does agile make us less secure
play

Does agile make us less secure? Security in a post devops world - PowerPoint PPT Presentation

Sep 20, 2023 •319 likes •1.71k views

Does agile make us less secure? Security in a post devops world YOW! Sydney 2019 Michael Brunton-Spall Bruntonspall Ltd Michael Brunton-Spall He/His/Him michael@bruntonspall.com Michael Brunton-Spall Bruntonspall Ltd The second most

  1. Does agile make us less secure? Security in a post devops world YOW! Sydney 2019 Michael Brunton-Spall Bruntonspall Ltd

  2. Michael Brunton-Spall He/His/Him michael@bruntonspall.com Michael Brunton-Spall Bruntonspall Ltd

  3. The second most scariest words in the English language Michael Brunton-Spall Bruntonspall Ltd

  4. The second most scariest words in the English language “Hi, I’m from the Government and I’m here to help” Michael Brunton-Spall Bruntonspall Ltd

  5. The scariest words in the English language? Michael Brunton-Spall Bruntonspall Ltd

  6. The scariest words in the English language? “Hi, I’m from security and I’m here to help” Michael Brunton-Spall Bruntonspall Ltd

  7. Michael Brunton-Spall Bruntonspall Ltd

  8. https://cyberweekly.net Michael Brunton-Spall Bruntonspall Ltd

  9. Why is security evolving Where we’ve come from Where we are going Michael Brunton-Spall Bruntonspall Ltd

  10. How to rethink security practices in organisations Michael Brunton-Spall Bruntonspall Ltd

  11. Some Context Michael Brunton-Spall Bruntonspall Ltd

  12. 2006 Michael Brunton-Spall Bruntonspall Ltd 06/12/2019 12

  13. 2010 Michael Brunton-Spall Bruntonspall Ltd 06/12/2019 13

  14. 2013 Michael Brunton-Spall Bruntonspall Ltd 06/12/2019 14

  15. 2015 Michael Brunton-Spall Bruntonspall Ltd 06/12/2019 15

  16. 2019 Michael Brunton-Spall Bruntonspall Ltd 06/12/2019 16

  17. Michael Brunton-Spall Bruntonspall Ltd

  18. Michael Brunton-Spall Bruntonspall Ltd

  19. Michael Brunton-Spall Bruntonspall Ltd

  20. Michael Brunton-Spall Bruntonspall Ltd

  21. Michael Brunton-Spall Bruntonspall Ltd 06/12/2019 21

  22. Michael Brunton-Spall Bruntonspall Ltd 06/12/2019 22

  23. Michael Brunton-Spall Bruntonspall Ltd 06/12/2019 23

  24. Michael Brunton-Spall Bruntonspall Ltd 06/12/2019 24

  25. Michael Brunton-Spall Bruntonspall Ltd

  26. Maginot Line

  27. 1930 France Michael Brunton-Spall Bruntonspall Ltd

  28. “We’d really like Germany not to invade us” Michael Brunton-Spall Bruntonspall Ltd

  29. In WW1, they came slowly overland and built trenches Michael Brunton-Spall Bruntonspall Ltd

  30. Michael Brunton-Spall Bruntonspall Ltd

  31. Michael Brunton-Spall Bruntonspall Ltd

  32. Michael Brunton-Spall Bruntonspall Ltd

  33. The Germans had invented Blitzkrieg “Lightning Strike” which simply went around Michael Brunton-Spall Bruntonspall Ltd

  34. Michael Brunton-Spall Bruntonspall Ltd

  35. The French were fighting a war from 1920 against an adversary using 1939 techniques Michael Brunton-Spall Bruntonspall Ltd

  36. Evolution

  37. Michael Brunton-Spall Bruntonspall Ltd

  38. Custom built minicomputer Michael Brunton-Spall Bruntonspall Ltd

  39. Servers in data center Michael Brunton-Spall Bruntonspall Ltd

  40. Colocated servers Michael Brunton-Spall Bruntonspall Ltd

  41. Virtual private servers Michael Brunton-Spall Bruntonspall Ltd

  42. Virtual machines at scale Michael Brunton-Spall Bruntonspall Ltd

  43. Michael Brunton-Spall Bruntonspall Ltd

  44. Michael Brunton-Spall Bruntonspall Ltd

  45. Why Wardley Maps? Michael Brunton-Spall Bruntonspall Ltd

  46. We can see changing landscapes Michael Brunton-Spall Bruntonspall Ltd

  47. We can discuss strategies Michael Brunton-Spall Bruntonspall Ltd

  48. A map isn’t reality, it’s just an abstraction Michael Brunton-Spall Bruntonspall Ltd

  49. Things evolve Michael Brunton-Spall Bruntonspall Ltd

  50. As servers move from physical to virtual, single to multiple, practice evolves Michael Brunton-Spall Bruntonspall Ltd

  51. Coevolution of product and practice

  52. Michael Brunton-Spall Bruntonspall Ltd

  53. Michael Brunton-Spall Bruntonspall Ltd

  54. Michael Brunton-Spall Bruntonspall Ltd

  55. How do we administer servers? Michael Brunton-Spall Bruntonspall Ltd

  56. Worries about hard drives, CPU’s, power etc Michael Brunton-Spall Bruntonspall Ltd

  57. Cloud providers give us abstractions Michael Brunton-Spall Bruntonspall Ltd

  58. Michael Brunton-Spall Bruntonspall Ltd

  59. We stop worrying about whether a hard drive fails in a server Michael Brunton-Spall Bruntonspall Ltd

  60. This results in changing operations practice Michael Brunton-Spall Bruntonspall Ltd

  61. DevOps, SRE Michael Brunton-Spall Bruntonspall Ltd

  62. This results in different developer consumption of operations Michael Brunton-Spall Bruntonspall Ltd

  63. Kubernetes, Serverless Michael Brunton-Spall Bruntonspall Ltd

  64. Michael Brunton-Spall Bruntonspall Ltd

  65. What does this mean for security? Michael Brunton-Spall Bruntonspall Ltd

  66. How we think about security has to change Michael Brunton-Spall Bruntonspall Ltd

  67. Security practices have to evolve Michael Brunton-Spall Bruntonspall Ltd

  68. Michael Brunton-Spall Bruntonspall Ltd

  69. Traditional security is about assurance Michael Brunton-Spall Bruntonspall Ltd

  70. Where will my data sit Michael Brunton-Spall Bruntonspall Ltd

  71. Where does the data go Michael Brunton-Spall Bruntonspall Ltd

  72. Michael Brunton-Spall Bruntonspall Ltd

  73. This works when you have individual servers Michael Brunton-Spall Bruntonspall Ltd

  74. This doesn’t work with modern cloud Michael Brunton-Spall Bruntonspall Ltd

  75. This doesn’t work th the e same same with modern cloud Michael Brunton-Spall Bruntonspall Ltd

  76. Security is currently fighting a war from a decade ago Michael Brunton-Spall Bruntonspall Ltd

  77. Mapping Security

  78. Michael Brunton-Spall Bruntonspall Ltd

  79. “Skate to where the puck is going, not where it has been” Wayne Gretsky Michael Brunton-Spall Bruntonspall Ltd

  80. Where the puck was yesterday Michael Brunton-Spall Bruntonspall Ltd

  81. What are solved problems? Michael Brunton-Spall Bruntonspall Ltd

  82. Commonly solved the same way Michael Brunton-Spall Bruntonspall Ltd

  83. Productionised processes Michael Brunton-Spall Bruntonspall Ltd

  84. Michael Brunton-Spall Bruntonspall Ltd

  85. SDLC, Assurance of suppliers, network assurance, hardware assurance Michael Brunton-Spall Bruntonspall Ltd

  86. All cloud customers have similar concerns in this area Michael Brunton-Spall Bruntonspall Ltd

  87. Buy don’t Build Michael Brunton-Spall Bruntonspall Ltd

  88. Compliance via certificates ISO27001, CSA, ISO27017, SOC, FISMA, HIPAA … Michael Brunton-Spall Bruntonspall Ltd

  89. Where the puck is today Michael Brunton-Spall Bruntonspall Ltd

  90. Michael Brunton-Spall Bruntonspall Ltd

  91. Continuous Integration, Continuous Deployment, DevOps Michael Brunton-Spall Bruntonspall Ltd

  92. Patching Michael Brunton-Spall Bruntonspall Ltd

  93. How quickly can you patch? Michael Brunton-Spall Bruntonspall Ltd

  94. DevOps Michael Brunton-Spall Bruntonspall Ltd

  95. How secure is your code? Michael Brunton-Spall Bruntonspall Ltd

  96. Code review and Pull requests Michael Brunton-Spall Bruntonspall Ltd

  97. Staff identity and single sign on Michael Brunton-Spall Bruntonspall Ltd

  98. Zero Trust Networking Michael Brunton-Spall Bruntonspall Ltd

  99. Michael Brunton-Spall Bruntonspall Ltd

  100. But where is the puck going? Michael Brunton-Spall Bruntonspall Ltd

Recommend

Secure Agile Development With FISMA Compliance https://www.fyrmassociates.com/ FYRM Overview

Secure Agile Development With FISMA Compliance https://www.fyrmassociates.com/ FYRM Overview

Secure Agile Development With FISMA Compliance https://www.fyrmassociates.com/ FYRM Overview Qualifications Performance Strategy Experience CPAR 4/4 Secure Agile Respected Partner CMS, DOE Knowledge Sharing FedRAMP

197 views • 16 slides
KB GOING AGILE HOW TO MAKE THE CHANGE WORK? S E P T E M B E R 1 0 - 1 1 , 2 0 1 8 WHY

KB GOING AGILE HOW TO MAKE THE CHANGE WORK? S E P T E M B E R 1 0 - 1 1 , 2 0 1 8 WHY

KB GOING AGILE HOW TO MAKE THE CHANGE WORK? S E P T E M B E R 1 0 - 1 1 , 2 0 1 8 WHY AGILE@KB? OUR ENVIRONMENT IS CHARACTERIZED BY INCREASING COMPETITIVE PRESSURE AND CUSTOMER DEMANDS On the other hand, our former operating model was not

644 views • 16 slides
The Joy of Open, Agile Government Security Compliance Using F/LOSS, Agile and DevSecOps to help

The Joy of Open, Agile Government Security Compliance Using F/LOSS, Agile and DevSecOps to help

The Joy of Open, Agile Government Security Compliance Using F/LOSS, Agile and DevSecOps to help make compliance secure Fen Labalme TOC How did I get here What is CivicActions What is compliance Making compliance fun Culture

1.24k views • 89 slides
(11-14) How much do you know about the internet? Make sure you stay SAFE AND SECURE ONLINE YOU

(11-14) How much do you know about the internet? Make sure you stay SAFE AND SECURE ONLINE YOU

(11-14) How much do you know about the internet? Make sure you stay SAFE AND SECURE ONLINE YOU KNOW EMAIL YOU KNOW SOCIAL NETWORKING YOU KNOW INSTANT MESSAGING YOU KNOW DOWNLOADS YOU KNOW GAMING MAKE SURE YOU Know Your World Make the

781 views • 28 slides
SELLING AGILE V E S A PA L M U @ W U N D E R . U K B U S I N E S S A N D S T R AT E G Y T R

SELLING AGILE V E S A PA L M U @ W U N D E R . U K B U S I N E S S A N D S T R AT E G Y T R

SELLING AGILE V E S A PA L M U @ W U N D E R . U K B U S I N E S S A N D S T R AT E G Y T R A C K Vendor? Customer? In-house team? New to agile? Some agile? 100% agile? Questions, feedback on Twitter #SellingAgile The Story 1.

918 views • 54 slides
The AGILE Data Center and the First AGILE Catalog Carlotta Pittori, on behalf of the AGILE

The AGILE Data Center and the First AGILE Catalog Carlotta Pittori, on behalf of the AGILE

The AGILE Data Center and the First AGILE Catalog Carlotta Pittori, on behalf of the AGILE Collaboration 2009 Fermi Symposium 2 - 5 November 2009, Washington AGILE on PSLV-C8 Sriharikota, India The AGILE April 15, 2007 Payload: the most

853 views • 38 slides
Security DevOps staying secure in agile projects Christian Schneider @cschneider4711 mail@

Security DevOps staying secure in agile projects Christian Schneider @cschneider4711 mail@

Security DevOps staying secure in agile projects Christian Schneider @cschneider4711 mail@ www. `whoami` Christian-Schneider.net Software Developer, Whitehat Hacker & Trainer Freelancer since 1997 Focus on JavaEE &

773 views • 59 slides
Bibliography [Agile Alliance2001] Agile Alliance, Principles: The Agile Alliance (2001),

Bibliography [Agile Alliance2001] Agile Alliance, Principles: The Agile Alliance (2001),

Bibliography [Agile Alliance2001] Agile Alliance, Principles: The Agile Alliance (2001), http://www.agilealliance.org/ . [Alexander2002] I. Alexander, Initial Industrial Experience of Misuse Cases in Trade-Off Analysis, pp. 1113 in

503 views • 12 slides
S t r e t c h i n g the Agile Envelope Agile Software Development Meets Corporate Deployment

S t r e t c h i n g the Agile Envelope Agile Software Development Meets Corporate Deployment

XP07 S t r e t c h i n g the Agile Envelope Agile Software Development Meets Corporate Deployment Procedures: Stretching the Agile Envelope David Leip Olly Gotel ibm.com Chief Innovation Dude Department of Computer Science Agile Methods

123 views • 10 slides
Scaling Agile to the Enterprise Enabling the Agile Enterprise Strategically Aligned, Throughput

Scaling Agile to the Enterprise Enabling the Agile Enterprise Strategically Aligned, Throughput

Scaling Agile to the Enterprise Enabling the Agile Enterprise Strategically Aligned, Throughput Focused, Human Powered Dennis Stevens Enterprise Agile Coach www.leadingagile.com OPM3: Deputy Project Manager www.dennisstevens.com PMI Agile

851 views • 71 slides
Agile Development emmet labs David Verba david@adaptivepath.com Agile Introduction Agile

Agile Development emmet labs David Verba david@adaptivepath.com Agile Introduction Agile

Agile Development emmet labs David Verba david@adaptivepath.com Agile Introduction Agile Manifesto Individuals and interactions over processes and tools Working software over comprehensive documentation Customer collaboration over contract

582 views • 31 slides
Secure Drupal Development Steven Van den Hout Steven Van den Hout

Secure Drupal Development Steven Van den Hout Steven Van den Hout

Secure Drupal Development Steven Van den Hout Steven Van den Hout @stevenvdhout http://dgo.to/@svdhout SECURE? 1 IS D DRUPAL AL S IS OPEN SOURCE SECURE? MANY EYES MAKE FOR SECURE CODE - Security by obscurity - Open

641 views • 51 slides
Duke Workshop PnT Agile Practice pnt-agile@redhat.com RED HAT CONFIDENTIAL - INTERNAL USE ONLY

Duke Workshop PnT Agile Practice pnt-agile@redhat.com RED HAT CONFIDENTIAL - INTERNAL USE ONLY

Duke Workshop PnT Agile Practice pnt-agile@redhat.com RED HAT CONFIDENTIAL - INTERNAL USE ONLY AGENDA What is Agile Why Metrics ? Agile Report explanations RED HAT CONFIDENTIAL - INTERNAL USE ONLY THE HISTORY OF AGILE RED

774 views • 44 slides
Agile Software Development 1 / 26 Agile Processes Agile Manifesto (http://agilemanifesto.org/)

Agile Software Development 1 / 26 Agile Processes Agile Manifesto (http://agilemanifesto.org/)

Agile Software Development 1 / 26 Agile Processes Agile Manifesto (http://agilemanifesto.org/) value: Individuals and interactions over processes and tools Working software over comprehensive documentation Customer collaboration over

694 views • 26 slides
Small, Modular, Agile, Secure: Pick 4 Many components makes light work Andrew Sullivan at ICANN

Small, Modular, Agile, Secure: Pick 4 Many components makes light work Andrew Sullivan at ICANN

Small, Modular, Agile, Secure: Pick 4 Many components makes light work Andrew Sullivan at ICANN 55 March 7, 2016 asullivan@dyn.com Anycast @ ICANN 55 asullivan@dyn.com Anycast is just good Good to sink traffic topologically close to

449 views • 18 slides
The Agile PMP: Teaching an Old Dog New Tricks The Agile PMP: Teaching an Old Dog New Tricks

The Agile PMP: Teaching an Old Dog New Tricks The Agile PMP: Teaching an Old Dog New Tricks

W8 Concurrent Session Wednesday 11/12/2008 12:45 PM 2:15 PM The Agile PMP: Teaching an Old Dog New Tricks The Agile PMP: Teaching an Old Dog New Tricks Presented by: Mike Cottmeyer VersionOne Presented at: Agile Development Practices

646 views • 60 slides
Agile for the Government Product Owner Agile Government Leadership Outcomes for today

Agile for the Government Product Owner Agile Government Leadership Outcomes for today

Agile for the Government Product Owner Agile Government Leadership Outcomes for today www.AgileGovLeaders.org/Academy Why you should do this course Lesson 1: Introduction To Agile Lesson 1: Reading List What Is Agile? Why Agile In

411 views • 24 slides
Leveraging Kanban to Create the Agile Organization As Agile is more accepted as the way to

Leveraging Kanban to Create the Agile Organization As Agile is more accepted as the way to

Leveraging Kanban to Create the Agile Organization As Agile is more accepted as the way to develop software in organizations, some software teams and groups within IT are also becoming Agile, but with using Kanban as their chosen Agile

458 views • 27 slides
How Secure are Secure How Secure are Secure Interdomain Routing Protocols? Interdomain Routing

How Secure are Secure How Secure are Secure Interdomain Routing Protocols? Interdomain Routing

DIMACS Workshop On Secure Routing March 10, 2010 How Secure are Secure How Secure are Secure Interdomain Routing Protocols? Interdomain Routing Protocols? $ $ Sharon Goldberg Microsoft Research & Boston University y Michael Schapira

701 views • 54 slides
HOW BDD CAN SAVE AGILE @mattwynne | QCon 2015 | London Does agile really need saving? Scrum !=

HOW BDD CAN SAVE AGILE @mattwynne | QCon 2015 | London Does agile really need saving? Scrum !=

HOW BDD CAN SAVE AGILE @mattwynne | QCon 2015 | London Does agile really need saving? Scrum != Agile Predictability Communication Quality Small pieces Collaboration Technical discipline How does BDD help? Individuals and Interactions

843 views • 37 slides
From Running Agile to Being Agile: How IT departments are the change makers of their organisation

From Running Agile to Being Agile: How IT departments are the change makers of their organisation

From Running Agile to Being Agile: How IT departments are the change makers of their organisation Laura-Jane Parker November 2017 POST*SHIFT @little_lj POST*SHIFT In agile we trust? Its certainly captured the attention of the C-Suite

418 views • 40 slides
Disciplined Agile In The City AGILE in the CITY, LONDON 2018 About today My

Disciplined Agile In The City AGILE in the CITY, LONDON 2018 About today My

Disciplined Agile In The City AGILE in the CITY, LONDON 2018 About today My background Case study More about Disciplined Agile About me Giles Lindsay: @anyone4seconds 25 years working as a Software Engineer

756 views • 46 slides
Agile Unified Process (UP): Agile Process Overview Introduction to an OOA/D Agile Unified

Agile Unified Process (UP): Agile Process Overview Introduction to an OOA/D Agile Unified

Overview Agile Unified Process (UP): Agile Process Overview Introduction to an OOA/D Agile Unified Process (UP) Basics Process Introduction to an OOA/D Process Eunjee Song Agile Process Principles Dept. of Computer Science

442 views • 3 slides
Agile Software Development Venkat Subramaniam svenkat@cs.uh.edu Agile Software Development - 1

Agile Software Development Venkat Subramaniam svenkat@cs.uh.edu Agile Software Development - 1

Agile Software Development Venkat Subramaniam svenkat@cs.uh.edu Agile Software Development - 1 Agile Software Development State of Softw are Developm ent Agility Planning Daily Activity Conclusion Agile Software

744 views • 23 slides

More recommend