- Dev SecOps is actually a concept used
in recent years to describe how to move security activities
to the start of the development life cycle.
Right. And basically you also have built-in
security practices within the environments
like I was actually mentioning to you before
like C I C D pipelines and many others.
Now there's also a concept
of a secure development life cycle.
Also referred to as SDLC
and many organizations actually use SDLC
for software development life cycle.
Some, you know, will refer
to it as secure development life cycle.
But if I actually mention SDLC here is
with the concept of secure development life cycle.
The SDLC and Dev Sec Ops programs basically are implemented
in many modern organizations and especially in
among organizations that are adopting the cloud
and are adopting things
like DevOps and the continuous integration
and continuous delivery pipelines.
Right now there's a project called the dev secs ops project.
And it's actually in GitHub at devsecops.GitHub.IO
which actually includes a set of tools
and tutorials about dev and underlying practices.
Now the OWASSP organization has a project called the
OWASP proactive controls, and it basically it's a collection
of secure developing practices and guidelines that
any developer should follow to build secure applications.
These practices will actually help you to
shift security earlier into the design
the coding and the testing.
And these are the top 10 proactive controls by OWASP.
And it starts with defining security requirements.
That's actually, you know, pretty self explanatory,
also goes over leveraging security, frameworks and libraries
and basically at the end of the day, not reinvent the wheel
and take advantage of actually several frameworks
and libraries that have been adopted by the industry
secure data database access
encode and escaped data cap, data validate all inputs.
And of course
input validation is a huge problem still nowadays.
And then also implementing digital identity
enforcing access control, protecting data, you know
wherever it resides, whether it's in the cloud
or on premise, and then implementing security login
and monitoring and handling all errors
and exception in an appropriate manner.
Now you should also use software assurance tools
and methods, including fuzzing,
static application security testing, or SAST
also dynamic application security testing
otherwise known as DAST.
Now I mentioned fast testing or fuzzing
And it's basically a technique that can be used to
find software errors or bugs, at the end
of the day security one, everybody are bugs, whether it's
in applications, operating systems, infrastructure devices
or even IOT devices right, now
fuzzing involves sending random data or crafted messages
to the unit that you're actually testing.
And you're sending this
in order to find input validation issues,
program failures, buffer overflows, and many other flaws.
The tools that are used to perform fuzzing are referred
to as fuzzers and examples
of very popular fuzzers are peach, munity
American Fuzzy Lop, the synopsis defensics
and a mutational fuzzing frameworks like radamsa.
And by the way
the immunity fuzzing framework is an open source
fuzzer that was actually created by Cisco.
And it works by replaying packet capture files
or pick up through a mutational fuzzer.
And you can actually download more information
about that fuzzing framework
at the GitHub that I'm showing in the screen.