AppSec at the speed of DevOps in the age of open source

Gabriela Motroc and Tim Mackey at DevOpsCon Berlin 2018

In the world of DevOps, traditional application security is no longer enough. How can we improve AppSec? What are the newest security challenges that arise as DevOps becomes more mature? JAXenter editor Gabriela Motroc caught up with Tim Mackey, technical evangelist for Black Duck by Synopsys at DevOpsCon 2018 to talk about all this and more.

“Through the community engagement, we all win”

In the world of DevOps, traditional application security doesn’t cut it anymore, and relying on perimeter defenses is a reactionary measure… assuming you control the perimeter. The unprecedented use of open source, speed of continuous integration and continuous delivery, containerization, and move to the cloud all mean that teams need a new approach to application security. DevOps teams cannot cede speed and agility for the sake of security.

JAXenter editor Gabriela Motroc caught up with Tim Mackey, technical evangelist for Black Duck by Synopsys at DevOpsCon 2018 to talk about how to do AppSec at the speed of DevOps in the age of open source. In this video interview, Tim will be answering the following questions:

How can we improve AppSec and what are the newest security challenges that arise as DevOps becomes more mature? Why should we build AppSec into the DevOps process? What are the benefits and what happens if we don’t do that? The results of theBlack Duck report were released a couple of months ago. What are the most unexpected or worrying facts? Right now, we’re using alot of open sourcecomponents that contain flaws. Does this mean we should stop using open source components altogether or is there a way to shield our work from vulnerabilities? How can we balance security and innovation in open source? Watch the video interview here. Here are some quotes from the interview: The biggest challenge in security in a DevOpsworld is to understand what the overallinformation flow is. You also need to understand what the security risks are and what the problem that needs to be solved right now is. With GDPR as a reality, that will trigger potential regularity impact. Trends from the report ( read more about ithere ): Open source is the way the world works today Security and engagement with an open source community are lagging Organizations are becoming more aggressive with open source license compliance Key takeaway from the report: Organizations need to be consuming but also engaging with the communities that are consuming the components from There is a tendency among some people to say “I want to remove the flawed component and replace it with something else”. The reality is that what you’re going to replace it with is probably just a different fork of that same component. If you see a flaw inside of an open source component, report that flaw, find where you obtained your code from. Through the community engagement, we all win.

SEE ALSO: “I think we will incorporate a ‘Security First’ mindset to DevOps”

When you find a security issue, you should report it

Tim Mackey from Black Duck by Synopsys discussed containers in his session “ AppSec at the Speed of DevOps in the Age of Open Source ” at DevOpsCon 2018 . Mackey reported that containers are immutable (they are created once and run many instances) and ephemeral (a container’s life should only be as long as necessary). Containers must be sacrificed and a system may terminate a container if needed; there is no guarantee of a container’s lifespan.

Mackey predicted that the rate of security disclosures will increase. He told the audience that web services APIs introduce new risk profiles (disruption or discontinuity of usage, loss of intellectual property, data breaching, unintended use of unreliable services) and that not every service is reliable and should be trusted. The final takeaway of Tim Mackey’s session is that we are all researchers and when you find a security issue, you should report it. This way we all increase vulnerability awareness together.

Tim Mackeyis a technical evangelist for Black Duck by Synopsys, which helps organizations to locate, manage and secure their open source software. Tim’s role is one of engaging with technical communities to best understand how Black Duck can solve their application security problems today, and learn what bleeding edge security concerns are top of mind in order to feed them back into the development team. He is well versed in open source application security, data center security, containers, virtualization, and cloud technologies. Tim has spoken at many events including OSCON, CloudOpen, Interop, CA World, Cloud Connect and the CloudStack Collaboration Conference. Tim is a published O’Reilly Media author.