Presentation: Keep Calm and Secure Your CI/CD Pipeline

Track: Scaling Security, from Device to Cloud

Location: St James, 4th flr.

Duration: 1:40pm - 2:30pm

Day of week: Wednesday

Share this on:

What You’ll Learn

  1. Hear about some DevSecOps challenges Pride in London had with open source software.
  2. Find out what are some of the security challenges web developers have to deal with and how to fix them.

Abstract

Shifting left significantly reduces costs and diminishes release delays. Continuous security validation should be added at each step from development through production to help ensure the application is always secure. We can then switch the conversation with the security team from approving each release to approving the CI/CD process and having the ability to monitor and audit the process at any time.

In this session, we’ll be focusing on work done with Pride in London (a project using Gatsby2, Contentful and Netlify) and showing you how to create a secure continuous integration/continuous deployment pipeline. You’ll learn how GitHub Marketplace helped the team automating and improving our workflow with different tools for accessibility, code coverage, code review, code quality, security and other functionalities (alerting with Slack). You’ll also find out what OWASP is and how to improve the workflow for your own open source projects using GitHub Marketplace applications.

Question: 

What is the work that you are doing today?

Answer: 

In my day job, I'm the lead security engineer at Photobox. I'm in charge of application security, cloud security and network security within my team. And for Pride in London, I'm the tech lead and the security manager. I take care of the website and the application, manage a team of fifteen developers and implement features that the other teams in the organisation are requesting. This is all volunteer based and working on an open source project.

Question: 

How do you deal with stress and development when building security features?

Answer: 

It depends on the features. If it's a new feature, we could set up threat modelling sessions where we would sit down with the developers, the architect and the product owner, go through those new features and see what can go wrong and how we can remediate or fix any issues that are flagged during those sessions. Also we attend their developers guilds and try to give more context and tell a story behind the vulnerabilities, because we think that presenting the OWASP Top 10 most common vulnerabilities is great, but also giving more context and how it impacts different companies, by giving real life examples, make more sense for the developers because they might not be used to the security jargon.

To give an example, let's say two, three years ago there was this event-stream npm package incident. There was a little bit of social engineering involved because it was open-source and the attacker managed to push malicious code within the repository. The result was that more than 8 million applications were running malicious code. There are many other examples around websites embedding crypto mining softwares, malicious scripts, and this could be prevented by implementing a content security policy or adding a subresource integrity checksum, for example.

Such cases help developers because they understand that if they don't check for their 3rd party packages, or if they don't implement a content security policy, this could happen in their company.

To summarize, I would say don't use specific security jargon when you talk to developers and product teams, but try to tell a story and give context.

Question: 

What are the goals for your talk and what are the takeaways?

Answer: 

The talk will cover a quick introduction around what is cybersecurity and why is it important? I will give a couple of examples - like the one that I mentioned with the event stream package. What could be the impact of ransomware? Then I will focus on web application security. 

My case study is around Pride in London, which is an open source project. We’ve leveraged the power of the GitHub marketplace applications we could find there because it's open source. We've implemented a lot of those tools and platforms that are available on the marketplace around code coverage, testing, compliance, security, scanning for tokens and credentials, and flagging any vulnerabilities.

We'll go through the challenges that we faced when using some of the tools, around false positives, how we tried to tune those tools, how we decommissioned some of these tools, how we're monitoring our third party packages, the CI/CD pipeline that we currently have with Pride in London with all the tools that we've implemented from the GitHub marketplace. Obviously, it's not a bulletproof solution, but it will help open source maintainers to have some guidelines or starting points to use those tools and have their open source projects more secure.

Speaker: Sonya Moisset

Lead Security Engineer @Photobox / Tech Lead @PrideInLondon

Sonya is a lifelong traveler who lived in the Middle-East, North Africa and Asia and is always looking for new challenges. She has made a career switch from International Business Consultant in Saudi Arabia and Singapore to Full Stack Software Engineer in South Korea to Lead Security Engineer at Photobox Group. Before coming to the UK, she was based in South Korea for 6 years where she learnt Korean and worked for several Korean companies. Sonya is a Tech Advocate and a public speaker in the UK tech scene. She is also a mentor for women in tech, a cybersecurity writer for FreeCodeCamp publications and an active member of the tech community in London. Her motto is #GetSecure, #BeSecure & #StaySecure

Find Sonya Moisset at

Similar Talks

Scaling N26 Technology Through Hypergrowth

Qcon

Software Engineer and Tech Lead @N26

Folger Fonseca

How to Debug Your Team

Qcon

Senior VP Engineering @spring_health, former VP Engineering @Meetup

Lisa van Gelder

Trust, the Secret Ingredient in High Performing Team

Qcon

Site Reliability Engineer @immersivelabsuk

Jaycee Cheong

Modern Banking in 1500 Microservices

Qcon

Senior Staff Engineer @Monzo

Matt Heath

Rampant Pragmatism: Growth and Change at Starling Bank

Qcon

Web Technology Practice Lead @StarlingBank

Daniel Osborne

Monitoring All the Things: Keeping Track of a Mixed Estate

Qcon

Principal Engineer Operations and Reliability Programme @FT

Luke Blaney

Tracks

Monday, 2 March

Tuesday, 3 March

Wednesday, 4 March

Download the QCon App!

Available on iOS and Android

The QCon app helps you make the most of your conference experience. Easily browse and follow the conference schedule, star the talks you want to attend, and keep tabs on your personal itinerary. Download the app now for free on iOS and Android.

QCon - iOS QCon - Android
QCon