You are viewing content from a past/completed QCon

Presentation: Keep Calm and Secure Your CI/CD Pipeline

Track: Scaling Security, from Device to Cloud

Location: Churchill, G flr.

Duration: 1:40pm - 2:30pm

Day of week: Wednesday

Slides: Download Slides

More talks on:

Share this on:

This presentation is now available to view on InfoQ.com

Watch video with transcript

What You’ll Learn

  1. Hear about some DevSecOps challenges Pride in London had with open source software.
  2. Find out what are some of the security challenges web developers have to deal with and how to fix them.

Abstract

Shifting left significantly reduces costs and diminishes release delays. Continuous security validation should be added at each step from development through production to help ensure the application is always secure. We can then switch the conversation with the security team from approving each release to approving the CI/CD process and having the ability to monitor and audit the process at any time.

In this session, we’ll be focusing on work done with Pride in London (a project using Gatsby2, Contentful and Netlify) and showing you how to create a secure continuous integration/continuous deployment pipeline. You’ll learn how GitHub Marketplace helped the team automating and improving our workflow with different tools for accessibility, code coverage, code review, code quality, security and other functionalities (alerting with Slack). You’ll also find out what OWASP is and how to improve the workflow for your own open source projects using GitHub Marketplace applications.

Question: 

What is the work that you are doing today?

Answer: 

In my day job, I'm the lead security engineer at Photobox. I'm in charge of application security, cloud security and network security within my team. And for Pride in London, I'm the tech lead and the security manager. I take care of the website and the application, manage a team of fifteen developers and implement features that the other teams in the organisation are requesting. This is all volunteer based and working on an open source project.

Question: 

How do you deal with stress and development when building security features?

Answer: 

It depends on the features. If it's a new feature, we could set up threat modelling sessions where we would sit down with the developers, the architect and the product owner, go through those new features and see what can go wrong and how we can remediate or fix any issues that are flagged during those sessions. Also we attend their developers guilds and try to give more context and tell a story behind the vulnerabilities, because we think that presenting the OWASP Top 10 most common vulnerabilities is great, but also giving more context and how it impacts different companies, by giving real life examples, make more sense for the developers because they might not be used to the security jargon.

To give an example, let's say two, three years ago there was this event-stream npm package incident. There was a little bit of social engineering involved because it was open-source and the attacker managed to push malicious code within the repository. The result was that more than 8 million applications were running malicious code. There are many other examples around websites embedding crypto mining softwares, malicious scripts, and this could be prevented by implementing a content security policy or adding a subresource integrity checksum, for example.

Such cases help developers because they understand that if they don't check for their 3rd party packages, or if they don't implement a content security policy, this could happen in their company.

To summarize, I would say don't use specific security jargon when you talk to developers and product teams, but try to tell a story and give context.

Question: 

What are the goals for your talk and what are the takeaways?

Answer: 

The talk will cover a quick introduction around what is cybersecurity and why is it important? I will give a couple of examples - like the one that I mentioned with the event stream package. What could be the impact of ransomware? Then I will focus on web application security. 

My case study is around Pride in London, which is an open source project. We’ve leveraged the power of the GitHub marketplace applications we could find there because it's open source. We've implemented a lot of those tools and platforms that are available on the marketplace around code coverage, testing, compliance, security, scanning for tokens and credentials, and flagging any vulnerabilities.

We'll go through the challenges that we faced when using some of the tools, around false positives, how we tried to tune those tools, how we decommissioned some of these tools, how we're monitoring our third party packages, the CI/CD pipeline that we currently have with Pride in London with all the tools that we've implemented from the GitHub marketplace. Obviously, it's not a bulletproof solution, but it will help open source maintainers to have some guidelines or starting points to use those tools and have their open source projects more secure.

Speaker: Sonya Moisset

Lead Security Engineer @Photobox / Tech Lead @PrideInLondon

Sonya is a lifelong traveler who lived in the Middle-East, North Africa and Asia and is always looking for new challenges. She has made a career switch from International Business Consultant in Saudi Arabia and Singapore to Full Stack Software Engineer in South Korea to Lead Security Engineer at Photobox Group. Before coming to the UK, she was based in South Korea for 6 years where she learnt Korean and worked for several Korean companies. Sonya is a Tech Advocate and a public speaker in the UK tech scene. She is also a mentor for women in tech, a cybersecurity writer for FreeCodeCamp publications and an active member of the tech community in London. Her motto is #GetSecure, #BeSecure & #StaySecure

Find Sonya Moisset at

Speaker page

Twitter
https://www.linkedin.com/in/sonyamoisset/

Last Year's Tracks

Schedule

Learn trends from innovator and early adopter companies that you can bring home to your team

Save your spot at QCon Plus (Nov 4-20, 2020)

Sign Up