With the rapid growth of technology, the potential for data to be stolen has grown exponentially. Therefore, security needs to become a higher priority in applications. DevSecOps is a concept which seeks to do just that. With this presentation, I seek to create a means to inform IT professionals why security is a rising concern and methods to improve the security of applications through DevSecOps. With reports on data breaches, this presentation first emphasizes how security is a growing concern. Then, through articles written by IT professionals, it focuses on how DevSecOps can transform the application development cycle to create more secure applications. Through this practice, companies can have faster response times and fend off more attacks, leading to an overall more protected system

Gomes, Katia T.

English

Huskie Commons

NORTHERN ILLINOIS UNIVERSITY  The Importance of DevSecOps  A Thesis Submitted to the  University Honors Program  In Partial Fulfillment of the  Requirements of the Baccalaureate Degree  With Upper Division Honors  Department Of  Computer Science  By  Katia Gomes  DeKalb, Illinois  May 2018      HONORS THESIS ABSTRACT THESIS SUBMISSION FORM   AUTHOR: Katia Gomes  THESIS TITLE: The Importance of DevSecOps  ADVISOR: Daniel Rogness  ADVISOR’S DEPARTMENT: Computer Science  DISCIPLINE:  Computer Science                                            YEAR: 2018  PAGE LENGTH: 16  BIBLIOGRAPHY: Included  ILLUSTRATED: Yes  PUBLISHED (YES OR NO): No  LIST PUBLICATION: N/A  COPIES AVAILABLE: Online  ABSTRACT (100-200 WORDS):  With the rapid growth of technology, the potential for data to be stolen has grown exponentially. Therefore, security needs to become a higher priority in applications. DevSecOps is a concept which seeks to do just that. With this presentation, I seek to create a means to inform IT professionals why security is a rising concern and methods to improve the security of applications through DevSecOps. With reports on data breaches, this presentation first emphasizes how security is a growing concern. Then, through articles written by IT professionals, it focuses on how DevSecOps can transform the application development cycle to create more secure applications. Through this practice, companies can have faster response times and fend off more attacks, leading to an overall more protected system. The Importance of DevSecOpsBY: KATIA GOMES     Why is security important?• Generic Login• Basic SQL Injectionselect Password from Users where UserName='$user' and Password='$password’select Password from Users where UserName=‘’ or ‘’=‘' and Password=‘’ or ‘’=‘’• The query will return true – valid user  To demonstrate why security is such a big topic, let’s go through a basic example I created at http://students.cs.niu.edu/~z1730089/honors/. It is a basic login connected to a database of users and their password. It works as you would accept, allowing a login with correct credentials and failing otherwise. However, with some simple SQL Injection (‘ or ‘’=’ in Username and Password), a malicious user could fake a successful login, gaining access to data they shouldn’t have.     OWASP Top 10 Application Security Risks - 20171. Injection (such as SQL, NoSQL, OS, LDAP)• Untrusted data is sent to an interpreter and executed2. Broken Authentication• Incorrect implementation of authentication and session management3. Sensitive Data Exposure• Sensitive data is not properly protected  Open Web Application Security Project • Injection • Untrusted data is sent to an interpreter and is executed, allowing a malicious user to access data without proper authorization (like my example) • Broken Authentication • Authentication and session management are incorrectly implemented, allowing attackers to compromise passwords, keys or session tokens. They can then assume other users’ identities temporarily or permanently • Sensitive Data Exposure • Sensitive data such as financial or healthcare are not properly protected. Attackers can steal or modify such data to conduct credit card fraud, identity theft, or other crimes.   Data BreachesBIGGESTYahoo• 2013 – 3 billion accountsAdult Friend Finder• 2016 – 400+ million accountseBay• 2014 – 145 million usersEquifax• 2017 – 143 million consumers2018Best Buy – April 5Sears – April 4Delta – April 4Saks Fifth Ave/Lord & Taylor – April 1Under Armour – March 29Hack Sponsored by Iran – March 23FedEx – Februrary 15  There have also been many data breaches over the years. These are the top 4, by number of records stolen: • Yahoo • 3 billion user accounts, including user names, email addresses, dates of birth and passwords • Adult Friend Finder • 400+ million accounts including names, email addresses and passwords (encryption easily cracked) • eBay • 145 million accounts, including names, addresses, dates of birth and encrypted passwords. • The hackers got in via credentials of 3 corporate employees  • Equifax • 143 million consumers, including SSN, birth dates, addresses plus potentially drivers’ license numbers and credit card data • They are one of the largest credit bureaus in the U.S.  In 2018 alone, these companies have been hacked and user information, typically including customer information and even payment information. • Specifically, an Iranian hacker ring hacked into computer networks of 144 U.S. universities and sent a phishing scan, breaching the email accounts of roughly 4,000 professors. This resulted in 31 terabytes of data stolen, totaling $3.4 billion worth of damages.   As a whole, data breaches are on the rise  And those are just a few examples of the number of data breaches that have occurred. As a whole, data breaches have been on the rise.   Now, how can we go about reducing the number of data breaches? Of course, we need to make applications more secure. But how would a company go about doing that?      DevSecOps• What is it?• Development, Security and Operations• Weaves security into DevOps• What is DevOps?  This is where the concept DevSecOps comes into play. It stands for Development, Security and Operations. This is basically a guideline for how to weave security into DevOps – a practice companies have already started using. To fully understand DevSecOps, we need to make sure we understand DevOps.     DevOps – Before Security• Restructures app lifecycle• Core Principles:• Collaboration and communication• Agility towards change• Software design• Failing fast and early• Innovation and continuous learning• Automating processes and tools• However, cycle lacks security  Basically, DevOps restructures the traditional application lifecycle. It weaves together Development and Operations to create flexibility in the application. It outlines a set of guidelines to implement through tools, technology and process. The core principles are …  DevOps encourages faster delivery, defect resolutions and creates an overall collaborative environment. However, this process fails to include security.     DevSecOps• DevOps with Security• Once again restructures app lifecycle• Shift security to the left  DevSecOps is, simply put, DevOps with security baked into it. It once again restructures the application lifecycle to make it so that security is something considered at every stage. The goal is to shift security to the left of the development cycle, adding security checks after each development phase.      So What?• Build in security• Automation• Faster introduction of defects• Faster fixes  So what? By shifting security to the left of the development cycle, it ensures that security is thoroughly built into the application. Security checks after each phase add a level of automation. It also allows developers to notice potential vulnerabilities faster. And, one of the most important things, in my opinion, is that it allows for faster response times to vulnerabilities found in the live software.     Integration• Developers need to learn security• Add security checks for each small code release• Use tools to both monitor and identify security issues  Clearly this concept is something beneficial for companies to use, but with any new methodology, a company would need to figure out how to implement it into their work flow. With DevSecOps, this means changing the development process from start to finish so that it incorporates security. So, first off developers need to learn about security.     Jenkins• Automation software• Assists in continuous integration• Tests code every time it is updated in repository• Helps ensure that there are no code defects  One very helpful software companies can use is called Jenkins. It is a software that can help with automation. Specifically, it is used to assist with continuous integration. With DevSecOps, there should be frequent releases. This means there will be daily code changes and merging with repositories. If code is not tested frequently, it could lead to a pile of defect by the time it is. Jenkins assists with automatically testing code when it is integrated, helping to ensure that the code contains no defects.     Nessus• Vulnerability scanner• Assists with finding vulnerabilities within software• Scans software for security defects hackers could exploit• Ensures that there are minimal security defects  Another useful software is called Nessus. It is a vulnerability scanner software. It scans the application and will search for security defects that a hacker could exploit. Nessus alerts the developer of these defects, ordering them by severity. Then these potential exploits can be fixed before the software is released, leading to less vulnerabilities in the deployed code.     Metasploit• Penetration testing framework• Assists with finding vulnerabilities within software• Attacks software like a potential hacker would• Ensures that there are minimal security defects  Another tool used for fining security defects is Metasploit. Specifically, Metasploit is used for penetration testing. This is where the company has a person test their application to see if there are any security vulnerabilities in the software. They are trying to see if they can find a way to break through the security of the software. So, Metasploit allows the tester to facilitate the attacks hacker run. This way different types of security vulnerabilities can be tested. This ability to run penetration tests on the software adds another way to make sure that an application doesn’t have any security defects.     Splunk• Monitoring software• Assists with monitoring deployed software for security threats• Analyses and identifies anomalous behavior• Alters developer about potentially malicious attacks  One more very useful tool for companies to use is Splunk. This is a monitoring software that identifies potentially malicious attacks on the application. This application makes it very easy to not only identify malicious attacks, but automating the incident response procedures. This leads to faster response times to vulnerabilities.     Final Thoughts• Obviously, security is important• DevSecOps offers the framework to bake security into an application• There are already many tools available  With all of that said, here are a few final thoughts. Obviously, security is important for the fact that technology is constantly being developed and it is only being released faster. Given how many security breaches there have been, the need for secure applications is only increasing. So, thoughts of security need to be generated towards to the start of development.  DevSecOps is a framework with the goal to bake security into an application. It makes it so that security is everyone's responsibility, not just the security team. And there are already many tools available to assist with the integration of DevSecOps. Though it seems like a simple concept, it is something that will help increase the overall application security and would help prevent data breaches.     Bibliography  Armerding, Taylor. “The 17 Biggest Data Breaches of the 21st Century.” CSO Online, CSO, 26 Jan. 2018, www.csoonline.com/article/2130877/data-breach/t5he-biggest-data-breaches-of-the-21st-century.html. Bearak, Steven. “2018 Data Breaches - The Worst Breaches, So Far.” IdentityForce, 1 May 2018, www.identityforce.com/blog/2018-data-breaches. Casey, Kevin. “Why DevSecOps matters to IT leaders.” The Enterprisers Project, Red Hat, Inc., 15 Jan. 2018, enterprisersproject.com/article/2018/1/why-devsecops-matters-it-leaders. Crouch, Alan. “Implementing the DevSecOps Process.” Coveros, 22 Oct. 2017, www.coveros.com/implementing-devsecops-process/. “DevSecOps Bootcamp.” GitHub, github.com/devsecops/bootcamp. Green, Dennis. “If You Shopped at These 14 Stores in the Last Year, Your Data Might Have Been Stolen.”Business Insider, 6 Apr. 2018, www.businessinsider.com/data-breaches-2018-4. Javanicus, Zenodermus. “Login Bypass Using SQL Injection.” Security Idiots, 3 Apr. 2014, securityidiots.com/Web-Pentest/SQL-Injection/bypass-login-using-sql-injection.html. Lietz, Shannon. “<- Shifting Security to the Left.” DevSecOps, 5 June 2016, www.devsecops.org/blog/2016/5/20/-security. Modi, Ritesh. “What Is DevOps?” The New Stack, 17 May 2017, thenewstack.io/what-is-devops/. “OWASP Top 10 Application Security Risks - 2017.” OWASP, www.owasp.org/index.php/Top_10-2017_Top_10. Reklaitis, Victor. “How the Number of Data Breaches Is Soaring - in One Chart.” MarketWatch, 2 Mar. 2018, www.marketwatch.com/story/how-the-number-of-data-breaches-is-soaring-in-one-chart-2018-02-26. Wallgren, Anders. “DevSecOps: 9 Ways DevOps and Automation Bolster Security, Compliance.” TechBeacon, 18 Oct. 2017, techbeacon.com/devsecops-9-ways-devops-automation-bolster-security-compliance.    

The Importance of DevSecOps

https://huskiecommons.lib.niu.edu/cgi/viewcontent.cgi?filename=0&article=2213&context=studentengagement-honorscapstones&type=additional

The Importance of DevSecOps

Abstract

Similar works

Full text

Available Versions

Huskie Commons