GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deployment Firewall and DBOM

Effective Application Security in Software Delivery lifecycle using Deployment Firewall and DBOM

The modern software delivery process (or the CI/CD process) includes many tools, distributed teams, open-source code, and cloud platforms. Constant focus on speed to release software to market, along with the traditional slow and manual security checks has caused gaps in continuous security as an important piece in the software supply chain. Today organizations feel more susceptible to external and internal cyber threats due to the vast attack surface in their applications supply chain and the lack of end-to-end governance and risk management.

The software team must secure its software delivery process to avoid vulnerability and security breaches. This needs to be achieved with existing tool chains and without extensive rework of the delivery processes. This talk will present strategies and techniques for providing visibility into the true risk of the existing vulnerabilities, preventing the introduction of security issues in the software, resolving vulnerabilities in production environments quickly, and capturing the deployment bill of materials (DBOM).

Speakers:

Bob Boule

Robert Boule is a technology enthusiast with PASSION for technology and making things work along with a knack for helping others understand how things work. He comes with around 20 years of solution engineering experience in application security, software continuous delivery, and SaaS platforms. He is known for his dynamic presentations in CI/CD and application security integrated in software delivery lifecycle.

Gopinath Rebala

Gopinath Rebala is the CTO of OpsMx, where he has overall responsibility for the machine learning and data processing architectures for Secure Software Delivery. Gopi also has a strong connection with our customers, leading design and architecture for strategic implementations. Gopi is a frequent speaker and well-known leader in continuous delivery and integrating security into software delivery.

1. ©} Opsmx
Delivery to Deployment
Application Security ,

—

May 2024

2. = Ship Better Software Faster

7% OpsMx

OpsMx secures and intelligently automates software delivery
from developer to deployment, building on an
Open Software Delivery architecture and Al/ML-powered DevSecOps

QUE A O =
lel Google RE FAN Adobe ZE,

3. = OpsMx Delivery Shield

OpsMx Delivery Shield secures your application
lifecycle with continuous security posture
management, global visibility, and policy
enforcement.

AppSec Today
+ Too many tools that don't work together
e Disjointed data - no unified view
e “Shift Left” slowing down developers

OpsMx Offers
+ Faster, more secure application releases
e Automated compliance and enforcement
e Lower overall cost of AppSec

7 OpsMx

Security App Dev DevOps
OpsMx Delivery Shield

Application Security Posture Management

bata eco ooops Toe |

“an tect

Software Development Lfecycie

4. = Managing Application Security
In a DevOps World

à 2: BUILD -8- DEPLOY |-»[ OPERATE |

7% OpsMx

Old World

+ Centralized teams

+ Consistent Dev environment
Monolithic applications

« One path to production

5. = Managing Application Security 7% OpsMx
In a DevOps World

New World

= e Distributed development teams

a. ® Service-based architecture
= © Frequent releases to multiple targets
= e Teams choose DevOps tools

« Shift left security responsibilities

6. = Managing Application Security FX OpsMx
In a DevOps World

Service-based architecture
Frequent releases to multiple targets
Teams choose DevOps tools

Shift left security responsibilities

7. = AppSec Challenges We Hear

=s “Choose Your Own Adventure”
— Every team is using different
=e

— tools, different processes

Siloed Visibility

We have all the data that we
need, but it is siloed in separate
tools and data sets

fe)

80

Too Many Alerts

Each tool generates its own
alerts, but no rationalization
across them

7% OpsMx

Every Tools Adds Cost, Complexity
How can | stop paying for some
of the tools that | pay for today?

Overloaded Developers
“Shift Left” overloads
developers without reducing
security risks

Security Effectiveness

No good way to show the
overall results of the security
program.

8. = Challenges Addressed by OpsMx #YopsMx

SecOps / DevOps CISO / Exec Mgmt

+ Detect, prioritize, e = Shift-left without « Global security
remediate security burdening developers visibility
threats e Fits in the existing e Audit reports with

e Automated checks / SDLC workflow compliance checklist
controls e Security / fix e Easy to implement with

e Shift-left security recommendations to existing tools, central

e Blocks vulnerable Developers management
deployments + Developer visibility and e Lower TCO

+ Continue to leverage productivity + Eliminate tool sprawl

existing tools / Reduce tools license
workflows costs

9. Security Policy Management

d Archi

7% OpsMx

El Bill of Materials

itomation

Security Posture Evaluatio

"Developer to Deployment” Lifecycle Visibility

à ee. BUILD

DEVELOPER
bernoences (9

10. = OpsMx Benefits

Faster Application Releases
Only manage security exceptions,
automate everything else

More Secure Applications
Broad end-to-end data drives more
comprehensive risk assessment

Productive “Shift Left"
Developer-friendly visibility and
guidance to close security gaps

G
A

FM OpsMx

Lower Cost of AppSec
Improve team efficiency, reduce
redundant tools, leverage open source

Automated Compliance
Automated policy enforcement,
automated audit reporting

Global Security Visibility
See what is really happening
across tools & teams in one place

11. ©} OpsMx

Delivery Shield
Product Capabilities

12. = OpsMx Delivery Sheild Capabilities 7 OpsMx

Application Lifecycle Visibility
+ Real-time, end-to-end, Developer to Deployment
+ Auto-discovered, synthesized, stored in SDLC
+ Powered by 90+ DevOps integrations Security Posture Evaluation
Evaluated against industry, organization policies
Security of release artifacts, artifact provenance
CVE scans and posture
Deployment target configuration, IAC
Compliance with delivery process steps

Incident Response
e Monitor for new vulnerabilities

+ Trace CVEs in production Application
© Detect drift in security posture Security
Posture Mgmt.

Policy Enforcement
+ Automated approvals, release verification
+ Option to use Deployment Firewall to block
out-of-compliance releases
+ Policy exception tracking and management

Software Delivery Audit & Compliance
+ Full audit, automated compliance reporting
+ Delivery Bill of Materials (DBoM)

13. = SDLC Tracking: Representative Data Set 7% OpsMx

“Developer to Deployment” view of the application lifecycle - all available in one place

+ DEPLOY

e Build tool

Artifact i
Ñ paar e A Tepe ae Ra
e Build approvers report Kubernetes service
e Dependency CIS benchmarks

validation

14. Real-Time Risk Assessment 7% OpsMx

tr:

15. Deployment Firewall 7% OpsMx

Real-time, policy-driven evaluation of deployment policies across dev, test, staging, and
production environments

16. = Delivery Bill of Materials 7% OpsMx

Comprehensive, consolidated record of the application delivery and deployment process

Delivery Bill of Materials

SBoM + Delivery and Deployment Process
Approvals

Security posture

Policy checks

Policy exceptions

Build process

Test results

Captured at time of Deployment
Preserved for future audit / compliance

17. (2 0psMx

Demo

18. ©} OpsMx

Thank You

Contact: [email protected] Visit: www.opsmx.com