Fast moving DevOps teams are making hundreds, or even thousands, of changes per day, and traditional approaches to security are struggling to keep up. Most static and dynamic scanners take too long to complete and the results are invalidated after the next commit. The question is, how can security teams build stronger security checks into the DevOps pipeline and obtain fast feedback without slowing down engineering teams?
Here's the good news: DevOps teams are already using Test Driven Development (TDD) frameworks and Continuous Integration (CI) tools to automate unit testing. And even better news: it's time for security teams to get their hands dirty, write some code, and add custom security unit tests to the pipeline.
In this talk, we will explore where security unit testing fits in the DevOps phases, a few unit testing frameworks, and several examples that can help security teams harden their applications. Live demonstrations will show how to write security unit tests, execute the tests in a Jenkins continuous integration (CI) build pipeline, and evaluate test results.
Resources Mentioned in this session:
Some resources that Eric mentioned in route….
GitHub https://github.com/OWASP/user-security-stories OWASP/user-security-stories
Repo to hold mapping of user-security-stories. Contribute to OWASP/user-security-stories development by creating an account on GitHub.
sethlaw/sputr - Security Payload Unit Test Repository (SPUTR). Contribute to sethlaw/sputr development by creating an account on GitHub.
Secure DevOps Practices: https://www.sans.org/u/OGx
JUnit (Java) https://junit.org
XUnit (C#, F#, VB) https://xunit.github.io/
Mocha (NodeJS) https://mochajs.org/
RSpec (Ruby) http://rspec.info/
PyUnit (Python) https://wiki.python.org/moin/PyUnit
JUnit 5 junit.org The next generation of JUnit.
Eric is a co-founder and principal security engineer at Puma Security focusing on modern static analysis product development and DevSecOps automation. His experience includes application security automation, cloud security reviews, static source code analysis, web and mobile application penetration testing, secure development lifecycle consulting, and secure code review assessments.
Previously, Eric spent 5 years as a principal security consultant at an information security consulting firm helping companies deliver secure products to their customers, and another 10 years as an information security engineer at a large US financial institution performing source code audits.
As a Certified Instructor with the SANS Institute, Eric authors information security courses on DevSecOps, cloud security, secure coding, and defending mobile apps. He serves on the advisory board for the SANS Security Awareness Developer training program, delivers security training around the world, and presents security research at conferences including SANS, BlackHat, OWASP, BSides, JavaOne, UberConf, and ISSA.
Eric completed a bachelor's degree in computer engineering and a masters degree in information assurance at Iowa State University, and currently holds the CISSP, GWAPT, GSSP-.NET, and GSSP-Java certifications.