implementing an application security pipeline in jenkins

Post on 07-Jan-2017

445 Views

Category:

Software

1 Downloads

Preview:

Click to see full reader

TRANSCRIPT

Implementation an Application Security Pipeline in Jenkins

• Introduction• Continuous Integration • Application Security Pipelines• Approaches in Jenkins• Demo

About me

Software Security Professional having 10+ years of experience

Specialize in Secure SDLC implementation Threat Modeling/Secure Code Review/Penetration Continuous Security Testing Secure Coding Trainer, SecurityQA Testing Trainer Speaker DevSecOps Singapore & Null Singapore

What next for me ? IoT Security

Continuous Integration

Master

Branch1

Compile

Test Publish

Deploy

Build

GitHub Jenkins Dev Deploy

Open Source Libraries

Application Security Pipeline

DEVELOPMENT

BUILD AND DEPLOY STAGINGREQUIREMEN

TS

External Repositori

esCommon Components

DESIGN

Repository

SCM Tools

Security Test Automation

Threat Modeling

SCA Tools/IDE Plugins

VS/PT/IASTComponents Monitoring

PRODUCTION

Monitoring

What we need ?

People

TechnologyProcess

• People Training Role

• Process Compliance Certifications

• Technology Security tools Dev tools

Education

• Traditional Training • Shorter training duration• Modular • Hands-on • Challenges• Scoring

• Rugged Software “Rugged” describes software development organizations which have a

culture of rapidly evolving their ability to create available, survivable, defensible, secure, and resilient software.

• BSIMM The Building Security In Maturity Model (BSIMM, pronounced “bee simm”) is

a study of existing software security initiatives. By quantifying the practices of many different organizations, we can describe the common ground shared by many as well as the variation that makes each unique.

• OWASP SAMM Evaluate an organization’s existing software security practices Build a balanced software security assurance program in well-defined

iterations Demonstrate concrete improvements to a security assurance program Define and measure security-related activities throughout an organization

Software security centric process, standards & approaches

Choose the right tools

IDE Plugins

SAST/Dependenci

es check

• CI/CD Supports• Scalability• Scan time• Incremental

Report• False Positives• Custom Rules

Set• Language

Supports• Plugins

DAST

• API Calls• Scalability• Scan Policies• Plugins

Security Unit test

CasesIAST

• Less False Positives

• Monitor Traffic• Along with QA

testing

• Immediate Feedback

• Threat Modelling

Secure Coding Training

Jenkins Application Security Pipeline

• Configuration as Code• Jenkins Plugin

Plugins

Github Delivery Pipeline Build Pipeline OWASP Dependency-Check Plugin HP Fortify Jenkins Plugin OWASP ZAP Plugin Sonatype CLM for CI plugin

Feedback loop

SAST

DAST

SecurityQA

VS/Fuzzing

IAST

02468

10

Analytics DB

Security metrics template

http://www.sumansourav.com

Thank you

top related