How to Manage Risk of Your Polyglot Environments Manage Risk: - PowerPoint PPT Presentation

How to Manage Risk of Your Polyglot Environments

Manage Risk: Polyglot Environments Presenters Jeff Rouse , VP Product, ActiveState ● Pete Garcin , Senior Product Manager, ActiveState ● Larry Maccherone, Head of DevSecOps Transformation, Comcast ●

VP Product Jeff Rouse, ActiveState

Manage Risk: Polyglot Environments Platform Presentation Jeff Rouse VP Product ActiveState

Manage Risk: Polyglot Environments Track-record: 97% of Fortune 1000, 20+ years open source Polyglot: 5 languages - Python, Perl, Tcl, Go, Ruby Runtime Focus: concept to development to production

Manage Risk: Polyglot Environments What is Polyglot? SQL

Manage Risk: Polyglot Environments How Do Polyglot Environments Evolve? Technology. Best tool for the job, modern ● software projects. People. technology stacks added through ● acquisition, changes in tech leadership Time. technologies come in & out of favour; old ● languages never die.

Manage Risk: Polyglot Environments Every Organization is Polyglot Any desktop application with an online ● component. YAML configuration used with any project. ● An application with embedding scripting. ●

Manage Risk: Polyglot Environments Adding a Language Source: ActiveState Developer Survey 2018, Open Source Runtime Pains

Manage Risk: Polyglot Environments Rank the Challenges Source: ActiveState Developer Survey 2018, Open Source Runtime Pains

Manage Risk: Polyglot Environments Stability & Security → Painful Source: ActiveState Developer Survey 2018, Open Source Runtime Pains

Manage Risk: Polyglot Environments Hidden Costs 75% Managing dependencies Source: ActiveState Developer Survey 2018, Open Source Runtime Pains

Manage Risk: Polyglot Environments Benefits Speed. Ship faster: better products, better ● innovation. Recruitment. Be attractive workplace: enable ● coders to choose the tools they need.

Manage Risk: Polyglot Environments Drawbacks Variability. Tooling support & programming ● language quality. Expertise Gap. Deep core competency at odds with ● breadth of programming languages. Dependencies. Larger pool of dependencies. ● Support Costs. Unable to centralize, maintenance. ●

Manage Risk: Polyglot Environments Presentation Title Title color by theme Magnified Issues How will you monitor, identify and resolve? Most important tex. tipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute Production bugs, Common Vulnerabilities & Exposures (CVE), irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. threats; additional risk exposure with 3rd party dependencies. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum. Equifax Breach: out of date 3rd party dependency

Presentation Title Resolutions Reduce Reduce Reduce Reduce Attack Libs Tools Services Surface Robust Processes, Automated and Centralized for Visibility

Senior Product Manager Pete Garcin, ActiveState

Manage Risk: Polyglot Environments Platform Presentation Pete Garcin Senior Product Manager ActiveState

Manage Risk: Polyglot Environments Automated Processes

Manage Risk: Polyglot Environments

Manage Risk: Polyglot Environments Automating Environments Automate. ● Bundle. ● Simplify Shares. Encourage adoption of common ● environments.

Manage Risk: Polyglot Environments

Manage Risk: Polyglot Environments

Manage Risk: Polyglot Environments Solving Core Problems Environment Dependency Workflow Configuration Management Configuration

Manage Risk: Polyglot Environments Best Practices - Build Eng & Development Build Standard Reproduce & Manage Shrink Build

Manage Risk: Polyglot Environments Best Practices - Development to Production Monitor Runtime Get Updates

Manage Risk: Polyglot Environments Benefits to You Dev Zen Same Same Time

E7: SDL Self Assessment | 28 Security at the Speed of Software Development Presented by: Larry Maccherone DELETE A lean/agile transformation approach to achieving a DevSecOps culture Privileged and Confidential The approach for Comcast’s Secure Development Lifecycle (SDL) initiative

E7: SDL Self Assessment | 29 DELETE Larry Maccherone Larry Maccherone LinkedIn.com/in/LarryMaccherone Larry_Maccherone@Comcast.com Privileged and Confidential

Security practices on DevOps continuum ➔ DevSecOps • Analysis → Learning • Pen testing (Vuls found → Test scripts) • Defect/Incident 3-step • Compliance validation (PCI, etc.) • New attack surface? • Fuzzing Plan to update threat model • • Test security features Restore/maintain service for • Common abuse cases non-attack usage • Break the build • RASP auto respond code analysis • Roll-back or toggle off • Block attacker • Shut down services • Static/IAST analysis • Abuse case tests • Code review • Intrusion detection • App attack detection • Threat modeling → backlog items • Analyze/Predict → backlog items • • Log information for If we do X will it mitigate Y? • Design complies with policy? • Configuration validation • after-incident analysis Capacity forecasting • Feature toggles/Traffic • Learning → Update playbooks shaping configuration and Training • Secrets management

That’s a lot of stuff! How do we get development teams to adopt?

E E X X A A M M P P L L E E 3 2

E E L L P P Visualizing an Org’s M M A A practices X X E E

Dev [Sec] Ops is … empowered engineering teams taking ownership of how their product performs in production [including security] LinkedIn.com/in/LarryMaccherone

Build security in more than bolt it on Rely on empowered engineering teams DevSecOps Manifesto more than security specialists Implement features securely more than security features Rely on continuous learning more than end-of-phase gates Build on culture change more than policy enforcement

We, the Security Team … Recognize that Engineering Teams … Pledge to … • • Want to do the right thing Lower the cost/effort side of any investment in • Are closer to the business context and will developer security tools or make trade-off decisions between security practices and other risks • Assist 2x as much with • Want information and advice so those preventative initiatives as trade-off decisions are more informed we beg for your assistance reacting to security incidents Understand that … • We are no longer gate keepers but rather tool-smiths and advisors

DevSecOps Tool Landscape Primary Code Analysis Dynamic • Exercises app via UI/API IAST Fuzzing (black box) • Senses vulnerability by response to input for code you write (1st • Runtime code analysis (PCA) • Instruments system (to varying degrees) • Zero? false positives. Report is an exploit • Combine dynamic/static • Sends unexpected input at API • High false negatives • Low false positives • Looks at response and instrumentation output • Difficult to implement especially w/ auth party) • Depends on test coverage • Great for testing protocols like SIP • Sometimes hard to find code to remediate • Immature but getting there • Good for REST APIs • Potentially long run times Static Analysis (aka SAST) • Hard to find code to remediate • Looks at source code • Data/control flow analysis • Prone to false positives • Rapid feedback for developers • Code fix suggestions Software Composition Analysis (SCA) for code you import (3 rd party) Runtime Application • Identifies dependency and version Security Protection • Checks CVE/NVD + … for reported (RASP) vulnerabilities • Often uses same engine • Proposes version/patch to remediate as IAST • Checks license vs policy • Reports on “bad” • Runs fast behavior • Easy to implement • Can abort transaction or • Best bang for buck! kill process to protect

• Questions? • Pilot this DevSecOps What’s transformation framework next? with a few of your teams • Connect with me on: LinkedIn.com/in/LarryMaccherone LinkedIn.com/in/LarryMaccherone

Q & A

What’s Next Watch a demo: ● https://www.youtube.com/watch?v=c5AIxN9ehrI Get a demo marketing@activestate.com ● Contact us for the language build you need: ● platform@activestate.com

Manage Risk: Polyglot Environments Where to find us Tel: 1.866.631.4581 Website: www.activestate.com Twitter: @activestate Facebook: /activestatesoftware