DevSecOps: Overcoming the Culture of No’s with Chaos

January 08, 2018 By Derek Weeks

3 minute read time

Traditional security has thrived in culture of “no.”

The Culture of “No”

We have all met that wall. And when those walls exist, people find ways around them. The workarounds make their lives easier. They implement what they think is best. Their efforts are not intentionally destructive, but can lead to unintentional vulnerabilities and, potentially, harm.

Screen Shot 2018-01-08 at 9.53.04 AM-1

 

At All Day DevOps, DJ Schleen (@dschleen) tackled security issues in his talk, Automating Security in DevOps - Security in the Pipeline. While he studied physical architecture and design, he now works in software security architecture and is a DevSecOps Evangelist for insurance giant Aetna.

The culture of “no” is exactly the kind of culture DevOps is designed to improve, and, as DJ asserts in his talk, “DevOps is an unprecedented opportunity for security.” DevOps provides a system to react quickly by supporting a continuous delivery culture and the addition of security controls into an automated environment.

Invest in People

DevOps is also about investing in people, improving the lines of communication between development, operations, and security, and automating where you can automate to give humans the ability to focus on what we do best. You maximize success with DevOps when you invest in people, which, in turns, also improves your processes and tools.

 

null

 

So, how do we change security from a culture of “no” to a culture of “yes” - or, perhaps more appropriately, “Yes, but this is what it looks like.”

To start, DJ first looks at the underlying system and asks, “Is Agile ‘agile’ enough” to force this change. When his answer is answer “no” he knows it’s time for DevOps.

Too often, Agile is just a collection of mini waterfalls. DJ states, “DevOps breaks the chain of waterfalls. With DevOps you can get fixes out quickly and easily. No one has to come in on Saturday.”

 

null

 

Building Security into the DevOps Pipeline

To fully recognize the benefits of DevOps for security, DJ notes you must build security into the pipeline, automate wherever possible, and have security professionals code too. DJ outlines some goals:

  • Be a culture of yes and working together
  • Deliver remediation guidance back to developers
  • Integrate security knowledge and secure coding practices into your DevOps teams
  • Have security teams “get hands dirty” by coding
  • Don’t just automate the scan button
  • Pass software through well-defined and automated gateways where guardrails are in place to assess code security without decreasing velocity
  • Utilize automation to stop or pause the delivery pipeline when critical vulnerabilities are detected or manual intervention is necessary
  • Utilize automation to provide actionable remediation guidance
  • Remember software after production deployments

 

Chaos in Your Comfort Zone

What are some practical techniques DJ recommends? First, introduce chaos.

Chaos is a matter of stretching your comfort zone. DJ recommends going beyond traditional monitoring. Consider:

  • Randomly take containers down
  • Explore holes in your development practices
  • Unleash random hell on your infrastructure and applications
  • Continuously review the stability and resiliency of your systems
  • Execute attacks in production

DJ digs into the details of each of these techniques, but, in the end, it all comes back to introducing chaos to improve your preparedness for attacks and your understanding of the entire system.

Of course, this approach has challenges. DJ mentions selecting the right tool sets, tailoring the people, processes, and tools to unique environments, teaching old dogs new tricks, having multiple “flavors” of DevOps, and making KPIs and indicators actionable.

Don’t Go the Road Alone

To dig into the details with DJ, watch his full talk for free here. Then if you have any questions, ping him on Twitter (@dschleen) where he is very active in the community. We all learn from one another, so don’t go the road alone.

In the meantime, his takeaways are:

  • Don’t fear deploying rapidly and often into production
  • Always gather information in the form of KPIs and make them ACTIONABLE
  • Support the organization with tools, techniques, and best practices
  • Automate EVERYTHING
  • Defects are defects - regardless if they are a code defect or a security vulnerability
  • Code your infrastructure - eliminate access to physical or cloud-based machines
  • Choose tools that interfere minimally with flow
  • Introduce chaos to become a moving target

 

If you missed any of the other 100 speakers at All Day DevOps, you can find their 30-minute presentations here.

 

 

 

 

 

 

 

Tags: Application Security, devsecops, cultural transformation

Written by Derek Weeks

Derek serves as vice president and DevOps advocate at Sonatype and is the co-founder of All Day DevOps -- an online community of 65,000 IT professionals.