LONDON 18-19 OCT 2018
Enabling shift-left for 12k banking
developers from scratch and
without breaking the bank
ERNESTO BETHENCOURT

LONDON 18-19 OCT 2018

LONDON 18-19 OCT 2018
Ernesto Bethencourt
Product Owner for Chimera

LONDON 18-19 OCT 2018

LONDON 18-19 OCT 2018
Source: https://www.bbva.com/en/corporate-information/the-transformation-of-bbva/

LONDON 18-19 OCT 2018
*12k Developers

LONDON 18-19 OCT 2018
Key Elements For This
Transformation
• Internal talent
• End-to-end automation
• DevOps “philosophy”
• API and obsession to reuse
• Global communities

Ether is BBVA’s global banking platform, which allows developers to easily build, deploy and
operate banking services of any kind by leveraging cloud
Global Cloud Services
Automation
Open Source &
Vendor decoupling
Developer centric
Hybrid cloud
Reliability /Operability

LONDON 18-19 OCT 2018

LONDON 18-19 OCT 2018

LONDON 18-19 OCT 2018

LONDON 18-19 OCT 2018

LONDON 18-19 OCT 2018
What are we doing?
• SECaaS, part of the New Platform
• BBVA Labs Advance Security
• ACS (for Legacy Platform)
• Cultural Change (Tribes/Clans)

LONDON 18-19 OCT 2018
Security As A Service (SECaaS)
BBVA’s SECaaS is one of the main Cloud
components composing Ether.
SECaaS builds on the concept that Security
can be provided on demand to the user
SECaaS provides a security embedded by
default.

LONDON 18-19 OCT 2018
SECaaS Objectives 4 SDLC
• Early Security Feedback for Developers
(Shifting Left)
• Security Feedback also must be “aaS”
• Automate Security Checks & Enforcement

TOOLS! TOOLS EVERYWHERE! DEVELOP A PRODUCT

CHIMERA

LONDON 18-19 OCT 2018
Since 2016!
Slides: https://www.rsaconference.com/writable/presentations/file_upload/asd-f01-security-as-a-service-in-a-financial-institution-reality-or-chimera.pdf

SELF-SERVICE 4 DEV TEAMS SERVICES 4 SECURITY TEAMS

LONDON 18-19 OCT 2018
Our Vision
• Abstraction of Security “Solutions”
• Orchestration
• Added Value
CHIMERA
disclaimer: vendors logo used as an example only that we want our developers to know Chimera and not Vendors

LONDON 18-19 OCT 2018
In-take Triage Test Deliver
DevSecOps “Foundations”
Static Black-box “Manual”
DevSecOps
Analytics
Blue Team
Services
Security
Provision
DevSecOps
Threat Model
Auto-Enrollment
Continuous
Monitoring
Governance
Added Value
Services
Continuous Feedback
& Optimization
Our long term “Services” proposal

LONDON 18-19 OCT 2018
SECURITY TOOLS
CI Pipelines (i.e: Ether Pipelines)
CHIMERA
Security Code Review Docker Images Review Secrets Review
Current Status
BANDIT GECRETS
In-take Analytics

LONDON 18-19 OCT 2018
4 Devs Teams
CI Pipelines (i.e: Ether Pipelines)
Docker Images
Review
CHIMERA
Orchestrations +
Added Value

LONDON 18-19 OCT 2018
Developers can access and use this
information on their pipelines and in
Ether’s Console

LONDON 18-19 OCT 2018
4 Sec Teams
CI Pipelines (i.e: Ether Pipelines)
Docker Images
Review
CHIMERA
“Security Seal”Orchestrations
AUTOMATIC!

LONDON 18-19 OCT 2018

LONDON 18-19 OCT 2018
BBVA Labs - Advanced Security Labs
• “Working how to adapt security processes from the risk analysis to the
security operation in the Cloud and DevOps worlds, researching and
developing concept tests that can be converted into open source tools”
• Example Public Research:
• https://www.bbva.com/en/vulnerability-management-in-dependencies-in-ci-cd-
environments-with-open-source-tools/

LONDON 18-19 OCT 2018
Example of our Public Work
https://github.com/BBVA/gitsechttps://github.com/BBVA/deeptracy https://patton-server.readthedocs.io/en/latest/

LONDON 18-19 OCT 2018
Deep Tracy + Patton

LONDON 18-19 OCT 2018

LONDON 18-19 OCT 2018
ACS – (Continuous Security Analysis)
• Blue Team’s Service
• BBVA’s Worldwide Service
• Free for all BBVA’s projects
• Manual, APIs and Jenkins library options for
integrations
• Compliance compatible for some projects
• Manual results processing by blue team member

LONDON 18-19 OCT 2018
Current Process
Secure
SDLC
Source
Repository
Build
Management
Code
Analysis
Result
Triage
Publish
Results
Developer
Feedback

LONDON 18-19 OCT 2018
Culture
Tribes and Clans

LONDON 18-19 OCT 2018

LONDON 18-19 OCT 2018
Next Steps (2019)
• Chimera Triage and DAST MVPs
• Chimera – ACS Integrations
• BBVA Labs Tools in Chimera
• DevSecOps Ninja and TechU Tracks
• Security Champions Pilot Programs

LONDON 18-19 OCT 2018

LONDON 18-19 OCT 2018
[https://www.bbvanexttechnologies.com/]