Even Faster: How Rugged DevOps & SW Supply Chains Attack Developer Waste Josh Corman @joshcorman @joshcorman
Conclusions / Apply! § Idea: A full embrace of Deming is a SW Supply Chain: § Fewer/Better Suppliers § Highest Quality Supply § Traceability/Visibility throughout Manufacturing / Prom & Agile Recall § Benefits: Such rigor enables: § Even FASTER: Fewer instances of Unplanned/Unscheduled Work ( ALSO CONTEXT SWITCHES) § More EFFICIENT: Faster MTTD/MTTR § Better QUALITY/RISK: Avoid elective/avoidable complexity/risk § Urgency: It’s OpenSeason on OpenSource § And our dependence on connected tech is increasingly a public safety issue § Coming Actions: “Known Vulnerabilities” Convergence § Lawmakers, Insurers, Lawyers, etc. are converging @joshcorman
Who am I? Joshua Corman @joshcorman CTO, Sonatype @joshcorman
@joshcorman
@joshcorman
@joshcorman 6
h/t @petecheslock DevOpsDays AusHn 2015 True #DevOps + Security isn’t all rainbows & unicorns. Unicorn p00p has to be worked thru @joshcorman @mortman #RSAC @joshcorman
@joshcorman
Rugged DevOps SESSION ID: Going Even Faster With Software Supply Chains Gene Kim Joshua Corman Researcher and Author CTO IT Revolution Press Sonatype @RealGeneKim @joshcorman #RSAC
~ Marc Marc Andreessen 2011 @joshcorman 10/23/2013 10 @joshcorman
@joshcorman 11
Trade Offs Costs & Benefits @joshcorman 10/23/2013 12 @joshcorman
Beyond Heartbleed: OpenSSL in 2014 (31 in NIST’s NVD thru December) As of today, internet scans by MassScan reveal 300,000 CVE-2014-3470 6/5/2014 CVSS Severity: 4.3 MEDIUM ß SIEMENS * of original 600,000 remain CVE-2014-0224 6/5/2014 CVSS Severity: 6.8 MEDIUM ß SIEMENS * CVE-2014-0221 6/5/2014 CVSS Severity: 4.3 MEDIUM unpatched or unpatchable CVE-2014-0195 6/5/2014 CVSS Severity: 6.8 MEDIUM CVE-2014-0198 5/6/2014 CVSS Severity: 4.3 MEDIUM ß SIEMENS * CVE-2013-7373 4/29/2014 CVSS Severity: 7.5 HIGH CVE-2014-2734 4/24/2014 CVSS Severity: 5.8 MEDIUM ** DISPUTED ** CVE-2014-0139 4/15/2014 CVSS Severity: 5.8 MEDIUM CVE-2010-5298 4/14/2014 CVSS Severity: 4.0 MEDIUM CVE-2014-0160 4/7/2014 CVSS Severity: 5.0 MEDIUM ß HeartBleed CVE-2014-0076 3/25/2014 CVSS Severity: 4.3 MEDIUM CVE-2014-0016 3/24/2014 CVSS Severity: 4.3 MEDIUM CVE-2014-0017 3/14/2014 CVSS Severity: 1.9 LOW CVE-2014-2234 3/5/2014 CVSS Severity: 6.4 MEDIUM CVE-2013-7295 1/17/2014 CVSS Severity: 4.0 MEDIUM CVE-2013-4353 1/8/2014 CVSS Severity: 4.3 MEDIUM CVE-2013-6450 1/1/2014 CVSS Severity: 5.8 MEDIUM … @joshcorman
Heartbleed + (UnPatchable) Internet of Things == ___ ? In Our Homes In Our Bodies In Our Cars In Our Infrastructure @joshcorman
Sarcsm: I’m shocked! @joshcorman 15
@joshcorman
The Rugged Ma The Ru ed Mani nifesto festo I am I m rugged... and mo more imp mportantly, my my code is ru rugged. I recogniz I ize th that t softw ftware has become a fo foundatio tion of f our mo modern world. I I recogniz ize th the awesome responsib ibility ility th that t comes with ith th this is fo foundatio tional l role le. I I recogniz ize th that t my code will ill be used in in wa ways I cannot anticipat ant pate, in n ways ays it was as no not designe ned, and and for long nger th than it it was ever in inte tended. I recogniz I ize th that t my code will ill be atta ttacked by ta tale lente ted and pe persistent nt adve adversar aries who ho thr hreat aten n our phy physical al, ec econ onom omic ic, and nation ional sec securit ity. I I recogniz ize th these ese thin ings s - a and I I c choose t to b be r rugged. I am rugged because I I I refu fuse to to be a source of f vu vulne nerability or weakne kness. I I am rugged because I I assure my code will ill support t its its mi mission. I I am rugged because my code can fa face th these challe llenges and and pe persist in n spi pite te of f th them. I I am rugged, not t because it it is is easy, but t because it it is is necessar ne ary. y... and and I am am up up for the he chal hallenge nge. @joshcorman
I I recogniz ize th that t softw ftware has become a fo foundatio tion of f our mo modern world. I recogniz I ize th the awesome responsib ibility ility th that t comes with ith th this is fo foundatio tional l role le. I I recogniz ize th that t my code will ill be used in in wa ways I cannot anticipat ant pate, in n ways ays it was as no not designe ned, and and for long nger th than it it was ever in inte tended. I recogniz I ize th that t my code will ill be atta ttacked by ta tale lente ted and pe persistent nt adve adversar aries who ho thr hreat aten n our phy physical al, ec econ onom omic ic, and nation ional sec securit ity. I I recogniz ize th these ese thin ings s - a and I I c choose t to b be r rugged. I I am rugged because I I refu fuse to to be a source of f vulne vu nerability or weakne kness. I I am rugged because I I assure my code will ill support t its its mi mission. @joshcorman
I Am The Cavalry The Cavalry isn’t coming … It falls to us Problem Statement Mission Statement Our society is adopHng connected To ensure connected technologies with technology faster than we are able to the potenHal to impact public safety secure it . and human life are worthy of our trust . • The Why Trust, public safety, human life How EducaHon, outreach, research Who Infosec research community AutomoHve Connected Public Who Global, grass roots iniHaHve Medical Home Infrastructure What Long-term vision for cyber safety Collec9ng exisHng research, researchers, and resources Connec9ng researchers with each other, industry, media, policy, and legal Collabora9ng across a broad range of backgrounds, interests, and skillsets @joshcorman Catalyzing posiHve acHon sooner than it would have happened on its own
5-Star Framework Addressing Automotive Cyber Systems 5-Star Capabili9es « Safety by Design – AnHcipate failure and plan miHgaHon « Third-Party Collabora9on – Engage willing allies « Evidence Capture – Observe and learn from failure « Security Updates – Respond quickly to issues discovered « Segmenta9on & Isola9on – Prevent cascading failure Connec9ons and Ongoing Collabora9ons AutomoHve Policy Insurance Accident Standards Security Engineers Makers Analysts InvesHgators OrganizaHons Researchers @joshcorman h`ps://www.iamthecavalry.org/auto/5star/
5-Star Cyber Safety Formal Capacities Plain Speak 1. Safety By Design 1. Avoid Failure 2. Third Party 2. Engage Allies To Avoid Collaboration Failure 3. Evidence Capture 3. Learn From Failure 4. Security Updates 4. Respond to Failure 5. Segmentation and 5. Isolate Failure Isolation www.iamthecavalry.org @iamthecavalry
h/t @petecheslock DevOpsDays AusHn 2015 True #DevOps + Security isn’t all rainbows & unicorns. Unicorn p00p has to be worked thru @joshcorman @mortman #RSAC @joshcorman
SESSION ID: ASD-T07R Continuous Security: 5 Ways DevOps Improves Security Joshua Corman David Mortman Chief Security Architect & Distinguished Engineer CTO Dell Software Sonatype @mortman @joshcorman #RSAC
@joshcorman
@joshcorman
@joshcorman
Innovate! PRODUCTIVITY TIME @joshcorman
@joshcorman 28
ACCEPTABLE ON TIME ON BUDGET QUALITY/RISK @joshcorman
@joshcorman
Agile goats; not goat rodeo. “We need to be agile, but not fragile.” @RuggedSojware @joshcorman @mortman #RSAC #DevOps @joshcorman
ON TIME. ON BUDGET. ACCEPTABLE QUALITY/RISK. Faster builds. More efficient. Easier compliance. Fewer interrup9ons. More profitable. Higher quality. More innova9on. More compe99ve. Built-in audit protec9on. Agile / CI @joshcorman
DevOps It may feel like DevOps is Pandora’s Box, but it’s open… and hope remains. ;) @joshcorman @mortman #RSAC #DevOps @joshcorman
ON TIME. ON BUDGET. ACCEPTABLE QUALITY/RISK. Faster builds. More efficient. Easier compliance. Fewer interrup9ons. More profitable. Higher quality. More innova9on. More compe99ve. Built-in audit protec9on. Agile / CI DevOps / CD @joshcorman
SW Supply Chains @joshcorman
ON TIME. ON BUDGET. ACCEPTABLE QUALITY/RISK. Faster builds. More efficient. Easier compliance. Fewer interrup9ons. More profitable. Higher quality. More innova9on. More compe99ve. Built-in audit protec9on. Agile / CI DevOps / CD SW Supply Chain @joshcorman
Comparing the Prius and the Volt Toyota Toyota Chevy Advantage Prius Volt Unit Cost 61% $24,200 $39,900 Units Sold 13x 23,294 1,788 In-House 50% 27% 54% ProducHon 16% Plant Suppliers 125 800 (10x per) Firm-Wide 4% 224 5,500 Suppliers @joshcorman
Embrace proven supply chain principles @joshcorman
Software Supply Chain Hygiene Use better & fewer Use higher Track what you use suppliers quality parts and where @joshcorman
Open source usage is EXPLODING Yesterday’s source code is now replaced with OPEN SOURCE components 2014 2007 2008 2009 2010 2011 2012 2013 1B 2B 4B 6B 8B 13B 17B 500M @joshcorman 40 Source: Sonatype, Inc. analysis of (Maven) Central Repository component requests.
Recommend
More recommend
