Movatterモバイル変換

Enable DevSecOps using JiraSoftwareSaurabh GuptaMarch 02, 2019DevOps Solution Engineer Head of Developer EfficiencyGroupMostofa Rahman

2 Information Classification: PublicEveryone isresponsible forsecurity

3 Information Classification: PublicDeveloper OperationSecurity

4 Information Classification: PublicApplication Security

5 Information Classification: PublicSecurity ScannigScanningSQL Injection Insufficient Input ValidationInformation Leakage Code QualityCryptographic IssuesCRLF InjectionCross Site ScriptingAccess Control Missing AuthenticationPrivilege EscalationHTTP Verb TamperingOpen Source ComponentScanning

6 Information Classification: PublicPlanDevelopBuildTestReleaseDeployOperateContinuousDeliveryContinuousIntegration

Effect of scan frequencyon flaw persistenceanalysis.STATE OF SOFTWARESECURITY VOL 9

8 Information Classification: Public2017 EMA reportA 2017 EMA report found thetop two benefits- better ROI improved- operational efficiencies

9 Information Classification: PublicSecurity Considerations

10 Information Classification: PublicTakes Timec

11 Information Classification: PublicTakes Time Adds CostccApplication Security

12 Information Classification: PublicTakes Time Adds CostReducesInnovationccc

13 Information Classification: PublicAutomation Opportunity

14 Information Classification: PublicSemi-Automated Process

15 Information Classification: PublicWhy Jira

16 Information Classification: PublicSolution ImplementationWhat we did?

17 Information Classification: PublicIntegratedmultiplescanningtools withJira

18 Information Classification: PublicScanning Tools Auto Issue CreationUsing any of the methods- Jira Plugin - Back end Script- Jira Rest API

19 Information Classification: PublicTo achieve all the functionalities we integrated our Jira with multiple datasourcesApplication Information SourceScan Request System Due Date Calculation System

20 Information Classification: PublicStandardize received dataü All fields are populatedü Right fields are populatedü Data in the scanning tool and data inJira matchesü Run different models for datastandardization and calculationaccording to user needs

21 Information Classification: PublicStandardize received dataü Recalculating severity based onCVSS, CWE ID, CVE IDü Adding remediation data based onCWE ID & CVE IDü Calculating remediation start dateü Calculating due date

22 Information Classification: PublicBNY Jira structureAS = App Sec JiraAD = App Dev JiraJira 1 AS Jira 2 AD Jira 3 AD Jira 4 AD Jira 5 AD

23 Information Classification: PublicWorkflow

24 Information Classification: PublicJira & Beyond

25 Information Classification: PublicFull ArchitectureScanning ToolsApplicationsList ofVulnerabilitiesPushed/Pulledinto JiraStandardizationtaskApp Sec JiraConnect toexternal systemfor differentparametersInformationSystemScanRequestSystemDue DateCalculationSystemData ValidationandRequired fieldscheckPush to othersystems foranalysticsApp Dev Jira

26 Information Classification: PublicChallenges Faced

27 Information Classification: PublicChallengesAPI Limitations

28 Information Classification: PublicChallengesAPI LimitationsClean Ups

29 Information Classification: PublicChallengesAPI LimitationsClean UpsCollaboration

30 Information Classification: PublicChallengesAPI LimitationsClean UpsCollaborationInfrastructure

31 Information Classification: PublicChallengesAPI LimitationsClean UpsCollaborationScope ChangesInfrastructure

32 Information Classification: PublicBenefits

33 Information Classification: PublicBefore• Scan Applications• Suggest remediation• Generate reports• Communicate reportsAfter• Scan Applications• Suggest remediationSecurity Analyst Responsibilities

34 Information Classification: PublicRegulatory

35 Information Classification: PublicOne StopShop For ALLApp Dev TeamThey do not need to go to different tools to getvulnerability information. Also, saving the effort tolearn new tool.WorkflowBoth teams can collaborate on the same Jiraissue. Saving time otherwise spent on back andfro.App Sec TeamNew workflow enables App Sec team toaccept/reject false positive findings.

36 Information Classification: PublicTime saved on generating & communicating report( 50 X 2 ) = 100 hours per dayNumber ofhours spentNumber ofSecurity Analyst* via Bloomberg/Payscale/IMG

37 Information Classification: PublicTime saved on generating & communicating report( 50 X 2 ) X 22 = 2200 hours per monthNumber ofhours spentNumber ofSecurity Analyst* via Bloomberg/Payscale/IMG

38 Information Classification: PublicTime saved on generating & communicating report( 50 X 2 ) X 262 = 26,200 hours per yearNumber ofhours spentNumber ofSecurity Analyst* via Bloomberg/Payscale/IMG

39 Information Classification: Public25%Of Effort Saved

40 Information Classification: PublicSummary & Takeaways

41 Information Classification: Public• DevSecOps is the new unicorn, who everyone wants to ride on• Enables shift left• Jira software integration with DevSecOps• Build workflow to simplify the remediation process• Reduces administrative work• Satisfy regulator/auditor needs• Full traceability• Facilitates ease of access• Security becomes cheaper and efficient when using DevSecOpsSummary

42 Information Classification: PublicBNY Mellon is the corporate brand of The Bank of New York Mellon Corporation and may be used as a generic term to reference the corporationas a whole and/or its various subsidiaries generally. Products and services may be provided under various brand names in various countries byduly authorized and regulated subsidiaries, affiliates, and joint ventures of The Bank of New York Mellon Corporation. Not all products andservices are offered in all countries.BNY Mellon will not be responsible for updating any information contained within this material and opinions and information contained herein aresubject to change without notice.BNY Mellon assumes no direct or consequential liability for any errors in or reliance upon this material. This material may not be reproduced ordisseminated in any form without the express prior written permission of BNY Mellon.©2019 The Bank of New York Mellon Corporation. All rights reserved.Disclosure

Movatterモバイル変換

Change Language

Enable DevSecOps using Jira Software

Embed presentation

Recommended

More Related Content

What's hot

Similar to Enable DevSecOps using Jira Software

More from Atlassian

Recently uploaded

Enable DevSecOps using Jira Software