WEBVTT

1
00:00.000 --> 00:05.000
Up until now, I haven't really said much about security.

2
00:05.000 --> 00:06.000
Have I?

3
00:06.000 --> 00:10.800
I mean, we've built an integrated code into our current code base,

4
00:10.800 --> 00:15.300
and then we deliver code to some environment,

5
00:15.300 --> 00:17.400
but we don't really talk about security.

6
00:17.400 --> 00:22.200
If we really broke down a full-fledged DevOps pipeline,

7
00:22.200 --> 00:24.600
you might see something like,

8
00:24.600 --> 00:29.000
upon a GitHub pull request,

9
00:29.000 --> 00:34.500
it will deploy the build environment.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:29.000 --> 00:34.500
it will deploy the build environment.

10
00:34.500 --> 00:36.900
So we'll put build right here,

11
00:36.900 --> 00:40.500
where it then clones the repository,

12
00:40.500 --> 00:44.000
basically copies the code to this local environment,

13
00:44.000 --> 00:48.700
build the code,

14
00:48.700 --> 00:54.000
deliver the code

15
00:54.000 --> 01:00.500
to a Dev server.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:54.000 --> 01:00.500
to a Dev server.

16
01:00.500 --> 01:06.000
Then this repeats two more times for the test environment,

17
01:06.000 --> 01:09.000
and then the prod environment.

18
01:09.000 --> 01:15.500
At no point did we actually come through and check for security, did we?

19
01:15.500 --> 01:20.000
That's because security in the DevOps pipeline for a long time

20
01:20.000 --> 01:25.100
was an afterthought.

21
01:25.100 --> 01:30.600
We didn't really look at security until maybe it was deployed to the Dev
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

21
01:25.100 --> 01:30.600
We didn't really look at security until maybe it was deployed to the Dev

22
01:30.600 --> 01:34.100
environment or in particular the test environment.

23
01:34.100 --> 01:39.700
The test environment is when we start allowing other users to jump in, right?

24
01:39.700 --> 01:42.800
Of course, the developers are going to be in the test environment

25
01:42.800 --> 01:45.300
clicking around and making sure things work.

26
01:45.300 --> 01:49.700
But we'll also do things like user acceptance testing

27
01:49.700 --> 01:52.000
or smoke testing,

28
01:52.000 --> 01:57.800
or even this might be when the security team jumps into the application

29
01:57.800 --> 02:00.200
and starts looking for security flaws.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
01:57.800 --> 02:00.200
and starts looking for security flaws.

30
02:00.200 --> 02:03.700
But this still to get to this point,

31
02:03.700 --> 02:08.700
it still got through this whole pipeline through the Dev environment

32
02:08.700 --> 02:13.900
and then most of the pipeline again for the test environment.

33
02:13.900 --> 02:18.800
And before we actually started looking at security at this point,

34
02:18.800 --> 02:20.000
that's a problem.

35
02:20.000 --> 02:23.800
Security being an afterthought is a problem.

36
02:23.800 --> 02:26.600
So what do we do about this?

37
02:26.600 --> 02:34.500
The idea with DevSecOps is that during these stages,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
02:26.600 --> 02:34.500
The idea with DevSecOps is that during these stages,

38
02:34.500 --> 02:37.500
particularly the build stage,

39
02:37.500 --> 02:45.300
we run tests to make sure the application isn't going to fail security.

40
02:45.300 --> 02:48.300
We also run regular tests at this time too,

41
02:48.300 --> 02:53.300
like unit tests to make sure the application doesn't break functionality.

42
02:53.300 --> 02:57.300
We want to make sure that all of the functions of our application

43
02:57.300 --> 02:59.900
continue to work the way we expect it to.

44
02:59.900 --> 03:04.700
So at some point after the code is built,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
02:59.900 --> 03:04.700
So at some point after the code is built,

45
03:04.700 --> 03:08.900
but before the code is delivered,

46
03:08.900 --> 03:17.200
we want to run unit tests or integration test,

47
03:17.200 --> 03:21.200
anything that makes sure we can integrate into our current environment

48
03:21.200 --> 03:27.700
and then run security tests.

49
03:27.700 --> 03:32.200
Only after these items passed will then be moved on to the next stage.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
03:27.700 --> 03:32.200
Only after these items passed will then be moved on to the next stage.

50
03:32.200 --> 03:35.000
And yes, yes, this environment,

51
03:35.000 --> 03:39.400
we will define the tests in a format that looks like this.

52
03:39.400 --> 03:42.200
This is YAML, by the way.

53
03:42.200 --> 03:45.900
It'll define all of our tests in a format that looks like this.

54
03:45.900 --> 03:51.200
And if the tests fail, that stops the pipeline from running,

55
03:51.200 --> 03:56.300
and it notifies the pipeline owners that CI has failed,

56
03:56.300 --> 03:58.500
and here are the reasons why.

57
03:58.500 --> 04:01.500
So they'll be able to see if it was a unit test that failed
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
03:58.500 --> 04:01.500
So they'll be able to see if it was a unit test that failed

58
04:01.500 --> 04:04.200
and specifically what in the unit test that failed,

59
04:04.200 --> 04:09.650
or if a security test fails and specifically what in the security test that

60
04:09.650 --> 04:10.400
fails.

61
04:10.400 --> 04:14.000
So this is now where DevSecOps comes into play.

62
04:14.000 --> 04:20.100
We can now confirm that we're not running into major security flaws,

63
04:20.100 --> 04:27.000
like leaking secrets or any type of injection attacks or scripting attacks,

64
04:27.000 --> 04:29.600
anything that we can test for.

65
04:29.600 --> 04:33.900
We can now build into the pipeline in an automated fashion
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

65
04:29.600 --> 04:33.900
We can now build into the pipeline in an automated fashion

66
04:33.900 --> 04:40.200
and fail the build, fail the pipeline in the event that these tests fail.

67
04:40.200 --> 04:44.200
That gives our developers a chance to fix any problems

68
04:44.200 --> 04:48.000
before it ever makes its way into a production environment,

69
04:48.000 --> 04:53.800
and that keeps our application online and running and generating revenue.

70
04:53.800 --> 04:56.800
So in the next video, really the next couple videos,

71
04:56.800 --> 05:02.300
we'll take a moment to pause and actually look at what the security portion
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
04:56.800 --> 05:02.300
we'll take a moment to pause and actually look at what the security portion

72
05:02.300 --> 05:06.400
of the DevSecOps pipeline is going to look like.