DevOpsSec

DevOpsSec

by Jim Bird
Released June 2016
Publisher(s): O'Reilly Media, Inc.
ISBN: 9781491958995

Read it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to live online training experiences, plus books, videos, and digital content from O’Reilly and nearly 200 trusted publishing partners.

Start your free trial

Book description

How do you build security and compliance into your DevOps platforms and pipelines? With this O’Reilly report, security analysts, security engineers, and pen testers will learn how to leverage the same processes and tools—such as version control, containers, and Continuous Delivery—that DevOps practitioners use to automate software delivery and infrastructure changes. In other words, you’ll understand how to use DevOps to secure DevOps.

Author Jim Bird uses case studies from Etsy, Netflix, and the London Multi-Asset Exchange (LMAX) to illustrate the steps leading organizations have taken to secure their DevOps processes. If you understand application and infrastructure security, and have some familiarity with DevOps and Agile development practices and tools, this report is the ideal place to start.

This report shows you how to:

  • Examine the security and compliance challenges that DevOps poses in your organization
  • Leverage key DevOps practices and workflows to design, build, deploy, and run secure systems
  • Build security as code by mapping security checks and controls into DevOps workflows
  • Take advantage of software component analysis, vulnerability management, and automated software testing tools that dev and ops already use
  • Build compliance into DevOps, and wire compliance policies and checks and auditing into Continuous Delivery

Publisher resources

View/Submit Errata

Table of contents

  1. 1. DevOpsSec: Delivering Secure Software through Continuous Delivery
    1. Introduction
  2. 2. Security and Compliance Challenges and Constraints in DevOps
    1. Speed: The Velocity of Delivery
    2. Where’s the Design?
    3. Eliminating Waste and Delays
    4. It’s in the Cloud
    5. Microservices
    6. Containers
    7. Separation of Duties in DevOps
    8. Change Control
  3. 3. Keys to Injecting Security into DevOps
    1. Shift Security Left
    2. OWASP Proactive Controls
    3. Secure by Default
    4. Making Security Self-Service
    5. Using Infrastructure as Code
    6. Iterative, Incremental Change to Contain Risks
    7. Use the Speed of Continuous Delivery to Your Advantage
    8. The Honeymoon Effect
  4. 4. Security as Code: Security Tools and Practices in Continuous Delivery
    1. Continuous Delivery
    2. Continuous Delivery at London Multi-Asset Exchange
    3. Injecting Security into Continuous Delivery
      1. Precommit
      2. Commit Stage (Continuous Integration)
      3. Acceptance Stage
      4. Production Deployment and Post-Deployment
    4. Secure Design in DevOps
      1. Risk Assessments and Lightweight Threat Modeling
      2. Securing Your Software Supply Chain
    5. Writing Secure Code in Continuous Delivery
      1. Using Code Reviews for Security
      2. What About Pair Programming?
      3. SAST: in IDE, in Continuous Integration/Continuous Delivery
    6. Security Testing in Continuous Delivery
      1. Dynamic Scanning (DAST)
      2. Fuzzing and Continuous Delivery
      3. Security in Unit and Integration Testing
      4. Automated Attacks
      5. Pen Testing and Bug Bounties
      6. Vulnerability Management
    7. Securing the Infrastructure
      1. Automated Configuration Management
      2. Securing Your Continuous Delivery Pipeline
    8. Security in Production
      1. Runtime Checks and Monkeys
      2. Situational Awareness and Attack-Driven Defense
      3. Runtime Defense
      4. Learning from Failure: Game Days, Red Teaming, and Blameless Postmortems
      5. Security at Netflix
  5. 5. Compliance as Code
    1. Defining Policies Upfront
    2. Automated Gates and Checks
    3. Managing Changes in Continuous Delivery
    4. Separation of Duties in the DevOps Audit Toolkit
    5. Using the Audit Defense Toolkit
    6. Code Instead of Paperwork
  6. 6. Conclusion: Building a Secure DevOps Capability and Culture

Product information

  • Title: DevOpsSec
  • Author(s): Jim Bird
  • Release date: June 2016
  • Publisher(s): O'Reilly Media, Inc.
  • ISBN: 9781491958995