From DevOps to DevSecOps: How Establishing a Threat Modeling Process Can Help You Transition
A presentation at NDC Oslo by Bruno Amaro Almeida
From DevOps to DevSecOps How Establishing a Threat Modeling Process Can Help You Transition NDC Oslo June 2020 Bruno Amaro Almeida BERLIN · HELSINKI · LONDON · MUNICH · OSLO · STOCKHOLM · TAMPERE @bruno_amaro Photo by Praveesh Palakeel on Unsplash
Thank you! Kiitos! Danke! Tack! Hello! Bruno Amaro Almeida P RINC IP AL ARC HITE C T & ADV ISOR Cloud, DevOps, Security, Data Engineering & AI Reach out on: @bruno_amaro @brunoamaroalmeida BERLIN · HELSIN K I · LON DON · MUN ICH · OSLO · STOCK HOLM · TAMPERE
ABOUT FUTURICE Nordic roots, global mindset 38 600+ 19 People 8 Offices Years in Business Nationalities 30% TRE 3000+ YOY Growth HEL OSL STHLM Projects Our family of companies LDN eCom m erce and Grow thHacking Artificial Intelligence and M achine Learning BER Platform for freelance tech professionals STGT MUC Map background designed by @Freepik
”What is DevOps? “DevOps is the combination of cultural philosophies, practices, and tools that increases an organization’s ability to deliver applications and services at high velocity(…)” source: aws.amazon.com source: devops.com “DevSecOps is the philosophy of integrating security practices within the DevOps process. DevSecOps involves creating a ‘Security as Code’ culture with ongoing, flexible collaboration between release engineers and security teams.” source: sumologic.com BERLIN · HELSIN K I · LON DON · MUN ICH · OSLO · STOCK HOLM · TAMPERE @bruno_amaro
Evolution of Cost Optimization in Tech 15 YEARS AGO COMPUTE IS EXPENSIVE 10 YEARS AGO STORAGETITLE IS EXPENSIVE TODAY HUMANS ARE EXPENSIVE @bruno_amaro
Role Convergence in Software Development System Administrator Database Admin Site Reliability Engineer Network Engineer Software Engineer ”InfoSec People” DevOps Engineer Quality Engineer Developer BERLIN · HELSIN K I · LON DON · MUN ICH · OSLO · STOCK HOLM · TAMPERE @bruno_amaro
T-Shaped Professionals for Holistic DevOps Source: Jason Yip @bruno_amaro
How Engineers Typically ”Sell” Security
Why should you care about DevSecOps? Having DevSecOps practices (e.g. Threat Modeling) in our organization enables us FASTER TIME TO MARKET • • Documentation up to date Faster Feature Delivery COST SAVINGS AND REDUCED HIGHER CUSTOMER ENGANGEMENT CREDIBILITY AND NEW BUSINESS OPERATIONAL COST AND SATISFACTION OPORTUNITIES • Lean Security Audits • Less Bugs and Vulnerabilities • Better User Experience understanding • Compliance (ISO 27001, GDPR) @bruno_amaro
“ “Threat modelling works to identify, communicate, and understand threats and mitigations within the context of protecting something of value.” source: owasp.org Different Methodologies • VAST: Visual, Agile & Simple Threat Modeling • PASTA: The Process for Attack Simulation & Threat Analysis • TRIKE • STRIDE • … @bruno_amaro
Threat Modelling Meet STRIDE @bruno_amaro
How does it work in practice? What? Who? • Architecture or Sequence-Flow Diagram • Facilitator, preferably neutral • Define the Scope of the TM: be strict • Development team • Architect • Product Owner • Users • … How? • Format: Workshop • Duration: 2-4 hours • Frequency: Every 3-6 months • Iterate over STRIDE For each term in STRIDE: Put yourself in an attacker shoes Exhaust the term before moving to next one Typical outcomes Architecture changes, Security measures, Increased validation, Investigate further @bruno_amaro
High Level Web Architecture Source: sketchappsources.com @bruno_amaro
Spoofing To pretend to be something or someone you are not. How do you authenticate the user or service? How do you authorize and validate it? How could I impersonate other user? (…) BERLIN · HELSIN K I · LON DON · MUN ICH · OSLO · STOCK HOLM · TAMPERE @bruno_amaro
Tampering To manipulate/change information you are not suppose to. Can I change other person information? How could I go around the business logic controls? Can I change data directly in the database? (…) BERLIN · HELSIN K I · LON DON · MUN ICH · OSLO · STOCK HOLM · TAMPERE @bruno_amaro
Repudiation The ability to claim you didn’t do certain actions (no matter if you did or not ). How can you prove user X perform a certain action? If needed (for auditing or troubleshooting purposes ) can you retrace the steps of an user? (…) BERLIN · HELSIN K I · LON DON · MUN ICH · OSLO · STOCK HOLM · TAMPERE @bruno_amaro
Information Disclosure To leak or expose information. Is the system information sensitive? Why? What are the risks of unauthorized information exposure to public (or other users within the system)? (…) BERLIN · HELSIN K I · LON DON · MUN ICH · OSLO · STOCK HOLM · TAMPERE @bruno_amaro
Denial of Service To prevent the system to provide a service. What is the service(s) the system is providing? What are the consequences if it gets interrupted? How likely is that to happen? (…) BERLIN · HELSIN K I · LON DON · MUN ICH · OSLO · STOCK HOLM · TAMPERE @bruno_amaro
Elevation of Privilege To gain rights to do things you are not suppose to. How could an user escalate to gain admin rights? Can a user with an expired subscription continue to use the service? (…) BERLIN · HELSIN K I · LON DON · MUN ICH · OSLO · STOCK HOLM · TAMPERE @bruno_amaro
Make it Fun BERLIN · HELSIN K I · LON DON · MUN ICH · OSLO · STOCK HOLM · TAMPERE @bruno_amaro
What is the value you create with this? • Security backlog with all the findings and new work uncovered. • Architecture and Flow diagrams up-to-date • Security and Compliance (e.g. PIA for GDPR, PCI DSS, CCPA, etc) • Alignment within the team • Enhanced visibility Photo by Ricardo Rocha on Unsplash @bruno_amaro
Thank you! Kiitos! Danke! Tack! Bruno Amaro Almeida P RINC IP AL ARC HITE C T & ADV ISOR Cloud, DevOps, Security, Data Engineering & AI Reach out on: @bruno_amaro @brunoamaroalmeida BERLIN · HELSIN K I · LON DON · MUN ICH · OSLO · STOCK HOLM · TAMPERE
Are you happy with your current Security practices? Is your company moving towards a DevSecOps culture?
Security is a crucial part of Engineering projects but is often disregarded as something to be added later. One reason behind that is the lack of knowledge about practices to enable a transformation. We can no longer rely on Infosec departments to get involved in a later phase and help to improve the system security. It needs to be considered from the get-go by the same people creating and developing the system as a basic element (similar to the infrastructure, CI/CD, etc).
Where can we start? How can security be included in a project day to day?
In this talk we will learn about how establishing a Threat Modelling process can help you move from DevOps towards DevSecOps.
Threat Modelling is a proven and effective process that can be applied to any project and teams of different sizes. It will help you to identify potential threats (blind spots) from an attacker’s point of view and translate those into new items to your backlog.
In addition to the enhanced security, your project will gain better technical documentation and your team becomes more engaged with a better understanding of the big picture and the project business requirements.
