CISOs and DevSecOps – Prakash Sethuraman, CloudBees

This is texturing TV. Of the great pleasure being joined by prakash satirama spakash is a ciso chief information security officer with cloudy good to be talking with you again. I'm gonna be talking to you Mitch and alongside my day job at ciso for cloud Visa.

Also look after the product that we have called Cloud B is compliance and it'll be great to talk about these two things in conjunction because a Cecil's job is predominantly security but security goes hand in hand with compliance so we can talk about both topics. Most certainly great. Well, let's talk about this in the context of devops world because devops world long-standing industry kind of one of the best industry.

If not the best conferences than the devops industry. It's you know started to Jenkins World long ago is happening what September 27th through the 29th and Orlando. I'll actually be there.

But let's look at it from a security perspective. Why does security people care about a devops conference devop like devops world? Let's start there.

I think this tool boxing. Why do they care about it today? Maybe they don't but rather the question should probably why should they care about it?

Why should there is a phenomenal reason why they should get about devops world. How our jobs and Security Professionals has evolved in initially. It was mainly about infrastructure security.

It was about perimeter security and device security and things like that. We've become quite good at that stuff. Now, you know, if you look across the globe, it'd be pretty good at it in most medium to large organizations perimeter security Etc is quite robust.

The challenge we have is that the tread landscape has changed. the threat vectors have changed and where it is now is predominantly the software landscape that is a threat and how we build applications how we build and deliver and deploy software is more of a problem than how do we protect networks and you know increasingly in a world where Soft your ability to compete in the industry is based on how good your teams are at delivering software. And this is regardless of whether you're a tech company or a company making and selling brand.

Technology is here to stay and it kind of determines the success of your business the application development teams and the engineers who work in that space become your customers your Frontline customers. Yes, your business will always be a customer but they're going to increasingly use the tools you provide the capabilities your teams provide to the organization at Large. Where better to meet the best and the brightest of the application development engineering community than devops were if they are the customers of your future.

Come to where they congregate come to where they exchange ideas where they demonstrate how their life is evolving. And how they are making big differences to the organizations they serve what are their impediments? What do they consider friction?

We put all those together. Why wouldn't you be there? I actually had very much agree.

It's it isn't just about putting people in the same room together. It's about talking about how to just like we talked about. How do we build networks and make them secure?

Why wouldn't we have the conversation about how do we build software? And how do we make it secure? Right?

We don't ask the car manufacturers to go at airbags after the car is shipped off the floor, right or we're building a crunch Zone into that car to make it a little safer after we you know, it landed at my at my driveway. It's got to be part of the process in building it in but you have to understand how it's made the process. And by the way, it's just like security is going rapidly down it it's ever changing path software devops Etc.

So rapidly changing so you really have to kind of bring them together and and work together on how you make it secure. Yeah, and I don't think as a profession we have a Huge responsibility to change the perceived reputation of security and compliance teams Etc. We play a very important role in protecting the organization.

At the same time for the engineering community. We are often seen as a department of slope. So we have a big job ahead of us to try and meet these stakeholders get to understand them get them to understand what we bring to the table and help them realize that.

Sometimes what they consider friction is necessary. And at the same time understand what? We can do as a profession to reduce friction at the front line of innovation friction and Innovation are kind of antithesis to each other.

You cannot tell the organization. Can you innovate rapidly and then say yeah, but every time you want to innovate we're gonna have 25 herders you need to jump through and you know, so it helps us as a profession mature into this phrase. We all love to use called devsecops.

But yet nobody has actually managed to explain to me succinctly Lucid late. What do we mean by deaf secops? Really?

Why is the SEC kind of sitting in between Dev and opposite children? It should just be devops Security in compliance should be transferred into those people because They want to go from development into operations in 24 hour Cycles. Not 24 months Cycles.

It is sort of there isn't one definition or one understanding. I think everyone's trying to understand what devsychopsis what that means to them. I think to your point is The as Security Professionals you can either look at it as how do we prevent people from doing dumb things unsecure software getting released or you can look at it as how do we help the organization release secure software faster.

And just that just that perspective change can radically change how you interface integrate with collaborate with work on the development tool chain the security tool chain that helps create secure software. I think that's maybe part of what that perspective is that you can get by immersing yourself into an environment where you're going to be with people who are doing devops. Absolutely, and that has to be you know, if you look at the agenda for devops world this year, there are many sessions and many themes and mainly but practitioners in the field customers talking about how are they solving this problem Focus predominantly on how do you deal with security in high frequency deployment scenarios?

If you're deploying once a year security is an as much of a pain as if you're deploying every day or every hour Etc. So and these are real customers who have solved the problem or who are facing the problem asking for advice and as security people and I see so specifically see so because they accept the tone For how their departments integrate within the wider Organization for CEOs to be there and understand their customer base. I think is absolutely critical.

They will find it extremely valuable listening to customers who've solved the problem and how their security departments helped, you know, the engineering community get better get ahead and and you know real life case studies always have set the tone and set a pattern. You know, I'm just familiarizing myself. And as I mentioned I'll be there as well.

Just looking at the agenda one of the big topics at this world. This year's devops. World is supply chain security software supply chain security.

I think there's some I think about 20 different talks on that that alone to me as a topic worth exploring Plus getting into the how that fits into the entire devops process and working with developers and that any perspective on that prakash. Yes, and I think it's it's, you know from cloud-based perspective. We worked with the software supply chain for a decade now.

And and now, you know philosophy throughout has been it's about the ecosystem security is increasingly about the ecosystem not point in place point in time point in process kind of security. It cannot be and after thought it as you said cause landed on the driveway and it has no airbags somebody turns up three days later to try and fit a bags into it. It cannot be alive.

It has to be secure by Design right through I think the dimension of software supply chain security that that's become. So critical and so Paramount and it's become critical to the point of it being a national security topic that the governments are talking about. Is because everything is so fundamentally interwoven.

And the complexity is beyond human comprehension at this point. We have to find a way to automate. Security, you know security checking we have to reduce the noise and the friction that all the scanners cause as you know, as a part of that ecosystem and more important.

If you're going to get shift left done, right? We have to make sure that for the person writing the software. We are not inundating them with research shift left.

So here are three thousand more things for you to look at. It has to be we've done all the homework we need to do here are three things we need you to fix so that what you're writing is secure by Design and because that's supply chain, especially, you know, I really see Enterprise customers and Enterprise engineering teams, right more than 30 or 40% of the application code. Most of it is third-party software.

A lot of it is open so software and we've got used to the situation where we don't really think about the third party packages. We use in the security vulnerability say introduce Etc. And it's arguable that we don't want them to think about it.

That way they should be something a fabric that is running real time that make sure that they don't think every time they use something we don't get in a car and think whether they're back is going to work or not. We just trust that it works because there's some systems behind the car that makes sure that they always work when you need them. Security should be exactly like that.

It should be a transparent Fabric and that's what we need to work towards. I think for me my kind of working definition of devsecopsis. It's not just shifting the work left.

It's not having developers do more security. Yes. Sure.

We'd like them to emphasize developing secure code. But you mentioned one of the keywords is automation. It's building security into the design but also into the tool chain into the workflows that happen across Deadlocks.

That's how you're going to ship secure software not by at the end. Let's go check the bill of materials and see if there might be any problems and you vulnerabilities and what we shipped kind of late, right? We want those things to be faired it out.

We want that to be part of the process that so we don't have to think about it, right we know. Okay, this blog for Jay vulnerability is out. Right we have that.

We're in our software great. Let's before we ship it. Let's patch these and fix it any codes.

It's moving out next or our own vulnerabilities for that matter that to me is kind of the most effective way to think about death second resonate. YouTube yes, it does and for a bulk of it that is you know, the primary goal. We need to hit red devsecops.

I think there are associated kind of topics. We need to really consider now so that it's not again a problem. We're dealing with three years from now security and compliance go hand in hand.

I think you know to large degree we've got used to saying I have a process. I have a pipeline and it's you know, when I checked it three years ago it posted for purpose. Therefore.

It must be fit for purpose. Now, you know, we talk about continuous authority to operate or continue as fast to live and all these nights phrases. The reality is point in time checking of a process is no longer I think for purpose especially for regulated Enterprises or you know medium to large complex Enterprises.

It's not enough. It's necessary, but it's not enough. What we really need to start thinking about is.

as an organization What is a risk we're really exposed to what is my risk appetite and all these various pipelines that are running automatically, you know through the day deploying code into a production environments. How are they really changing my risk envelope and my risk appetite am I within that risk Capital? So increasingly becomes a question of risk, not just the individual cve that we might have seen because a cve only says under certain conditions.

It might be severe and you really need to worry about it. But in a large number of cases, we have mitigating environment controls. We are mitigating organizational controls Etc.

Which bring the risk down if we try to respond or go to our Engineers to respond to every single thing that says, oh, you know, this looks like hi. They will forever be chasing their tails. They're not really going to get any applications software done so that bit about risk the conversation about risk and am I complying with the policies and the rules of that the organization has am I able to demonstrate day by day that my systems and my controls are effective.

Because the worst thing is having controls and not knowing whether they're effective or not because that gives you a false sense of security. Are they effective how am I preventative controls effective and the last bit at any point in time? If we have an audit?

Can I assert an evidence that when I say I'm effective here's the evidence for it. So we don't start our audit conversation with can all the engineering teams. Please provide me 30 PowerPoints like telling me all the metrics of all the scanning you did.

That's the way so everybody's time really because in the day and age of Automated build testing scanning deployments. Asking engineering teams to produce metrics and spreadsheets like Stone Age. You shouldn't be doing that.

It should be real time. We have the signals. We should be able to judge risk in real time and provide the evidence everybody needs in real time.

So that's the end and that date has been generated being created in real time as they're doing the work. Right so it isn't like let's wait till some point in time. Like you said Point time is old not you can't think of that way.

It's a continuous process. Now you have inside directly into the into what's happening, right? And are you complying, you know that data is available through Automation and the devops tool chain, you know what thinking about going to a conference if I'm if I'm not steeped in devops, but I want to understand this better.

I'm a see so security professional. Yeah, there are lots of topics that you are going to be familiar with you're gonna hear about things like credential security and how you manage that in a software supply chain and us and a workflow process. So you're not, you know, exposing credentials and secrets and the develop process.

It's how to manage risk in an agile type environment. Where things are changing very quickly. It also is is you know topics like securing containers securing, you know, kubernetes and environments where we're running Cloud native software.

So there'll be some new topics, but it's in the context of security. I think it'll still very comfortable but also enlightening to get that perspective. Yes, and then what I find really valuable in these conversations is things that I probably take for granted.

Of course, it's you know, that's common sense in my work day today minute by minute. It's common sense and then you turn up here and you realize that There is a completely different perspective to that same elephant, you know that that we take for granted. So then how do you create the communication bridge that helps explain our world to other people and at the same time understand their perspective and in addition to talking about all of these specifically security topics.

I think there are a few sessions and Demon demonstrations and Boots where we will be talking, you know, for example, we have Cloud bees compliance demonstrations in the booths there. We'll be talking how do you make this real because we can all have philosophical conversations. End of the day people are to get their job done and you know a seesaw carries a lot of responsibility in accountability within organizations and and you know that accountability has to be taken seriously.

So how do you make it real and we'll be demonstrating, you know how this can be achieved what kind of metrics are available in that real-time ecosystem and the beauty of having all that Insight available real time. You can start making decisions. You can stop deployments from happening.

You can stop feature flags from you know, switching on or switching off based on your risk appetite and you can start controlling the envelope that of each of like actually controls. So all these possibilities become available. But if as a security and a compliance function within an organization, we don't understand the state of the art and what is possible.

We can't possibly guide our organizations in the best way, you know that that meets organizational goals. So it is I think very educational from a security perspective even though it's not black cat. It's not RSA maybe talking about defined detail of how can I use machine learning to kind of you know, determine the latest threat that's kind of bothering everybody, etc.

Etc. So it's not purely deep security. It is the application of security.

To meet an objective and meet an organizational goal and drive customer experience for an organization. Extremely good point too because I think is Security Professionals were built in to have an extra layer or level of skepticism. Right?

And that that's resolved or proven by show me. Let me see it. Let's see how it works.

Yes, we can talk about it. We can agree or disagree about philosophies approaches Etc. But let's see it work.

Let's see what it can do and what the benefits are. And is that going to help me in my organization. So I think that's a devops world.

There's a fantastic by the way it Yes, cloudby's puts on devops world, but as I understand it, it's a very multi-vendor. Environment, I mean you have as well as practitioners, so it's not just vendors but it isn't just a bunch of the cloudbe's presentations. You have people from Jay frog and deploy Hub and any number Delight, you know a good number of folks from a lot of different organizations.

So you're gonna hear more than one perspective from one vendor. I think that's one of the healthiest things about this conference. That's absolutely right and the intent when we set up devops so and and forever since has been it's not a cloud Vision.

It's for devops practitioners my develop practitioners whether they are on the consuming side, I customers who used evolves and are trying to adopt their website scale all their people who are Consulting organizations the cloud organizations or you know other product vendors, it's open. It's an open conference Cloud base probably is a very small part of the entire conference. So it's not just a cloud bees Exhibition Center, you know, you will get a Of knowledge and Friends of information and most important a breadth of real life experience people.

People who use it day in day out talking to you. com to register. There's still space available.

It's in Orlando. Great place to be lots of other things to do so you can bring family along with you if you want to or just go down and kind of focus on on the conference. So it's been a pleasure talking with you guys.

Always enjoy your conversations. And this is this is you know, security and software meeting together I think is a fascinating topic and we're all hopefully learning from each other right how best to do this and take on those challenges. Likewise which Greg talking to you again, and thank you for having me.

com to register. I'm fantastic content. We'll hopefully see you there.