Ground Truths of a Rugged DevOps Practitioner

on YouTube ↗53m

" summary

Draws on Rackspace operations to argue traditional week‑long security windows are gone — one team averages 75 deploys/week — and replaces them with automated, repeatable checks: config management reviews (Chef/Puppet/Ansible/Salt), CI hooks (Jenkins check-in hook), static and dynamic tooling (Veracode, Nessus, Burp, Gauntlet), API scaffolding for OpenStack, and lightweight agents (CloudPassage/OSSEC) as an agent-as-narc. Ends with workflow specifics: findings go into ThreadFix/bug trackers, SLAs require remediation plans, report‑as‑code generation, and organic test growth.

AI-written summary · about

" chapters (9)

1. 0:00Start
2. 1:15Ground Truths of a Rugged DevOps Practitioner
3. 3:50THE SOLUTION - Automated software testing • Automated operational infrastructure - Automated security testing
4. 15:30Hook provisioning for post deploy review - Focus on checking for code compliance
5. 21:15Work with developer teams to submit bugs • Security category needs to exist Bonus points if the bug tracker has an API • Security issues are now part of the normal workflow
6. 25:09Reports = Findings + Automation . Consider markup for findings - Markdown, Wiki Text, asciidoc • Pandoc to convert to whatever - HTML, PDF, .doc, .odt,... • Keep testers writing the least possible • Template and re-use boiler plate items - New finding == new template for next time
7. 30:24Start with the developers • Finding details have to be detailed enough to: - Reproduce the issue after 6 months . Allow SecurityIQE to test the issue . Allow developers to find/tix the issue • Consider quick and dirty scripts to reproduce issue
8. 37:02What is Rackspace's Security Engineering doing?
9. 42:19"Whosoever desires constant success must change his conduct with the times." - Niccolo Machiavelli

" related talks

• 45mLessons From DevOps: Taking DevOps Practices Into Your AppSec LifeMatt Tesauro · OWASP AppSec Research (AppSecEU) 2015
• 34mDevops or: How I Learned to Stop Worrying and Love the Ops TeamMike Crute · PyOhio 2012
• 36mImproving Security while Reducing Toil with DevSecOpsPaul C Czarkowski · KubeCon + CloudNativeCon China 2019
• 58mWhy Infosec Needs Rugged DevOps Now: A Study Of High Performing IT OrganizationsGene Kim · AppSec California 2014
• 39mThe Path Of DevOps Enlightenment For InfoSecJames Wickett · OWASP AppSec California 2018
• 32mAdopting the right DevOps Tools for you and your teamMatt Makai · Devoxx US 2017
• 36mThe Road To Being RuggedShannon Lietz · GOTO London 2015
• 31mDevOps: You Build It, You Secure ItJohn Willis · DevOps Enterprise Summit San Francisco 2017