Talk given by Phil Parker (Partner at Equal Experts) at ExpertTalks Berlin, 14th June 2018. Running a build server does not mean you are *doing* Continuous Delivery. An OWASP Top 10 poster on the wall does not mean you are *doing* Information Security. This talk explores what the real important factors of Continuous Delivery are, does the same for Information Security and then focusses in on how the two intersect and interact. Developers, testers, ops (and anyone else working on tech teams) will learn why Continuous Delivery is actually MORE secure than the alternatives.

1. CONTINUOUS
SECURITY

2. CONTINUOUS
DELIVERY
INFORMATION
SECURITY
1 2
3
CONTINUOUS SECURITY

3. @parker0phil
Continuous Delivery
1

4. Continuous DeliveryContinuous Delivery
“a ready feature can be
put in front of real customers
at little notice,
with no panic”

5. Continuous DeliveryContinuous Delivery *
“When speed and stability
satisfy business demand.”
* See also:
Discontinuous Delivery

6. Continuous Delivery
“speed and stability”
Shorter
Cycle Time
Smaller
Batch Size
“a ready feature…
no panic”

7. Batch Size
Quantity (and complexity) of a
single unit of production
deployment.

8. ✗ ✓
@parker0phil
(Smaller) Batch Size

9. Cycle Time
Wait time between an idea
(hypotheses) of a piece of value
and that value being in
production, used by a real
customer.

10. @parker0phil
(Shorter) Cycle Time
✗
✓

11. How do we get Continuous Delivery?
a close, collaborative
working relationship
between everyone
involved in delivery
extensive
automation of all
possible parts of
the delivery
process

12. @parker0phil
2
Information Security

13. (Information) Security
“defence of computers and servers, mobile devices, electronic
systems, networks and data from malicious attacks”
“preventing unauthorized access to computers, networks
and data”
“protection of systems, networks and data in cyberspace”

14. “You can't defend. You can't
prevent. The only thing you can
do is detect and respond.”
- Bruce Schneier

15. Information Security
Managing the risk of
unauthorised impacts to the
confidentiality, integrity or availability
of systems and data.

16. Information Security
Protecting
Users

18. CVSS
Exploitability Impact

19. Security
Development
Lifecycle
Spoofing
Identity
Information
Disclosure
Elevation of
Privilege
Repudiation
S T R I D E
Tampering
with Data
Denial of
Service

21. @parker0phil
Continuous Delivery
is Secure
3

22. @parker0phil
Continuous Delivery
IS MORE Secure!
3

23. Smaller Batch Size

24. 1
Isolation of Cause and Effect
15

25. Shorter Cycle Time

26. Mean
Time to
Detect
(MTTD)
Mean
Time to
Resolve
(MTTR)
RELEASE
FIND
Vulnerability
FIX
Vulnerability
Attack Window
Mean Time to Detect
(MTTD)
Mean Time to Exploit
(MTTE)

27. extensive
automation of all
possible parts of
the delivery
process
How do we get Continuous Delivery?

28. “… we move too fast for there to be time for reviews
by the security team beforehand.
That needs automation, and it needs to be integrated
into your process. Each and every piece should get
security integrated into it … before and after being
deployed.”
- Werner Vogels

30. Dependency
Checking

32. Dependency
Checking
Static Analysis
Security Tests
(Checks)
Scanning

33. Dependency
Checking
Static Analysis
Security Tests
(Checks)
Scanning

35. a close, collaborative
working relationship
between everyone
involved in delivery
extensive
automation of all
possible parts of
the delivery
process
How do we get Continuous Delivery?

36. “Security is everyone’s job now, not just the security
team’s. With continuous integration and continuous
deployment, all developers have to be security
engineers, we move too fast for there to be time for
reviews by the security team beforehand.
...”
- Werner Vogels

37. EE Secure Delivery Playbook Principles
Security should be:
1. Collaborative
2. Continuous
3. Contextual

40. CONTINUOUS SECURITY
THANK YOU!