WEBVTT

1
00:00.000 --> 00:04.180
Now, throughout the software development life cycle, the continuous

2
00:04.180 --> 00:05.680
implementation and continuous

3
00:05.680 --> 00:10.300
development, there's a lot of security questions that we have. And I use the

4
00:10.300 --> 00:11.200
word questions for

5
00:11.200 --> 00:15.030
reason because there's a couple of questions that we should always be asking

6
00:15.030 --> 00:16.080
throughout any of

7
00:16.080 --> 00:20.220
these processes. And also the implementation through the previous skills that

8
00:20.220 --> 00:21.360
we've done as well.

9
00:21.360 --> 00:25.720
Let's take a look at some of them and ask why? What does the operation/program

10
00:25.720 --> 00:27.040
look like before and

11
00:27.040 --> 00:30.800
after a change? Now, this is really important because we need to be able to do
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:27.040 --> 00:30.800
after a change? Now, this is really important because we need to be able to do

12
00:30.800 --> 00:31.360
a compare and

13
00:31.360 --> 00:36.160
contrast to what we did before and what it looked like afterwards. Is that

14
00:36.160 --> 00:37.840
secure? Is that allowed?

15
00:37.840 --> 00:42.090
Because that goes into our next question of who has access to that data.

16
00:42.090 --> 00:43.040
Because if we have an

17
00:43.040 --> 00:47.230
implementation that opens up access to everybody inadvertently, well, then we

18
00:47.230 --> 00:48.480
got a problem. Are we

19
00:48.480 --> 00:53.470
testing everything and logging everything? Because while we are making sure

20
00:53.470 --> 00:55.040
that the patches in

21
00:55.600 --> 00:59.720
development that we work on implements correctly, we want to make sure that

22
00:59.720 --> 01:00.720
everything is being
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

22
00:59.720 --> 01:00.720
everything is being

23
01:00.720 --> 01:03.760
tested to make sure that there's no bugs behind the scenes just because you can

24
01:03.760 --> 01:04.640
't see a problem

25
01:04.640 --> 01:08.540
doesn't mean that one doesn't exist. And speaking of logging, did we log the

26
01:08.540 --> 01:09.840
entire process of

27
01:09.840 --> 01:14.160
implementation to include software and our equipment used? Because it may not

28
01:14.160 --> 01:15.360
seem like it on the

29
01:15.360 --> 01:19.340
physical side, but even with a cloud environment and software development,

30
01:19.340 --> 01:20.400
there may be physical

31
01:20.400 --> 01:24.380
equipment that we used that we need to know more information about. And did we

32
01:24.380 --> 01:25.680
perform any manual

33
01:25.680 --> 01:29.000
checks? Because we need to make sure that we're going through and double

34
01:29.000 --> 01:30.800
checking ourselves along with
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

34
01:29.000 --> 01:30.800
checking ourselves along with

35
01:30.800 --> 01:35.170
the actual developers inside of the software development life cycle. And this

36
01:35.170 --> 01:36.240
plays into probably the

37
01:36.240 --> 01:40.460
most important question. Do we have an SOP to cover our security implementation

38
01:40.460 --> 01:42.320
operations? See,

39
01:42.320 --> 01:46.800
we don't want to just do willy and illi every program or development that comes

40
01:46.800 --> 01:47.200
through and

41
01:47.200 --> 01:51.200
apply a different standard to it. We need to have a baseline standard and then

42
01:51.200 --> 01:52.480
and on a case by case

43
01:52.480 --> 01:57.230
basis apply different security scrutiny's to whatever it is that's being

44
01:57.230 --> 01:58.960
developed or proposed

45
01:58.960 --> 02:03.380
based on what it actually is that's being worked on for instance. Software
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
01:58.960 --> 02:03.380
based on what it actually is that's being worked on for instance. Software

46
02:03.380 --> 02:05.120
scrutiny for a security

47
02:05.120 --> 02:08.760
concern is going to have different questions asked about it and different

48
02:08.760 --> 02:09.600
checks done to it.

49
02:09.600 --> 02:14.560
Then a hardware implementation. And that's because of the actual coding. Yes,

50
02:14.560 --> 02:15.120
you can go in,

51
02:15.120 --> 02:18.320
work on firmware, machine code, and all this other great stuff. But I'm talking

52
02:18.320 --> 02:19.440
about general

53
02:19.440 --> 02:22.880
up physical upgrades. Let's say you change a video card and something for

54
02:22.880 --> 02:23.760
whatever reason.

55
02:23.760 --> 02:28.860
And that video card has a actual flaw on one of the chip designs. Well, that's

56
02:28.860 --> 02:29.760
a physical hardware

57
02:29.760 --> 02:34.460
problem. Did we do anything to that chip before we installed it? And these are
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
02:29.760 --> 02:34.460
problem. Did we do anything to that chip before we installed it? And these are

58
02:34.460 --> 02:35.360
questions that we

59
02:35.360 --> 02:38.920
develop along the way based on that second set of eyes that we've been

60
02:38.920 --> 02:40.480
emphasizing throughout the

61
02:40.480 --> 02:44.970
entirety of the integration and development process. Now you may be thinking

62
02:44.970 --> 02:46.400
that that's a lot to cover

63
02:46.400 --> 02:50.500
as far as different questions that we have about security. But fear not, we

64
02:50.500 --> 02:52.160
actually have a little bit

65
02:52.160 --> 02:56.650
of a guide to help us build a baseline in case we need to. Now what I'm looking

66
02:56.650 --> 02:58.560
at is the DevSecOps

67
02:58.560 --> 03:03.180
actual GitHub. I have the link for this below the video to go through and allow
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
02:58.560 --> 03:03.180
actual GitHub. I have the link for this below the video to go through and allow

68
03:03.180 --> 03:04.160
us to be able to go

69
03:04.160 --> 03:07.210
through and look at different pieces of information concerning different

70
03:07.210 --> 03:08.160
security factors

71
03:08.160 --> 03:12.080
throughout the organization. I'm providing this as a resource for you out there

72
03:12.080 --> 03:12.720
to be able to go

73
03:12.720 --> 03:17.310
through and just take a browse to go and see the different areas that this Dev

74
03:17.310 --> 03:18.560
SecOps checklist

75
03:18.560 --> 03:22.700
and different projects covers. Some of it may cover something you're working on

76
03:22.700 --> 03:23.920
. Some of it may not.

77
03:23.920 --> 03:27.370
Some of you may be able to piece together to make your own actual standard

78
03:27.370 --> 03:28.960
operating procedure

79
03:28.960 --> 03:33.120
for in terms of security for your organization. By all means, definitely go
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
03:28.960 --> 03:33.120
for in terms of security for your organization. By all means, definitely go

80
03:33.120 --> 03:34.560
through here. And also,

81
03:34.560 --> 03:40.030
don't be afraid to check out resources like NIST, Cybersecurity Framework as

82
03:40.030 --> 03:41.200
far as making sure that

83
03:41.200 --> 03:45.160
we're meeting all the security standards. And it helps in making sure that we

84
03:45.160 --> 03:46.400
can run vulnerability

85
03:46.400 --> 03:50.870
analysis and making sure there are no backdoors into any kind of programs out

86
03:50.870 --> 03:52.000
there that we don't know

87
03:52.000 --> 03:56.660
about. Overall, DevSecOps plays a big part in what we're doing as far as making

88
03:56.660 --> 03:57.360
sure that our

89
03:57.360 --> 04:01.410
organization is secure not only within the organization, but inside of its
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
03:57.360 --> 04:01.410
organization is secure not only within the organization, but inside of its

90
04:01.410 --> 04:03.200
cloud presence as well.

91
04:03.200 --> 04:07.240
Not just with software, platform, infrastructure as a service, but all

92
04:07.240 --> 04:08.320
throughout the actual

93
04:08.320 --> 04:12.970
different architects and environments that we may utilize. Be it here for one

94
04:12.970 --> 04:14.320
single usage or

95
04:14.320 --> 04:19.050
over a worldwide scope of different cloud environments that we hook up to our

96
04:19.050 --> 04:20.240
organization.

97
04:20.240 --> 04:23.120
Security is always of the utmost importance.