[Music]
before we start um how many people here
are Security
Professionals whoa okay then that means
I'm not expecting any questions right at
the end um um but please stop me ask me
questions anytime um and we will get
started on this all right so this is um
this talk is basically geared towards
security teams and um just sharing some
ideas some thoughts about how to be
agile
right um so the goal is uh so you know
as you know that security we Face
threats every time right every
day sometimes many many uh times a day
and things like that um and there's a
lot of apps lot of apis lot of
everything
yes oh
sure
better hello is that
better
all right is this better I'll try and
speak into the
mic and I lost my train of thought of
course right
um so yeah so um so there's new apps new
apis new everything being created new
hardware coming in every day so there's
a lot of security threats right so every
one of these uh could be a security
vulnerability right so the goal of this
talk is to identify how security teams
can um can use agile practices in their
own work to secure the organization
monitor um any security threats and um
respond to these and mitigate them as as
needed right and the second uh goal of
this talk is um how can you best
integrate agile processes into your um
your teams basically whether it's a
development team um whether it's your
security team and things like any uh def
cops people
here all right cool so that is the goal
of this right so you know so but before
we go into all that stuff in
introductions first right um my name is
naven VK I've um technical director at
inv viia it's a very small consulting
company based here in in Milwaukee um we
also have offices in Chicago and Madison
so I'm actually from Madison um so my
background it's mostly been apev so I've
been
um all the security things that I've
been um exposed to have been on the appd
side of things right so developing apps
apis and things like that on the
development side of things so this is so
take the these things with a pinch of St
salt take these as I ideas and and
things that I've experienced um and
things that I've helped basically right
um so I've my all my I've got 23 years
of experience and all my clients have
been basically in the financial aspects
in the financial industry if you can
call it that right so including the
government so but the financial part of
things right so insurance companies uh
Financial Services as well as well as
the state of Wisconsin but on the
financial the side of things um and then
um a little bit about invisia um like I
said you know we are based in Milwaukee
Chicago and Madison um as well as we
build software with the with our clients
right so it's not we just come in and
build and leave no we build it with the
clients so so there's that uh more when
you look at our website um the other
thing you know besides work which is
what I love to do I love my job the
other things that I really like to do is
um I'm a dance fitness instructor so if
you're ever in Madison and want to try
out any of the dance fitness classes um
whole bunch of them everywhere even here
in in Milwaukee I presume so I teach a
whole bunch of those um these are my two
cats and that's a photo that U my
boyfriend took and he uh made it into a
I love jigsaw puzzles and so he made
made it into a jigsaw puzzle and that's
what I put together uh last Christmas or
shortly after that right and then I also
love running um half marathons half
marathons are my things full marathons
we take take too much
time so that's what I do for fun
therapy um so the material for this talk
um this is where the source for the the
talk comes from right um so there's
disciplined agile anybody know what what
discipled agile is or it's a new term
there's a slide later on that that talks
about it um Dev SE SEC ops.org rugged
software oasp um as well as my boss
Tracy Barrett so she helped me with
these slides and with her expertise as
well and then a couple other books
right um so let's start with uh with the
talk then um before I go into the detail
sales um quick intro about da
disciplined agile right um it
is nothing but a um a toolkit with
guidelines guidelines for everything
especially when it comes to software
right um and the way it is setup or the
layout of this toolkit is you have
layers you have processed blades Within
These layers and then each one of these
processed blades has
activities and each one of those
activities has some options right so
these options may or may not be ordered
right so if you start if you have no
idea what to do right and at least
they'll give you like start here and
then proceed to the next you know so
it's it's it's a toolkit of guidelines
um the principle behind disciplined
agile is the way of working so the way
you work is very specific to an
organization and a specific team to an
organization right so no two teams in
even in the same organization work the
same way right um one team could have um
you know like an offshore like some
members in the offshore team right and
so they might be some something that
they do differently like some of their
standups might be at a some really odd
times of the the day or evening or
whatever right um so things like that um
there's also disciplined agile delivery
uh so it's an agile approach to deliver
it Solutions and one of the basic
premises or principles of disciplined
agile is people come first people come
first um it's it's learning oriented
you're always constantly R learning
right and then it's scalable right so
you can scale it so take a peek at it if
you've never looked at it it's um
just search for discipline agile and you
can get to that um they have a DA
browser um if there's time I'll I'll I
have a couple uh screenshots of that um
but the da
Model this is the da Model of the
Enterprise right and a major principle
and benefit of uh disciplined agile is
to be Enterprise aware so you have to be
aware of everything right and if
you notice where security is it's
down down there it's it's one of the
foundations it's not just a foundation
but it's also as close to delivery as
possible right so it's part of that Dev
Ops layer and it's just about as close
to delivery as you can
get right and those blades those are the
so that's a layer devops layer and those
are different blades
um
the another part of of um security
within devops is it's all about
collaboration right you
can't you have to work with everybody in
the organization the teams the business
the management and everything and which
is why security is a foundation is also
at the bottom right so and and you have
to have support from everybody right you
can't just um be isolated right it won't
work so um not only do you collaborate
with everybody you also have to um have
give give them guidance right um the the
guidance that maybe U the IT staff need
is totally different from what guidance
that does management need right um the
guidance may may also include tools and
other things that you use in your jobs
and then you know like your your appdev
people might need a a different kind of
guidance versus your your devops people
versus your your your database people
and things like that so you uh so you
have to be aware of everything that's
pretty much what this this side slide
says
um so big part of agile team is you know
the teams are agile so there's no roles
right anybody can do anything right
develop developer can be a tester tester
can be a
developer that's the whole mindset but
that's not really true in real life
right especially in big big
organizations we do have roles right so
in that's just part of how things work
right you have your scrum master and
your scrum master and your product owner
you do have these roles and they don't
code right your testers and your your um
the testing team or a member of the
testing team could also be a coder right
they help you with your unit test and
things like that um and and maybe one of
your Dev team can also test but roles
are part of life and so there are two
roles in the security team right you
have the security engineer and the
security
manager right and
um somebody can play multiple roles
somebody can be both but you need those
two distinct uh distinctions between
roles the security engineer assists
teams right and um they are the ones who
understand the security
fundamentals uh very well and they are
the ones who will be working with the
teams on a day-to-day basis
right and they are also the ones who
also doing the the uh making sure that
uh they evaluate security tools and they
make sure that those things get adopted
um and they also work with um
experts right and and other Security
Professionals to um um you can't do this
in isolation you need you know you need
the whole Community behind you the
manager they're the one who does the
prioritization of the work right they
work with the leadership right so they
doing the management part of the things
but you know in smaller organization the
same person might might do both things
but it's that distinction is very
important right and they work with also
external experts as well so you can't do
this in isolation um be
very aware of the words that were used
in that previous slide
right so we talked
about
collaboration right so you're working
with everybody collaboration is part of
devops
assisting there you're still you're
working with everybody assisting teams
to understand
um to understand security needs what it
is that they're trying to do and what
pitfalls that you can foresee right um
work with external
expert um lead team and prioritize their
work right so it's all and works with
the executive uh executive leadership so
it's all
about it's not an isolation you're
working with everybody
else
um agility is a mindset first and a
process
second in order to be agile you have to
think agile
before you start doing things in an
agile way right it's a mindset first so
that comes
first
um and going back to uh disciplined
agile because that's what this whole
thing is based on uh it defines the
security M uh mindset in um a few bullet
points right so I'm going to take a few
moments um to talk about this one
slide right so there's a lot lot of
things in here the first and the topmost
the highest priority of the security
team is to protect the
organization obviously right so that is
the primary goal it is also to make sure
that the
organization
um is secure
now as well as in the future right it's
not just you know one and done it's an
it's an ongoing process right it's it's
it's a very cyclical process um
collaborate with external organizations
right so you have to share um the whole
security Community has to share these
like anything new security threats that
come up the the mitigation strategies
how do you resolve them you have to
share um otherwise if you just you know
it doesn't work that that should be part
of that that's that's the second most
important thing um you have to work
closely with teams
you have to work closely with team so
that they can understand what are the
security threats um with you know if
they're trying to do something in a
certain way you have to say here are the
pitfalls right so you have to be make
them aware of what is could happen like
real potential scenarios um as well as
to educate them right so they need to
know that they have to write things
securely right so they have to have
Security in mind when they build their
AP when they build their apps and things
like
that um and the third thing is uh
transfer skills and knowledge you can't
do it in isolation again you have to
share right you have to tr work uh you
have to share your knowledge you have to
share your your your whatever new
security threats that you're aware of
that you know from the community um like
things need to be patched because this
came out right so that happens all the
time
um and
the next point is security needs to be
holistic right so it's it's not just
apps it's not just it it's apps it's
servers it's people that they are aware
of what the security vulnerabilities
could be um things that they should do
and do not should not do like you know
like have good passwords and multi you
know two- Factor authentication and all
that stuff um as well as hard hardware
and as well as data um not just
corporate data but um IP right
intellectual property right so security
needs to be very holistic and not just
specific things so that's that um so
these are the U the principles behind
that right and um you have to have a
common INF security infrastructure you
can't have uh two different teams doing
two different things there's no way you
can keep track of everything right so
you have to have this Cal common
infrastructure um or the common security
layer right we're doing security with
whatever it is and and it's the security
team who defines that who owns that
everybody else uses that right so you
have to have a common one otherwise it's
going to be too hard to keep track of
what's what right there's just too many
too many variables um and the last thing
is how do we do all this stuff you have
to automate there's no way we can
manually keep track of everything do
everything the more you automate the
better automate automate
automate all right
questions clear as
mud
um
so that was the mindset so you start
with the mindset you start with the
mindset first but then you have to have
processes behind it right you start you
have to think in an agile way and then
you can Implement those processes so
processes matter
too um so the goals for your processes
yeah first is you have to organize all
the needs right of your organization of
all the different teams if there's
like 15 teams need 15 different things
how do you keep track of those things
right you have to organ organize all
these requests and needs from all these
um all all the needs from your
organization the hardware you know
things have to be patched um you know U
your code needs to be scanned and things
like that um once you have all these
requests you have to prioritize them
right what is the highest
priority like here's the latest
vulnerability that could really impact
us that gets fixed first right so we
have to rep prioritize everything um
plus you have to provide transparency
and knowledge sharing you have to be
transparent about here are all the
requests that we that my team is
handling right and this is the order of
the things that it'll get done right and
uh you have to be transparent to the
team as well as to the entire
organization and the way to do all this
one way right
um use a kbon board
anybody know about kban here has
everybody used it okay a lot of people
have used it um so the the whole thing
about kban is is um you have all your
requests you know they're up on a board
it could be a physical board it could be
a virtual board right and then you have
uh you know what's your work in process
your whip is your work in progress you
have your whip limits right based on my
team has five people one person's on
vacation for the next uh two weeks that
means I have four people and that means
I can only have four things in progress
everything
else you know and
then and then you have this expedite
right if something comes in and that is
the highest priority you drop everything
something gets dropped from that work in
progress right something gets moved back
or put on hold
um so
looks like you guys are pretty
comfortable with with um kban board so
that's a good way to organize things um
plus you know the
priorities um and then the next thing is
working with agile team um so this
is this is actually from uh def SEC
ops.org
these this is the in Industry Staffing
uh statistics for every hundred
Developers
you have 10 infrastructure people right
and and the ratio is 100 to 10 to
one one security person for 10
infrastructure and 100
developers I
know so the only way we can we can do
all this stuff is using automation
there's no way we can can we can do it
all on our own
right
um so quick show of
hands who has this ratio in their
organization 100 to 10 to
one okay all
right who has
more and what is your
ratio if I may
ask 6 to
200 okay so three so instead of of for
every hundred developers one it's three
okay so three times better who has
less which is which is what I've seen
mostly in my career
right you for about like 500 people you
may have two Security
Professionals that is way skewed right
or maybe one and a half because one
person's doing something else
yes
yeah no that is what
is that is what they
found it's not the ideal state but that
is what they've generally found right
that it's one security person to every
hundred developers right um that's not
the ideal State you need more people
yeah and depending on the complexity of
your of your apps depending on the size
of your organization you do do need more
but that's what they found
right and most of the time it's it's
less it's way less because you're you're
trying to do two different things right
um and like I said it's impossible to
keep keep all that stuff I mean to do
things manually so you have to
automate um only solution is automation
automate automate automate right um so
this so the the next few slides are
talking about Automation and so in order
to think about automation you have to
think of layers first the four C's of
cloud um of cloud native security right
um Cloud so you have to have you know
infrastructure secure infrastructure
secure configuration secure data you
have your containers you have to have
your secured images and third party
Library so images are not uh gifs over
here right you're you're not your jpegs
and things like that these are your your
uh your your images of of your whatever
right your
Linux windows
binaries and things like that so those
are that that is those the container
images what we're talking about here U
clusters right so kubernetes um if you
were here like there was an earlier talk
um way earlier like nobody knows kues
really well so it's very very easy to
have things misconfigured and and
security holds in there so and and
network configuration um and then then
you have to think about your application
right so the four C's Cloud container
clusters and code right so those are the
four C's that you have to think about in
terms of
security it is but
then because kubernetes usually have a
clustered
environment yep it's it's a it it it
manages it's usually manages a cluster
of containers
right
exactly yep yep
yep and that's why it's in that cluster
and of course
code
um so at the cloud level what are the
things that we can do right so you have
to use infrastructure as um as code
right you can't do the the click stuff
right you have have to have your um
whatever it is um so last five years of
my life has been in the Azure world so
it's all been been Powershell scripts
you know and arm templates and yaml
files for um even to deploy
infrastructure right that's how you can
you can if you that's how you can make
it consistent you can make you know it's
it's there it's in the code so if you
deploy that the same thing in a
different environment it'll be exactly
the same
right um
and one of the um things that manages a
terraform is is what I've personally not
used it right but that's a good way to
manage all that stuff
yes
lot you are um when you're applying
security it's all in your code right all
the configuration all the whatever it is
that you're doing it's it's it's in the
code it's
not exactly so you know exactly what's
happening right and then um so the Hub
and spoke architecture this is what I
wanted to talk about earlier where your
security layer that is your Hub right
that is tightly knit that's owned by the
security team and the um the the the
appb people can can use that and those
become your spokes right so but that Hub
it needs to be that core right so the
shared Hub is uh is your security right
your security layer needs to be in that
shared Hub so the Hub spoke to it's one
it's it's a pretty common architecture
now especially in um the cloud
environment right and
um
exactly
yep exactly
yep and I lost my train of train of
train of thought oh no
worries but yes you have to use um
policies that's how you keep track of
that's how you make sure it's it's
secured you have to have your alerting
and monitoring and all that stuff in
there as
well I'll I'll come back um how many
companies here use
cloud so pretty extensively um
hybrid yeah where we live in a hybrid
world right
um and how many companies use
containers once you go on the cloud
containerization right so that's the
only way you can control things um
so segue into the next slide uh security
and automation at the container level
right so the advantages of containers is
by Def by default they're
secure right here's this thing nothing
can get into it you have to have your
access policies
defined so that that you know resource a
can now access this resource B can
access that but resource a b cannot
access resource a so you you have to
have it's it's secure by default right
it's not open by
default
um and any anytime you have to patch
anything it's it's a
deployment right you have to whatever it
is um it's it's a whole new deployment
that you have to do right um the
important considerations in here are um
trusted image repositories and routine
image scanning because you have to scan
um your images for vulnerabilities right
um if you're whatever auntu package or
your windows or net whatever it is needs
to be patched up it needs you know you
it's not a one and done these images
have to be uh constantly updated as well
maybe not as often as your as as the
rest of the stuff but it does have to be
monitored and um updated as well
routinely um cluster level once again
infrastructure is code right um we don't
create kuties like in AKs you can't just
you can create a but we don't do that
you you know it's all infrastructure is
code um important consideration for this
um is um encrypted
communication right um using between
different
services and US using our service me how
many people here use Serv service meshes
in their companies so service mesh is
nothing but a um a layer that is for
service to service communication right
isio is an example for that and somebody
was um mentioning um your
secret you need vaults you can't have
them in clear text anywhere yeah right
so it's there in the vault I don't even
know what it is right and the Vault um
and my app I have to give explicit
access to that Vault so that it can
retrieve whatever Secrets it needs right
right so it's secure that way and role
base access for um configuration which
is I why I as user cannot um cannot
cannot even look into that Walt because
I don't have access to it but my app
does right through its M and Azure it
through msas right um manage server MSI
manage server identities
right
um code level this is my comfort zone
everything else has been um things that
I've learned talking to people this this
is my comfort zone so code
level you have to have scanning tools
right you have to have cicd pipelines
you can't just deploy the code I mean
especially on the cloud right you you
you have to do it through a through a
pipeline and um as part of that pipeline
you have to scan for code
vulnerabilities right um how many people
here use scanning tools code
vulnerability SC y pretty much it's a
very common practice now that when you
do a build uh it automatically scans for
whatever code vulnerabilities there are
right and um a whole bunch of tools out
there um my current client uses ver code
um I know ness's is another uh very
popular one that's out there so there's
whole bunch of tools out there don't do
this by yourself use a tool makes it
easy um also have uh policies at your
repository your your code repository
level right where you can't even check
in code that you have accidentally like
for local testing um your credentials in
there it'll ping you saying hey I see a
password in there right if it says login
password whatever right um
and like and the other thing is is you
also need to scan code that is um not
being changed right so these code scans
run once a week or every other week and
then they spit out reports to say here
are all the code vulnerabilities that we
found because something new came up in a
package that hasn't been touched in like
five months right and those need to be
fixed
and and that is what we need to keep
track of right and um actually as um my
team we get actually automatically get
emails if um any of my um code fails uh
one of these scans right because we're
making so many apps so many different
apis who know I can't keep track of
everything we just get emails and we
have a dashboard right a dashboard where
we can I can go and look at all the apps
um and it's by team team so I can look
at all the apps that my team manages and
then I can see all
everything so that's a good way to do
that
um in order to all do all that stuff the
security team needs to understand how
software is written at your organization
right you need to understand the whole
um SD sdlc software development life
cycle right um in your organization so
that
you can fit in the
security
requirements where it's easily fits into
that flow right so we don't want to be
hurdles we want to be part of that flow
so as part of that
build injecting your code scan right
there right and not have the team make
them do a special you know whatever a
build or build a run to scan the c or
run a special pipeline to do that do it
as part of that build right um and
anything that um comes out of that right
or any kind of communication use
whatever the team is using to do the
communication right if they use
dashboard right a lot of uh these um uh
scanning tools by default they have some
dashboards that you can
just point the the team to right
and if your team uses um a document
repository or a
Wiki put all your document documentation
there and not email them like PDFs or
some other docs right so try and be part
of that process flow and instead of
creating
hurdles right and so the goal of this
is secure make sure that all your code
is secure at all times right or as
frequently as possible and continuously
verified that it's
secure um how much time do I have oh
we're good we're good um so here's um I
put get this the next few slides for
people who
um like starting guides like some
helpful resources um oasp actually has
um Dev seop's guidelines now if you
don't know where to even start right oos
has that so and their goal is to make
sure you know you detect your uh
Securities issues as soon as possible
right and mitigate them obviously right
um so check out oasp um you
know they have and that's a screenshot
of their uh page and they have lots of
details there um and I was talking about
about um discipline agile so we saw this
before right um and this these are the
layers those are the three layers so
that's the foundational layer the uh um
down there right and you have the value
stream and each one of these things is a
blade and when you look at the da
browser this is what it looks like so
right
so security that's are here are the
activities here are the options right
and so some sometimes it's
order right and the arrow points to from
um where you need to go and what's um
what's bolded is those are some um those
are your ideal right if you can hit
those that'll be good right so that's
what that is so check out the da browser
it's really really helpful it's
guidelines um so if you have any any
doubts about
anything you know it's a resource use
it um and in
conclusion uh keys to Agile security
develop an agile mindset starts with a
mindset use a conbine board to organize
your work rely on uh infrastructure as
Co code right um and automate because
without automation we really can't
like even us Dev teams right we automate
everything you know it's it's hard to
keep track of
everything um and
then those are the philosophies of The
Da mindset
again one more time and
uh thank
[Applause]
you