DevSecOps - Automating Security in DevOps | Jovin Lobo | Nullcon Webinar 2021

### Overview In this Nullcon Webinar session, speaker Jovin Lobo discusses the transition from traditional security practices to DevSecOps by automating security checks directly within DevOps pipelines. The presentation covers the four core pillars of DevOps—Continuous Integration (CI), Continuous Delivery (CD), Infrastructure as Code (IaC), and Continuous Monitoring—and explains how traditional security approaches (such as manual code reviews, isolated penetration testing, and post-deployment audits) fail to scale with modern deployment velocity. To prevent security from becoming a bottleneck, organizations must integrate automated security tools seamlessly across every stage of the software delivery lifecycle.

### Key Topics - **DevOps Core Pillars**: Reviewing Continuous Integration (using Git/GitHub), Continuous Delivery (using Jenkins), Infrastructure as Code, and Continuous Monitoring (using Elastic Stack: Filebeat, Logstash, Elasticsearch, and Kibana). - **The DevSecOps Imperative**: Why traditional security models fail against rapid release cycles and scaling microservice architectures, necessitating shared responsibility and "security by default." - **Pipeline Security Integration**: Automating checks at multiple stages including pre-commit hooks, secrets management, software composition analysis (SCA), static application security testing (SAST), dynamic application security testing (DAST), infrastructure assessment, compliance checks, and container scanning. - **Vulnerability Management & Monitoring**: Aggregating multi-tool findings into centralized management dashboards and protecting runtime infrastructure using Web Application Firewalls (WAF). - **Cultural Transformation**: Fostering cross-team collaboration and scaling security capabilities through dedicated Security Champions rather than relying solely on a separate security silo.

### Technical Details Lobo outlines specific stages and tools utilized across an automated DevSecOps pipeline: - **Pre-Commit Hooks & Secrets Management**: Developers use tools like `pre-commit` (and hooks such as `git-secrets` or `detect-secrets`) to prevent committing sensitive items like AWS keys directly to source control. Secrets management solutions like HashiCorp Vault ensure credentials and configurations are injected dynamically. - **Software Composition Analysis (SCA)**: Identifies vulnerable third-party components and dependencies using tools such as OWASP Dependency-Check, Retire.js, or language-specific tools like Bundler-Audit. - **Static Application Security Testing (SAST)**: Automated scanners inspect source code for vulnerabilities and bad practices. Recommended tools include Brakeman (for Ruby) or Semgrep, which Lobo highlights as highly configurable and customizable for writing custom rules across multiple programming languages. - **Dynamic Application Security Testing (DAST)**: Tools such as OWASP ZAP (Zed Attack Proxy) run automated scans against deployed staging environments to identify runtime flaws. - **Infrastructure & Container Security**: Infrastructure vulnerability scanning is conducted via OpenVAS, while compliance is enforced as code using Chef InSpec. Container images are scanned for vulnerabilities using tools like Trivy. - **Centralized Vulnerability Management & Incident Response**: Rather than managing output in silos, results are funneled into centralized dashboards such as ArcherySec, OWASP DefectDojo, or Faraday. Runtime monitoring and defense combine ModSecurity WAF in front of production servers with ELK (Elasticsearch, Logstash, Kibana) and Filebeat for log aggregation.

### Takeaways Automating security in DevOps requires choosing tools tailored to the technology stack and programming languages in use, while keeping the pipeline configuration principles uniform. Tooling alone is insufficient; organizations must bridge the gap between development and security through cultural change, cross-training, and establishing "Security Champions" to maintain security velocity alongside software releases.