Practical DevOps Security

In this video you will see how digitalization and adoption of  agile and DevOps practices has changed the way we create software. The  traditional techniques of Security verification are simply not adequate  for this new paradigm.                         

• Explore Shift-Left Security checks and verifications

• Learn about AppSec Pipelines

• Know more about consistent processes

This video covers the best practices for automating different types of security tests.                         

• Know that application security solutions need to evolve with changing times

• Learn about the application security need that has been intensified with increasing risks

• Build a comprehensive automated security testing strategy

This video showcases the various tools which are available for performing different types of security tests and scans.                         

• Choose appropriate tools from different open source and commercial options

• Explore the tools introduced by OWASP

In this video you will see the importance of Red and Blue teams,  which are two distinct teams of security professionals who are all  working for the betterment of the company, but doing it in opposing  ways.                         

• Approach to test resilience against any attack

• Learn the two-pronged strategy to attack and defend

• Perform an exercise to provide opportunity to challenge organization’s defenses realistically 

In this video you will see how proper planning is quite crucial to address security requirements.                         

• Define proper functional and non-functional requirements.

• Take the first step which is to identify all the risks

• Explore the security user stories for various stakeholders - User, Admin, Business Owner

In this video you will see how to take care of security principles during design and architecture phase.                         

• Get to think about security from architecture phase

• Identify the core pillars of secure architecture - Confidentiality, Integrity, Availability

• Follow best practices for a secure architecture

This video shows how to apply the techniques of threat modelling,  data flow diagrams and attack surface to build a secure and robust  design. This would lay the foundation of a secure software.                         

• Identify the important assets and protect them

• Learn the iterative process from design and throughout the application life-cycle

• Learn about STRIDE model

This video explores the importance of proper Identity and access  management to allow only authorized users to access the system and  resources.                         

• Create, maintain, and use digital identities

• Learn the major steps for inventory management– Define, Map, Assign

• Manage identity and access across different phases – Discover, Harvest, Refine.

This video demonstrates the significance of performing code  reviews in order to discover vulnerabilities and security related  weaknesses.                         

• Augment standard code review practice with security considerations

• Secure code reviews look for software weakness early on

• Check for areas more prone to weaknesses

The aim of this video is to learn about the security hardening.                         

• Explore the importance of hardening

• Study the hardening lifecycle

• Take a look at the different automation tools

In this video you will see how Static Application Security Testing  helps in finding vulnerabilities earlier in the development cycle.                         

• Analyze software during coding and unit testing phase

• Scan source code and look in binaries and configuration files

• Judiciously chose static analysis tools to perform static application testing

In this video you will see how to perform Static Application Security Testing by embedding SonarQube into CI/CD pipeline.                         

• Demonstrate static analysis testing

• Explore the use of WebGoat, a deliberate vulnerable application

• Learn about SonarCloud

This video explorers how Dynamic Application Security Testing helps in finding vulnerabilities on a running application.                         

• Analyze running application for weaknesses

• Learn about black-box testing where attacks are performed on running application

• Judiciously chose dynamic analysis tools to perform dynamic application testing

In this video you will see how to perform Dynamic Application  Security Testing by embedding Zed Attack Proxy into CI/CD pipeline.                         

• Demonstrate dynamic analysis testing

• Explore the use of WebGoat, a deliberate vulnerable application

• Know more about ZAP

This video showcases newer techniques of performing Security Analysis Testing.                         

• Instrument code for performing novel security testing and protection

• Use IAST to detect vulnerabilities in a running application

• Use RASP to prevent vulnerabilities from being exploited

In this video you will see how to audit the open-source components being used in any application.                         

• Make sure that the safe and secure open-source components are being used

• Track usage of OSS components

• Set up policies around vulnerability management and license compliance

In this video you will see how configuration of infrastructure should be secured.                         

• Identify and mitigate risks to infrastructure configuration

• Follow best practices - Isolation, Firewall and Identity based access

• Use Docker container for a safe and secure environment

In this video you will see how key management and identity management provides safe access to your applications.                         

• Explore management of encryption keys through their entire lifecycle

• Use KMS to provide organization exclusive custody of encryption keys

• Use identity management to control user information

In this video you will see how companies like Netflix continuously  test their production environment with various kinds of chaos. You will  also see how fuzz testing can be used to expose system vulnerabilities  against malicious input.                         

• Provide seamless service in distributed / cloud computing environment

• Simulate production environment with various failure scenarios

• Learn about the fuzzing technique

In this video you will see how a system should be monitored for security related incidents.                         

• Leverage both security information and event management

• Monitor for violations and assign distinct categories

• Know what the judiciously chosen metrics provide

In this video you will see the benefits of good Governance practices and regular audits.                         

• Manage organization's overall governance, risk management and compliance with regulations

• Track metrics across application security process, risk and SDLC

• Learn more about regular audits

In this video you will see how to respond to security incidents  and perform digital forensics to contain the impact and prevent future  incidents.                         

• Learn about having a proper incident response emergency plan

• Aim to prevent incidents by identifying trends in the adversary community

• Learn that Proper Incident Response minimizes losses and mitigates the exploited weakness