Continuous Security

•

4 gostaram•1,080 visualizações

Talk given by Phil Parker (Partner at Equal Experts) at London Continuous Delivery Meetup hosted at Financial Times, Monday 23rd May, 2016.

Software

@parker0phil
How do we achieve Security in a
Continuous Delivery environment?

@parker0phil
3. Continuous Delivery IS MORE secure!

@parker0phil
2. Continuous Delivery IS MORE secure!

@parker0phil
1. Continuous Delivery IS MORE secure!
Mean
Time to
Detect
(MTTD)
Mean
Time to
Resolve
(MTTR)
RELEASE
FIND
VULN
FIX
VULN
Attack Window
MTTD MTTE

@parker0phil
Continuous Delivery
IS MORE secure!

@parker0phil
2. Thinking about Security
Exploitability Impact

@parker0phil
1. Thinking about Security
1. Rely on developers and testers more than security
specialists.
2. Secure while we work more than after we’re done.
3. Implement features securely more than adding on
security features.
4. Mitigate risks more than fix bugs.

@parker0phil
Encoding Hashing
Encryption Signing
Pet Hate #2
b2JmdXNjYXRpb24=
%3Cscript%3Ealert(0)
%3C%2Fscript%3E
Integrity +
Non-repudiation
Confidentiality

@parker0phil
3. Enumeration of Usernames

@parker0phil
2. Unvalidated Redirects
?queryString=param
Cookie:value
Persisted

@parker0phil
1. Cross-Site Request Forgery (CSRF)

@parker0phil
Continuous Delivery IS MORE secure
How we achieve Security in a CD environment
Mental Models for Security
Pet Hates
My Favourite attacks

Mais conteúdo relacionado

Mais procurados

Google penguin 3.0Arun Mohapatra

IGSTK: Building High Quality Roads with Open Source Software-9300Kitware Kitware

Sucuri Webinar: Is SSL enough to secure your website?Sucuri

LavaCon 2017 - Making a Quantum Shift in Structured AuthoringJack Molisani

Finding Hazards Using Washing State Hazard Zone CchecklistMathesonWorkSafe

Hacking WordPress... and countermeasures.Nestor Angulo de Ugarte

Naswiz perfect appdhekanenandkishor

Mais procurados (7)

Google penguin 3.0

IGSTK: Building High Quality Roads with Open Source Software-9300

Sucuri Webinar: Is SSL enough to secure your website?

LavaCon 2017 - Making a Quantum Shift in Structured Authoring

Finding Hazards Using Washing State Hazard Zone Cchecklist

Hacking WordPress... and countermeasures.

Naswiz perfect app

Semelhante a Continuous Security

Maturing DevSecOps: From Easy to High ImpactSBWebinars

Continuous Security: 5 Ways DevOps Improves SecuritySonatype

Cybersecurity: A game of innovationW2O Group

Anastasia Vixentael - Don't Waste Time on Learning Cryptography: Better Use I...OWASP Kyiv

S TECHNOLOGY Product/ Services Presentation Sameer Padwal

Webinar: Insights from CYREN's 2015-Q3 Cyber Threat ReportCyren, Inc

Splunk Webinar: Splunk App for Palo Alto NetworksGeorg Knon

Cybercrime and the developer 2021 styleSteve Poole

SharePoint Fest Denver - Practical Tools and Techniques for the SharePoint Bu...Richard Harbridge

Multipathed, Multiplexed, Multilateral Transport Protocols - Decoupling trans...APNIC

Cyber Security Dr Sally ErnstCissy Ma FCPA GAICD

Getting Started with Splunk Hands-onSplunk

[Webinar] Why Security Certification is Crucial for IoT SuccessElectric Imp

Robert Hurlbut - Threat Modeling for Secure Software Designcentralohioissa

Opsec for security researchersvicenteDiaz_KL

LeadDev NYC 2022: Calling Out a Terrible On-call SystemMolly Struve

Liran tal Stranger Danger Security vulnerabilities - Negev Web Developers mee...Liran Tal

Think horizontally - Giuliano and De DonatoCodemotion

Disruptive Product Positioning with A/B TestingOptimizely

SplunkLive! Utrecht - Splunk for Security - Monzy MerzaSplunk

Semelhante a Continuous Security (20)

Maturing DevSecOps: From Easy to High Impact

Continuous Security: 5 Ways DevOps Improves Security

Cybersecurity: A game of innovation

Anastasia Vixentael - Don't Waste Time on Learning Cryptography: Better Use I...

S TECHNOLOGY Product/ Services Presentation

Webinar: Insights from CYREN's 2015-Q3 Cyber Threat Report

Splunk Webinar: Splunk App for Palo Alto Networks

Cybercrime and the developer 2021 style

SharePoint Fest Denver - Practical Tools and Techniques for the SharePoint Bu...

Multipathed, Multiplexed, Multilateral Transport Protocols - Decoupling trans...

Cyber Security Dr Sally Ernst

Getting Started with Splunk Hands-on

[Webinar] Why Security Certification is Crucial for IoT Success

Robert Hurlbut - Threat Modeling for Secure Software Design

Opsec for security researchers

LeadDev NYC 2022: Calling Out a Terrible On-call System

Liran tal Stranger Danger Security vulnerabilities - Negev Web Developers mee...

Think horizontally - Giuliano and De Donato

Disruptive Product Positioning with A/B Testing

SplunkLive! Utrecht - Splunk for Security - Monzy Merza

Mais de Equal Experts

TRUST Framework Talk 2023-03-10.pptxEqual Experts

Will it matter if your child cannot code?Equal Experts

Platform Security IRL: Busting Buzzwords & Building BetterEqual Experts

Software development practices & Infrastructure as Code - how well do they wo...Equal Experts

A Whole Team Approach to Quality in Continuous Delivery - Lisa CrispinEqual Experts

Secure Continuous DeliveryEqual Experts

Smoothing the continuous delivery path a tale of two architectures - expert...Equal Experts

Embracing collaborative chaos (April 2020) by Lyndsay PrewerEqual Experts

Design Systems: Designing out Waste, Designing in ConsistencyEqual Experts

Growing Together - software development in the Developing worldEqual Experts

Infrastructure - a journey from datacentres to cloudEqual Experts

Data Science In Action: Prenatal Screening for Down SyndromeEqual Experts

The essentials of the IT industry or What I wish I was taught about at Univer...Equal Experts

Secrets of an agile transformationEqual Experts

Obstacles of Digital Transformation EvolutionEqual Experts

Avoiding the security brickEqual Experts

Embracing collaborative chaosEqual Experts

Continuous SecurityEqual Experts

Organising for Continuous DeliveryEqual Experts

Cracking passwords via common topologiesEqual Experts

Mais de Equal Experts (20)

TRUST Framework Talk 2023-03-10.pptx

Will it matter if your child cannot code?

Platform Security IRL: Busting Buzzwords & Building Better

Software development practices & Infrastructure as Code - how well do they wo...

A Whole Team Approach to Quality in Continuous Delivery - Lisa Crispin

Secure Continuous Delivery

Smoothing the continuous delivery path a tale of two architectures - expert...

Embracing collaborative chaos (April 2020) by Lyndsay Prewer

Design Systems: Designing out Waste, Designing in Consistency

Growing Together - software development in the Developing world

Infrastructure - a journey from datacentres to cloud

Data Science In Action: Prenatal Screening for Down Syndrome

The essentials of the IT industry or What I wish I was taught about at Univer...

Secrets of an agile transformation

Obstacles of Digital Transformation Evolution

Avoiding the security brick

Embracing collaborative chaos

Continuous Security

Organising for Continuous Delivery

Cracking passwords via common topologies

Último

%in ivory park+277-882-255-28 abortion pills for sale in ivory park masabamasaba

CHEAP Call Girls in Pushp Vihar (-DELHI )🔝 9953056974🔝(=)/CALL GIRLS SERVICE9953056974 Low Rate Call Girls In Saket, Delhi NCR

Define the academic and professional writing..pdfPearlKirahMaeRagusta1

How To Troubleshoot Collaboration Apps for the Modern Connected WorkerThousandEyes

Software Quality Assurance Interview QuestionsArshad QA

Sector 18, Noida Call girls :8448380779 Model Escorts | 100% verifiedDelhi Call girls

AI & Machine Learning Presentation TemplatePresentation.STUDIO

call girls in Vaishali (Ghaziabad) 🔝 >༒8448380779 🔝 genuine Escort Service 🔝✔️✔️Delhi Call girls

ManageIQ - Sprint 236 Review - Slide DeckManageIQ

+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...Health

OpenChain - The Ramifications of ISO/IEC 5230 and ISO/IEC 18974 for Legal Pro...Shane Coughlan

Direct Style Effect Systems -The Print[A] Example- A Comprehension AidPhilip Schwarz

%in kempton park+277-882-255-28 abortion pills for sale in kempton park masabamasaba

Pharm-D Biostatistics and Research methodologyAnusha Are

%in tembisa+277-882-255-28 abortion pills for sale in tembisamasabamasaba

call girls in Vaishali (Ghaziabad) 🔝 >༒8448380779 🔝 genuine Escort Service 🔝✔️✔️Delhi Call girls

Chinsurah Escorts ☎️8617697112 Starting From 5K to 15K High Profile Escorts ...Nitya salvi

W01_panagenda_Navigating-the-Future-with-The-Hitchhikers-Guide-to-Notes-and-D...panagenda

BUS PASS MANGEMENT SYSTEM USING PHP.pptxalwaysnagaraju26

VTU technical seminar 8Th Sem on Scikit-learnAmarnathKambale