Enhancing security
through tight collaboration
aka
OWASP PCI DevOps
- OWASP: Web Application Security - thanks, lads!
- PCI-DSS: Payment Card Industry Data Security Standard
- DevOps: Development, Testing and Operations
- Different people together, not just automation
Kalle Hallivuori @ Solinor.com
Done stuff
- Programming 1982 -
- IT Support 1989 -
- Application development 1996 -
- IT solution development 1997 -
- Service development 1998 -
- Process development 2004 -
Been called names
- CS dropout 1993 - 1997
- Scrum Master 2009 - 2010
- Operations Manager 2011 - 2012
- Software Architect 2012 - 2013
- Actually a Generalist?
Through the painful mistakes of others, I have come to value
- Software development as a service process rather than projects
- Unix + Web = MicroServices over Enterprise Service Bus
(That is, while there is value in the items on the right,
I value the items on the left more.)
Disclaimer
I may or may not be at liberty to disclose any true experience.
I may or may not make up details or generalities.
Audience would do well to resort to reasoning and judgement.
On a totally unrelated and irrational note,
I always wanted to be Linus Torvalds instead of Linus Torvalds.
Why?
6 months
¥€$
Time to Market
Analysis
Design
Development
Testing
Deployment
5 days
3 days
6 days
4 days
2 days
or, according to Poppendieck
Cycle Time
Feedback
3 months
2 weeks
2 weeks
1 month
By magic! Looks like a
Value Stream
Problem?
¥€$
Analysis
Design
Development
Testing
Deployment
Feedback
Learning
Learning
Learning
Learning
Learning
Hand-over queues lose information,
and therefore responsibility.
Forgetting
Forgetting
Forgetting
Forgetting
Solution
DevOps
Feedback
Learning
What?
DevOps
- All specialists together -> Live knowledge
- No hand-overs -> Full responsibility
- Immediate feedback -> Rapid adaptation
- Natural for startups; strange for large departmentalised corporations
DevOps
is not Scrum
I asked Jim "Cope" Coplien last week in person.
Cope is determined about taking everything not directly related to actual implementation of production software out of the team, including prototyping, specification and indeed deployment and operation of production systems.
Motivation there is to leave only determinable and well planned work to be executed by the actual Scrum team. Work by the rest of the organisation may take indeterminate times.
Many DevOps teams presumably do great "Scrum-butt"
DevOps
Principles
- Sit together to enable continuous communication about work
- Pair specialists whenever and wherever multiple discipline expertise is needed
- Automate all mundane work ruthlessly - from executable specifications to packaging, systems-wide testing, deployment and monitoring
- Reserve time to search for opportunities and implement enhancements to work practices
DevOps
Security
- Like bugs in zero-defects Scrum, security issues can be handled immediately
- All work is visible to whole team
- Enthusiastic, professional team spirit prevents sloppiness
- Everyone learns enough about each other's work to be able to review and criticize it
- Security steps are easy to introduce and whether they are being followed becomes evident to all
- style and complexity checks
- test results - team spirit can not allow a single failing test
- production systems' status monitor visible to whole team
How?
DevOps
seating
Diplomat:
Scrum Master,
manager, secretary,
what have you
Testing specialist:
development of
quality measures,
executable specifications
Domain specialist: understand
and develop solutions
particular to business
Generalist: automation,
development of
quality of work
IT administrator:
deployment and
monitoring of
systems and
machinery
Operator:
solves users' issues
domain expert
?
YMMV
Facing
each other
is GREAT!
learn from real use
search for better ways
plan system structure
WE RULE!
DevOps
PCI compliance
I am not going to delve into PCI DSS proper.
This just to give some idea how to meet strict security requirements.
- 100% code review by a team member for every feature
- pair coding makes this a breeze :)
- OWASP gets paid extra attention
- Executable security specifications can be written straight after functional ones
- Only administrators and operators can access production systems, but others pair with them as necessary to solve issues
- Automation makes test setups identical to production systems, which is great for introspection, but access to production can still be restricted with several steps not seen in testing
DevOps
problems
Disparity of operations and development work is hard.
- System administrators and operators work on the rhythm of audits, machine problems, user issues
- Developers and testers work on each new feature until it is finished
- People need to be willing to develop into team members, sharing trust, goals, and effort
- Automation requires a lot of creativity and persistence
Sana viikon vaihteeksi
Word for gear of week
Discipline comes from within
Responsibility is a social agreement
Thanks!
-
Ask Questions!
DevOps Finland!
http://www.meetup.com/devops-finland/
Kalle Hallivuori @ Solinor.com
Slides available at http://kato.iki.fi/owasp-pci-devops
owasp-pci-devops-slides by Kalle Hallivuori is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
Images from OpenClipArt.org except DevOps circles from Wikipedia, and some by myself. Iznogoud is a trademark of Edition Tabary (Sarl). Fnord.
