps 的操作中 )

Credit: https://blog.newrelic.com/2015/08/27/secdevops-rugged-devops/

slide-40
SLIDE 40

40/78

DevOps & Security

The hinge to success for DevOps security lies in changing the underlying DevOps culture to embrace security—with no

  • exceptions. As with any other methodology, security must be

built into DevOps.

Credit: https://techbeacon.com/devsecops-foundations

slide-41
SLIDE 41

41/78

DevOps & Security

The hinge to success for DevOps security lies in changing the underlying DevOps culture to embrace security—with no

  • exceptions. As with any other methodology, security must be

built into DevOps.

Credit: https://techbeacon.com/devsecops-foundations

DevOps 資訊安全成功的關鍵仰賴改變潛在的 DevOps 文化以擁抱安全性

  • 沒有例外 -
slide-42
SLIDE 42

42/78

DevOps & Security

slide-43
SLIDE 43

43/78

DevOps & Security

slide-44
SLIDE 44

44/78

DevOps & Security

slide-45
SLIDE 45

45/78

Credit: https://www.owasp.org/index.php/OWASP_AppSec_Pipeline#tab=Pipeline_Design_Patterns

slide-46
SLIDE 46

46/78

Credit: https://www.linkedin.com/in/LarryMaccherone/

slide-47
SLIDE 47

47/78

Agenda

SDLC & Agile 1 Product Owner & Stakeholders 2 CI/CD & Pipeline 4 DevOps & Security 3

實踐

slide-48
SLIDE 48

48/78

CI/CD & Pipeline

《 Dev Ops ⋅ & CI ⋅ CD 》 DevOps 非商業口號，是以工具為中心的哲學，支持持續交付價值鏈。 持續交付採用自動部署流水線，以便可靠、快速地將軟體發佈的方法。 持續交付和 DevOps 擁有敏捷和精益的共同背景：小而快速的變化。 DevOps 關乎文化、開發和運營之間、明確的流程。關乎敏捷。 你可以在不實施持續交付的情況下接受並實踐 DevOps 理念。

從 CI/CD & Pipeline 視角，探討 Security

slide-49
SLIDE 49

49/78

CI/CD & Pipeline

《 Dev Ops ⋅ & CI ⋅ CD 》 DevOps 非商業口號，是以工具為中心的哲學，支持持續交付價值鏈。 持續交付採用自動部署流水線，以便可靠、快速地將軟體發佈的方法。 持續交付和 DevOps 擁有敏捷和精益的共同背景：小而快速的變化。 DevOps 關乎文化、開發和運營之間、明確的流程。關乎敏捷。 你可以在不實施持續交付的情況下接受並實踐 DevOps 理念。

slide-50
SLIDE 50

50/78

Credit: https://www.linkedin.com/in/LarryMaccherone/

slide-51
SLIDE 51

51/78

Credit: https://www.linkedin.com/in/LarryMaccherone/

實踐上的困難點？

slide-52
SLIDE 52

52/78

CI/CD & Pipeline

《 Pen testing 》 滲透測試 (Penetration testing) 有時長達兩個月。 每一次的提交與改變，是否會影響之前滲透測試的結果？ 《 Compliance validation 》 如果發布需要通過外部審核機構 ( 法務 / 會計 / 稽核 ) ， 如何能實現快速循環實驗？

slide-53
SLIDE 53

53/78

Credit: https://hackernoon.com/introducing-the-infosec-colour-wheel-blending-developers-with-red-and-blue-security-teams-6437c1a07700

slide-54
SLIDE 54

54/78

Credit: https://hackernoon.com/introducing-the-infosec-colour-wheel-blending-developers-with-red-and-blue-security-teams-6437c1a07700

slide-55
SLIDE 55

55/78

CI/CD & Pipeline

Credit: https://www.linkedin.com/pulse/transformation-pmo-jack-caine/

以 SAFe 的 Continuous Delivery( 持續交付 ) 模型為例

The Scaled Agile Framework (abbreviated as SAFe)

slide-56
SLIDE 56

56/78

CI/CD & Pipeline

Credit: https://www.scaledagileframework.com/release-on-demand/

Develop on Cadence. Release on Demand.

  • A SAFe mantra
slide-57
SLIDE 57

57/78

CI/CD & Pipeline

Credit: https://www.scaledagileframework.com/release-on-demand/

Develop on Cadence. Release on Demand.

  • A SAFe mantra

按節奏開發，按所需發布

  • SAFe 的口號 -
slide-58
SLIDE 58

58/78

CI/CD & Pipeline

Credit: https://twitter.com/deanleffingwell/status/612425925515317248

slide-59
SLIDE 59

59/78

CI/CD & Pipeline

Credit: https://www.scaledagileframework.com/release-on-demand/

Develop on Cadence. Release on Demand.

  • A SAFe mantra

Develop on Cadence ( 技術流程 ) Release on Demand ( 商業決策 )

slide-60
SLIDE 60

60/78

CI/CD & Pipeline

Credit: https://www.scaledagileframework.com/release-on-demand/

Develop on Cadence. Release on Demand.

  • A SAFe mantra

Develop on Cadence ( 技術流程 ) Release on Demand ( 商業決策 ) 解耦

(decoupling)

slide-61
SLIDE 61

61/78

CI/CD & Pipeline

Credit: https://martinfowler.com/books/continuousDelivery.html

Continuous delivery is about putting the release schedule in the hands of the business, not in the hands of IT.

slide-62
SLIDE 62

62/78

CI/CD & Pipeline

Credit: https://martinfowler.com/books/continuousDelivery.html

Continuous delivery is about putting the release schedule in the hands of the business, not in the hands of IT.

持續交付是指將發布時程放在業務手中，而不是掌握在 IT 手中

slide-63
SLIDE 63

63/78

CI/CD & Pipeline

Credit: https://martinfowler.com/bliki/ContinuousDelivery.html

Continuous Delivery is sometimes confused with Continuous Deployment. Continuous Deployment means that every change goes through the pipeline and automatically gets put into production, resulting in many production deployments every day. Continuous Delivery just means that you are able to do frequent deployments but may choose not to do it, usually due to businesses preferring a slower rate of deployment. In

  • rder to do Continuous Deployment you must be doing

Continuous Delivery.

Martin Fowler

slide-64
SLIDE 64

64/78

CI/CD & Pipeline

Credit: https://martinfowler.com/bliki/ContinuousDelivery.html

Continuous Delivery is sometimes confused with Continuous Deployment. Continuous Deployment means that every change goes through the pipeline and automatically gets put into production, resulting in many production deployments every day. Continuous Delivery just means that you are able to do frequent deployments but may choose not to do it, usually due to businesses preferring a slower rate of deployment. In

  • rder to do Continuous Deployment you must be doing

Continuous Delivery.

Martin Fowler

持續交付只是意味著你可以進行頻繁部署 , 但可以選擇不這樣做， 通常是因為企業更喜歡較慢的部署速度

slide-65
SLIDE 65

65/78

CI/CD & Pipeline

Credit: https://www.scaledagileframework.com/release-on-demand/

Develop on Cadence. Release on Demand.

  • A SAFe mantra

Develop on Cadence ( 技術流程 ) Release on Demand ( 商業決策 ) 解耦

(decoupling)

slide-66
SLIDE 66

66/78

CI/CD & Pipeline

Credit: https://www.linkedin.com/pulse/transformation-pmo-jack-caine/

以 SAFe 的 Continuous Delivery( 持續交付 ) 模型為例

The Scaled Agile Framework (abbreviated as SAFe)

slide-67
SLIDE 67

67/78

CI/CD & Pipeline

Credit: https://www.linkedin.com/pulse/transformation-pmo-jack-caine/

以 SAFe 的 Continuous Delivery( 持續交付 ) 模型為例

The Scaled Agile Framework (abbreviated as SAFe)

解耦

(decoupling)

slide-68
SLIDE 68

68/78

CI/CD & Pipeline

Credit: https://www.linkedin.com/pulse/transformation-pmo-jack-caine/

以 SAFe 的 Continuous Delivery( 持續交付 ) 模型為例

The Scaled Agile Framework (abbreviated as SAFe) 商業決策 技術流程 商業決策

slide-69
SLIDE 69

69/78

CI/CD & Pipeline

Credit: https://www.linkedin.com/pulse/transformation-pmo-jack-caine/

商業決策 技術流程 商業決策

C

  • mp

l i a n c e S e c u r i t y 滲透測試 (Penetration testing) / 紅隊演練 (Red Team Assessment) 。 外部審核機構 ( 法務 / 會計 / 稽核 ) 。

slide-70
SLIDE 70

70/78

S e c u r i t y Ma r k e t i n g C

  • mp

l i a n c e needs pen testing red team regulations controls standards unit / integration / performance test unit / integration / performance test scheduling unit / integration / performance test scheduling schedule pipeline D e v e l

  • p
slide-71
SLIDE 71

71/78

S e c u r i t y Ma r k e t i n g C

  • mp

l i a n c e D e v e l

  • p

needs pen testing red team regulations controls standards unit / integration / performance test unit / integration / performance test scheduling unit / integration / performance test scheduling schedule pipeline

slide-72
SLIDE 72

72/78

Credit: https://www.linkedin.com/pulse/agile-scrum-gdpr-ruud-van-driel-cissp/

slide-73
SLIDE 73

73/78

Credit: https://www.linkedin.com/pulse/agile-scrum-gdpr-ruud-van-driel-cissp/

slide-74
SLIDE 74

74/78

Credit: https://www.linkedin.com/pulse/agile-scrum-gdpr-ruud-van-driel-cissp/

slide-75
SLIDE 75

75/78

Credit: https://www.linkedin.com/pulse/agile-scrum-gdpr-ruud-van-driel-cissp/

slide-76
SLIDE 76

76/78 Password Policy SQL Injection XSS Information Disclosure StackOverflow Insider Threat

slide-77
SLIDE 77

77/78

Agile ≠ Fast 產品負責人必須將資安官納入主要利益相關人 借鏡 DevOps/SAFe ，引入 DevSecOps 文化 利用軟體工程的手法 , 將複雜的流程解耦、分段 階段性實施 DevSecOps ( 小跑步法 ) 確認團隊所有成員認同資安對於客戶的價值 持續投入資安訓練及演練

slide-78
SLIDE 78

78/78

yftzeng@gmail.com https://www.facebook.com/yftzeng.tw https://twitter.com/yftzeng

曾義峰 (Ant)