Exploring the DevSecOps Toolchain


The authors of the SANS Institute’s DEV540 Secure DevOps & Cloud Application Security course created the Secure DevOps Toolchain poster to help security teams create a methodology for integrating security into the DevOps workflow. As you can see, the poster breaks DevOps down into 5 key phases and includes a massive list of open source tools to help DevOps teams level up their security.

In a new presentation titled Continuous Security: Exploring the DevSecOps Toolchain (Phases 1-2), I spend the entire hour walking the attendees through the first 2 phases of the DevOps workflow:

  • Pre-Commit: Security controls that take place as code is written and before code is checked into version control.
  • Commit: Fast, automated security controls that are invoked by continuous integration tools during the build.

I had the opportunity to present this talk at the Australia Information Security Association’s National Cyber Conference 2018 event this month in Melbourne, as well as a local SANS Community event in Sydney. For those that asked, the presentation slides can be found here:

Continuous Security: Exploring the DevSecOps Toolchain (Phases 1-2)

In the next round, we’ll pick up where we left off and explore Phases 3-4. Until then, cheers!

To learn more about DevSecOps and Cloud Security, check out the DEV540: Secure DevOps and Cloud Application Security course!

About the Author

Eric Johnson is a co-founder and principal security engineer at Puma Security focusing on modern static analysis product development and DevSecOps automation. His experience includes application security automation, cloud security reviews, static source code analysis, web and mobile application penetration testing, secure development lifecycle consulting, and secure code review assessments.

Previously, Eric spent 5 years as a principal security consultant at an information security consulting firm helping companies deliver secure products to their customers, and another 10 years as an information security engineer at a large US financial institution performing source code audits.

As a Certified Instructor with the SANS Institute, Eric authors information security courses on DevSecOps, cloud security, secure coding, and defending mobile apps. He serves on the advisory board for the SANS Security Awareness Developer training program, delivers security training around the world, and presents security research at conferences including SANS, BlackHat, OWASP, BSides, JavaOne, UberConf, and ISSA.

Eric completed a bachelor’s degree in computer engineering and a masters degree in information assurance at Iowa State University, and currently holds the CISSP, GWAPT, GSSP-.NET, GSSP-Java, and AWS Developer certifications.

Continuous Opportunity – DevOps and Security

Thank you to everyone at the Minnesota ISSA chapter for the opportunity to share some background on DevOps and some ideas about how security teams can benefit by adopting DevOps practices & tools. The presentation slides are available here:

Continuous Opportunity- DevOps and Security.

To learn more about DevOps and Cloud Security, check out the new DEV540: Secure DevOps and Cloud Application Security course!

About the Author
At the SANS Institute, Ben Allen works as a member of the Information Security team to protect the world’s most trusted source of computer security training, certification, and research. He applies knowledge gained through over a decade of Information Security experience to problem domains ranging from packet analysis to policy development on an ongoing basis. Ben has contributed to Security best practices for DevOps and operationalized DevOps techniques for security teams leading to improvements in release time and stability.

Prior to joining the Information Security team at SANS, Ben worked in both the operations and development teams at SANS, as a Security Engineer and Architect at the University of Minnesota, and long ago as a systems administrator for the LCSE. Ben holds numerous SANS certifications, and a Bachelor’s degree in Electrical Engineering.