Securing Your Deployment Pipeline With Docker

Securing your Deployment Pipeline Strategy & Tech Talk - April 19, 2016

Maximilian Schöfmann | @schoefmann

Container Solutions Switzerland

www.container-solutions.com | [email protected]

B.C. (Before Continuous Integration)


B.C. (Before Continuous Integration)

homoabap-cobolusintegratingsoftwaremodules,ca.200000B.C


A.D. - but Pre-DevOps (CI only)


DevOps (present time)


DevOps + Continuous Delivery + PaaS


… and Security


Avg: 103 days to fix a vulnerability

http://darkmatters.norsecorp.com/2015/06/09/security-vulnerabilities-take-average-of-103-days-to-remediate/


CD improves reaction time!


So we need to:


…with better tooling!


Stages of a delivery pipeline

Commit Integration Acceptance Release




unit tests




unit tests service tests




unit tests service tests UI tests




unit tests service tests UI tests (exploratory tests)


Test pyramid

Unit Tests

Service Tests

UI tests

fast

er fe

edba

ck

conf

iden

ce

coverage


“AppSec Pipeline”







static codeanalysis





static codeanalysis

vulnerability scanning





static codeanalysis


end-to-end security tests





static codeanalysis


end-to-end security tests

(penetration tests)


AppSec pyramid?

static code analysis


E2E security tests

fast

er fe

edba

ck

conf

iden

ce

coverage


Challenge: False Positives

• maintain exception/fine tuning config for scanner

• run with sensitive heuristics nightly, then update config

• or branch to manual stage to check false positives


Static analysis

• SonarQube (multiple languages)

• Brakeman (Ruby/Rails)

• OWASP WAP (PHP)

• FindBugs (Java)

• FlawFinder (C/C++)

• … (many commercial, e.g. CHECKMARX)


Vulnerability scanners (many commercial)

• OWASP Zed Attack Proxy (ZAP)

• Burp suite

• Acunetix

• Nessus, OpenVAS

• Nikto

• w3af

• … (lots and lots more)


End to end security tests

• Standard tools like Selenium work well

• BDD-Security if you fancy text or want to integrate PO friendly E2E tests with vulnerability scans

continuumsecurity.net/bdd-intro.html


more…

owasp.org/index.php/Appendix_A:_Testing_Tools


But…

• Too many!

• Too different!

• Too complex!

• Stuff to install (lots!)

• Stuff to configure…


But…

• Too many!

• Too different!

• Too complex!

• Stuff to install (lots!)

• Stuff to configure…


And what about…


If we just had a way to package those tools uniformly…


If we just had a way to package those tools uniformly…


Demo: Static analysis


If we just had an easy way to connect scanners to apps…


If we just had an easy way to connect scanners to apps…


Demo: Vulnerability scanners


If there was just a way to scale those tests…


If there was just a way to scale those tests…

[email protected] | @schoefmann

container-solutions.com

Technology

Securing Your Deployment Pipeline With Docker