This document discusses a presentation about the journey of migrating applications to the cloud while securing them. It describes challenges with application security and how traditional security tools are not sufficient for modern development environments. It advocates for integrating security into the entire software development lifecycle using an approach called DevSecOps. Specific examples are provided about how SAP Concur integrated Contrast Security's application security platform into their processes and cloud migration to AWS to help shift security left.

1. • Rory McEntee, Director of App Sec, SAP Concur
• Scott Ward, Principal Solutions Architect, Amazon Web Services
• Jeff Williams, Co-Founder & CTO, Contrast Security
A Journey of Chutes & Ladders
Real World Ups and Downs of Migrating
to the Cloud & Securing Applications

2. CONTRASTSECURITY.COM © 2019 COMPANY CONFIDENTIAL
CONTRASTSECURITY.COM © 2019 COMPANY CONFIDENTIAL
THE AVERAGE
APPLICATION IS
EXTREMELY
VULNERABLE
71% unused Libraries
26.7Vulnerabilities
2Vulnerabilities
8% USED Libraries
21% Custom Code
Source: www.helpnetsecurity.com

3. CONTRASTSECURITY.COM © 2019 COMPANY CONFIDENTIAL
3
Source: http://www.ptsecurity.com
YOU ARE
UNDER
ATTACK

4. CONTRASTSECURITY.COM © 2019 COMPANY CONFIDENTIAL
4CONTRASTSECURITY.COM © 2019 COMPANY CONFIDENTIAL
APPSEC MEETS MODERN SOFTWARE:
IMPOSSIBLE ECONOMICS
HUGE RISK
Specialized security staff
More code, faster
applicationstorunthebusiness
time
Security tools budget

5. CONTRASTSECURITY.COM © 2019 COMPANY CONFIDENTIAL
1.Establish work flow
2.Ensure instant feedback
3. Culture of experimentation
1.Establish security work flow
2. Ensure instant security feedback
3. Build a security culture
DEVOPS DEVSECOPS
DEVSECOPS IS VERY PROMISING

6. About SAP Concur
Rory McEntee,
Director, Product Security

7. CONTRASTSECURITY.COM © 2019 COMPANY CONFIDENTIAL
The
Start
Increased
Velocity
Security
Challenge
Secure by
Design
And it
Continues
Our Journey

8. Business Drivers
• Improve security posture
• Maximize developer time with meaningful findings
Technology drivers
• Ease of use is paramount
• SDLC workflow fit is important
• Ability to automate and scale
• Reduce the surprise factor
Economic Driver
• Total cost of ownership is important
Key Drivers

9. CONTRASTSECURITY.COM © 2019 COMPANY CONFIDENTIAL
Limitations of Static & Dynamic tools in a
Modern DevOps World
• Code Scanning
• Whitebox testing
• Point in-time
SAST DAST
Traditional legacy approaches are not enough in today’s environment
• From the Outside
• Blackbox testing
• Expertise required
for test creation

10. CONTRASTSECURITY.COM © 2019 COMPANY CONFIDENTIAL
Provide An Easy Way To Write Secure Code
Greater Accuracy
Integrations
Ability To Scale
Inventory and Secure the Software Supply Chain
Holistic View Custom Code & Libraries
Why We Chose Contrast Security for IAST

11. CONTRASTSECURITY.COM © 2019 COMPANY CONFIDENTIAL
Shifting Security Further to the Left
within the SDLC
“Shift Left”

12. CONTRASTSECURITY.COM © 2019 COMPANY CONFIDENTIAL
• Threat Modeling
• Security Testing
• Triaging
• Developer Education
• Governance & Compliance
Security • Scope
• Design
• Code
• Test
• Release
Development
Collaborative Culture
Shared (security) Responsibility

13. There’s No Silver Bullet to Security

14. Automate
with deeply integrated
security services
Scale with superior
visibility and control
Largest network
of security partners and
solutions
Inherit
global security and
compliance
controls
Highest
standards for privacy
and data security
Move Fast & Stay Secure

15. Business Imperatives
Competing forces
Development
Build it faster
Operations
Keep it stable
Security
Make it secure
D E V O P S
BUILD TEST DISTRIBUTE
MONITOR
Developer
s
Users
D E V S E C O P
S
BUILD TEST DISTRIBUTE
MONITOR
Developer
s
Users
SECURITY
15
Why DevSecOps

16. 16
Pre Commit Commit Acceptance Deploy
 Continuous Compliance 
Threat modeling
Initial *AST inside IDE
Code review
“Break the build“
Compile/build checks
SCA
Container security
Additional *AST
Unit test
Secure infra build
Functional testing
SCA *AST
Unit testing
Security attacks
Detailed *AST
Fuzzing, Pen Tests
Provision runtime
environment
Config management
RASP
SECURITY
COMPLIANCE
CI/CD
DEVOPS
Security & Compliance of the Code in the
Pipeline
Security & Compliance of the Code in the Pipeline

17. Customers have their
choice of security
configurations IN
the Cloud
AWS is responsible
for the security OF
the Cloud
AWS Customers control their own security policy
Shared Responsibility Model

18. Cloud & Security Migration Journey High Points
ANDMove fast Stay secure

19. Recap

20. Next Steps
• CONCUR: https://www.concur.com
• AWS: https://aws.amazon.com/security/
• Contrast Security: https://www.contrastsecurity.com/contrast-community-edition
https://aws.amazon.com/marketplace/pp/B07T9GRPPG

21. Q&A

22. Thank You

23. Chutes & Ladders
PLACEHODER SLIDE
Rory to help provide
content
 Key Stakeholders
 Compliance & Regulations
 Shared Security Responsibility

24. Architecture & Roadmap
Contrast Security TeamServer deployed in AWS

25. Steps to Success – Implementation Roadmap
Train
• Lunch and Learn
• Onsite Training
• KPIs and Reporting
• Vulnerability
Management
Workflow with CTE
• Current & Future
state workflow
mapping
Scale
• CI/CD integration
• Automatic ticket
creation
• Instrument Chorus
DT and TMC
services
• Leverage OSS
• Developer Training
Systematize
• CI/CD integration
• Vulnerability
Management for the
next apps
• Deliver Policy
Compliance
Reporting
• Developer Training
Replicate
• Onboard next in line
apps
• OSS
• Developer Training
Jun
May
Apr
Build
• TeamServer
Implementation
• Single Sign On
• CTE App on
Faraday cloud
instrumented
• Jira Integration
• Launch Internal
Collateral
Mar
Done

26. Maybe slide About Concur’s journey to
AWS comes here?

27. Contrast and Faraday
Post provisioner
• Downloads Contrast .NET agent from Artifactory
• Sets up config files
• Runs Contrast .NET agent installer

28. Contrast and Faraday
Post provisioner
• Downloads Contrast .NET agent from Artifactory
• Sets up config files
• Runs Contrast .NET agent installer

29. 29
4. SECURE BY DESIGN