for agile & devops pm toolbox 2.0: managing …...introduction to devops - fit within other...
TRANSCRIPT
Amalia Barthel, Raluca Blidaru, Carlos ChalicoSeptember 29th 2018
PM Toolbox 2.0: Managing Information Risk for Agile & DevOps
WELCOME!
3
Agenda
Section Presenter Time
Breakfast 8:00-8:30 am
Welcome and Introductions PMI 8:30am
Overview of Information Security Key Concepts Carlos Chalico 8:45 – 9:05
Information Security Alignment with IT Governance Carlos Chalico 9:05 – 9:35
Break 10 min
Introduction to DevOps - fit within other approaches (Waterfall and Agile Environments Raluca Blidaru 9:45 – 10:00
DevOps and Traditional Project Management Amalia Barthel 10:00 – 10:25
Overview of Integrated Cybersecurity Risk Management Carlos Chalico 10:25 – 10:50
Break 10 min
Cybersecurity and Project Risk Management Amalia Barthel 11:00 - 11:15
Putting All Together - Security DevOps and Risk Management Raluca Blidaru 11:15 – 11:30
Break 10 min
Key Take - Aways Amalia Barthel 11:40 – 12:05
Q&A All 12:05 - 12:20
Closing PMI 12:20-12:30
Amalia Barthel
20+years
CISMCISM
CRISC
PMP
LSigma
CIPTCIPM
Raluca Blidaru
10+years
CISACRISCCISM
GSEC
CISSPCIPTPMP
Carlos Chalico
20+years
CISACISSPCISM
ISO27001LA
CGEITCRISCPbDA
@carloschalico
OVERVIEW OF INFORMATION SECURITY KEY CONCEPTS
Data Vs. Information
Knowledge
Information
Data
Intelligence
Lowest level of abstraction from which information and then knowledge are derived
Sequence of symbols, data, that can be
interpreted as a message
Acquaintance with facts, truths or
principles;
Why?
Automated data processing is growing
Things are getting connected
Source: CISCO, 2011
What?
What to protect?
Information Governance
Nonrepudiation
Authentication
Availability
Information Security
Cybersecurity(Electronic)
InformationProtection
Confidentiality
Integrity
Privacy
Security Gap
Security Gap
IT is important!
How?
Related Frameworks
TARA
COSO
ValIT RiskIT
NIST
ISO 38500
COBIT
INFORMATION SECURITY ALIGNMENT WITH INFORMATION GOVERNANCE
Information Governance
ISACA, where COBIT comes from• Founded in 1969, as the EDP Auditors Association
• Evolved to the Information Systems Audit and Control Association
• More than 140,000 members in over 180 countries
• Over 200 chapters worldwide
• Toronto Chapter has over 2,800 members, largest in Canada
• Developed COBIT and Cybersecurity Nexus
• Four industry-leading certifications:
COBIT History
IT Governance
COBIT4.0/4.1
Management
COBIT3
Control
COBIT2
A business framework from ISACA, at www.isaca.org/cobit
Audit
COBIT1
2005/7
20001998
Evo
lutio
n of
sc
ope
1996 2012
Val IT 2.0(2008)
Risk IT(2009)
© 2012 ISACA® All rights reserved.
COBIT 5
COBIT 5
COBIT 5Governance ensures that stakeholder needs, conditions and options are evaluated to determine balanced,agreed-on enterprise objectives to be achieved; setting direction through prioritisation and decision making;and monitoring performance and compliance against agreed-on direction and objectives.
Management plans, builds, runs and monitors activities in alignment with the direction set by the governancebody to achieve the enterprise objectives.
COBIT 5
COBIT 5
What´s the challenge now?
INTRODUCTION TO DEVOPS
What is DevOps?
“Devs are from Venus. Ops are from Mars” - Steve Haines
From Waterfall to Agile, to DevOps
“Growing” from Agile to DevOps
https://en.wikipedia.org/wiki/DevOps
https://bikeshsrivastava.blogspot.com/2017/01/part-43what-is-agile-methodology.html
Why DevOps?
Goals of DevOps
How does DevOps work?
DEV
OPS
(+ UX)
Where does Risk fit in DevOps?
● Security built-in ● Risk management frameworks● Compliance audit processes
Break – 10 minutes
DEVOPS AND TRADITIONAL PROJECT MANAGEMENT
38
OK: WHY DevOps?
• IT Enterprises need to compete – who has time for regular development?
• Agility vs. Stability : Customers are demanding : better products, more features,
RIGHT NOW!!!
• Information is the new GOLD which enables products on the market
• Applications are a highway for information exchanges and business gains
• Strategic IT Leaders win but their budgets are shrinking: shared infrastructure!
• IT Leaders are pressured to better align IT with Business Goals & support
revenue generation
• Information Governance: know what data you have, where, who has access to
it, who needs to have access to it, how do we monetize it?
CONFIDENTIAL
39
Project Managers
• Manage projects which produce a product or a result IN SUPPORT of a Business objective
• Understand application development, QA, testing, release into production
• Practice Risk Management
• Motivate Teams
• Facilitate learning and exchange of information between team members
• Are great communicators
40
Does DevOps mean?• No planning? ADAPTIVE LEARNING
• No change control? ADAPTIVE PLANNING
• No documentation? Code documentation requirements
• No meetings? SHORT AND FOCUSED MEETINGS
• No process? VERY WELL DEFINED PROCESS
• Bullet proof? INTEGRATE & FAIL OFTEN
• Just need to know how to code? DEVELOPER SECURITY TRAINING
• No project manager? Developers run amock???
41
Project Manager Strengths ….and Opportunites
• Need to create a CULTURE of DevOps (what does “culture” mean?)
• Focus on software development delivery success
• Integrate Quality into delivery
• Ability to react rapidly and adjust to a fast pace
• Understanding Regulatory requirements (for security & privacy)
• Be conversant with “Availability” as a parameter/attribute in rapid development: performance is directly linked with availability
• Management Reports …. How are the DevOps Teams prepared to support SecDevOps* (security testing tools to act as Acceptance Testing)
• Security Tools Integration
42
A Culture of DevOps• Developers need to be trained on security for DevOps
• Culture of learning (kinda’ like Lessons Learned but Postmortems)
• NO SILOS : Share the learning (blameless Postmortems)
• Proactive Product Managers : look at the history, at what you know (vulnerabilities) and push training (update the training)
• Adapting to change – the 3 Part Framework (Larry Maccherone) DevSecOps Manifesto :
»Build Security in (*by design, not afterthought)»Empowered Engineer Teams (*not security specialists)»Implement features securely (*not security features)»Build on a Culture of Change (*rather than Policy Enforc)
43
The DevOps Continuum
44
Just one example……
But…..Traditional vs. Agile
⇥ Predictability, stability⇥ Heavy bureaucracy, rigid procedures ⇥ Process driven ⇥ Upfront, extensive design & planning⇥ Sequential⇥ Hierarchical, top to bottom approach⇥ Large teams, multi-tasking⇥ Perfection focused⇥ Change process to follow
Traditional Project Management Agile Project Management
⇥ Acceptance of unpredictability, adjustment to reality⇥ Minimal Bureaucracy, follows principles⇥ Activity driven⇥ Design & Plan as needed⇥ Iterative and Incremental ⇥ Flat, lean structure⇥ Small, empowered teams⇥ Just enough focused⇥ Quick to respond change
CONFIDENTIAL
Agile ….. Or DevOps?• Agile works in “sprints” which is considered 1 unit of code
• DevOps cannot assess the security of the application with 1 unit of code at the time = it works with chunks of code
• Chunks can be evaluated in production to understand if the functionality and security of code was achieved
• When Agile sprints include “shippable code” – this can be evaluated for security
• Not handy to have “shippable code” – you also need a “ready” environment to try out the code = DevOps
DevOps Roles and Responsibilities
• Project Manager or Product Manager
• Application Developers
• Risk Management (Infrastructure Security, Code/ Application security)
• Reporting?
• Budget Tracking?
• Schedule Tracking?
• Quality Tracking?
• ?????Facilitate learning and exchange of information between team members
DevOps Roles and ResponsibilitiesBusiness Objectives
Business capability
PLATFORM
Application environment
Infrastructure
Quality + Availability +Performance
Information Security/ IT Risk Management
49
Roles….cont’d
CONFIDENTIAL
50
51
Waterfall vs. Agile vs. DevOps
52
OVERVIEW OF INTEGRATED CYBERSECURITY RISK MANAGEMENT
Why is risk management important?
Organization
Stakeholders Customers
Risk Management
$
What is risk?
“The possibility of an event occurring that will have an impact on the achievement of
objectives, and it is typically measured in terms of likelihood and impact”
Possibility Threat
Vulnerability Asset
Likelihood Impact
Source: CGEIT Review Manual 2015 ISACA
What to do with a risk?
Risk
Control Ideal Scenario
Source: EY Mexico
What to do with a risk?
Risk Control
Over-Controlling
Source: EY Mexico
What to do with a risk?
Risk
Control
Residual or Remanent Risk
MitigateEliminateTransferAssume
Source: EY Mexico
How?
NIST Cybersecurity Framework
Source: NIST Cybersecurity Framework
http://www.nist.gov/cyberframework/upload/cybersecurity-framework-021214.pdfhttp://www.nist.gov/itl/csd/the-stakeholders-have-spoken-nist-to-refine-cybersecurity-framework.cfm
Using COBIT 5 to implement NIST CSFNIST Steps to use the CSF to implement a new cybersecurity program or maintain an existing one:
• Prioritize and scope
• Orient
• Create a current profile
• Conduct a risk assessment
• Create a target profile
• Determine, analyze and prioritize gaps
• Implement action plan
Using COBIT 5 to implement NIST CSF
Using COBIT 5 to implement NIST CSF
Going beyond the CSF
Going beyond the CSF
• Prioritize and scope
• Orient
• Create a current profile
• Conduct a risk assessment
• Create a target profile
• Determine, analyze and prioritize gaps
• Implement action plan
Going beyond the CSF
Summarizing
• There are valuable frameworks to help implement an effective cybersecurity risk management program.
• There are effective frameworks to integrate the cybersecurity risk management program into a broader ERM program.
• You can decide which frameworks to use.
• The most important exercise includes.
– Understanding risk appetite and tolerance.– Organization’s current and future state.– Gaps.– How to close them.
• DevOps can be part of that current or future state.
Break – 10 minutes
CYBERSECURITY RISK AND PROJECT RISK
70
History of Risk
According to Peter L. Bernstein dividing line between what we should call ancient
times and modern times is mastering risk!*
• Earliest concept of managing risk arose because of gaming
• Gaming gave rise to probability theory
• First actuaries worked in England as early as the 1700s
• The modern terms for managing risk rose after World War II (Risk
Management: History, Definition, and Critique by Georges Dionne)
• 1950s to the 1970s, risk discipline began to expand to alternatives
* Against the Gods: The Remarkable Story of RiskCONFIDENTIAL
71
Risks vs. Issues
Uncertain Certain
Futuristic Current
May impact objectives Has/will impact objectives
Unknown impact value Known impact value
Risks vs. Issues
CONFIDENTIAL
Organisational Risk Management
Strategic
Programmes
Projects
Operational
Long term
Medium term
Short term
CONFIDENTIAL
73
Risk Management Overview
Project Risk is when an uncertain event, or condition occurs, that has a positive or negative effect on one or more project objectives, such as; Scope, Schedule, Cost and Quality.
Objective of Risk Management is to increase the likelihood of positive events, and decrease the likelihood of negative events that will impact the project.
CONFIDENTIAL
74
Risk Management Overview
75
Projects, Programs & Portfolios in the IT Organization (COBIT 5)
Projects
76
77
Residual Risk in DevOps
78
Project Management Risk• Inherent in every Project Management process & activities
• Residual risk needs to be reviewed and stays in the Risk Register
79
DevOps Risk Management
80
Empowered DevOps Teams….• Developers will know to balance out the business risk vs.
security/privacy risks → they are closer to the business
• They need to feel they are trusted– the Team knows they will do the right thing!
• Security Team needs to provide tools and knowledge resources to help the Empowered Developer Team
• Security Team is no longer the Gate Keeper but trusted Advisors
• Development team needs to trust the Security Team to provide the right tools at the right cost/effort ratio
• Security Team to guide the Development Team on preventative security practices and assist assist assist with security incidents!
81
DevSecOps Self Assessment
• More mature practices : green belt training, security architecture review (threat modelling?), security POC for components of the app, etc.
• DevSecOps Tools: Policies will stop the development unless scans are clean, use OWASP and set targets
PUTTING ALL TOGETHER – SECURITY, DEVOPS AND RISK MANAGEMENT
Today’s story is ...
84
Let’s remember how everything started ...
• “The Problem”: Delivery time was too long.
• Testing a platform software enabling faster deployments• Infrastructure• Code
• Dev&Ops in a “platform”• Configuring resources in a programmatically manner• Pipelines for development lifecycle• Automated testing (security, functional)• Reporting bugs automatically• Promotion of the code to the next environment
PoC - Continuous Deployments
Champion Team:• Project Managers• Developers• System Administrators• Integrators• 3rd party Consultants
R&D
MVP
Scope:• Test the platform• Develop one Minimal Viable
Product• Reengineer processes
The result: a Minimum Viable Product
Experience Towers
DEVTESTPROD
DEVTESTPROD
DEVTESTPROD
DEVTESTPROD
Moving from MVP to Enterprise
… with Advantages
andDisadvantages
88
What Could Have Gone Wrong?
• Security is not turned on “by default”• Encryption, High Availability• Hardening, Patching, Vulnerability Management• Segregation of duties• …
• Skills are not transferred automatically
• Architects, Developers, QA, DBAs, System Admins, …
• Project Managers, Project Coordinators, ….
• Automating the solution delivery ≠ the automation of compliance
One solution: updated Risk Management framework
What happened next?
90
Organizational Changes
91
Building the future state
92
Updating Risk Management methodology• risk assessments are part of the Agile
processes• roles and responsibilities were
assigned: Developers/Engineers (risk owners), Risk Officers (risk controls implementation, L1), Risk Bench Team (risk governance, L2)
• developed Security Stories• created Risk adjusted
Backlog • documented accepted risks
93
And not only ...
• Cross functional domains training:– Info Risk team is trained about Agile Frameworks– Developers, Engineers, Architects take Security training– Product Managers learn about Information Risk Management
• Train the Trainer:– Project managers become Scrum Master Certified
94
Why? To go SecDevOps.
To change this…. into this:
95
Questions?
96
References• ISACA COBIT 5 & COBIT 5 for Risk www.isaca.org
• https://medium.com/@cote/roles-and-responsibilities-for-devops-and-agile-teams-fdacbffb4cb4 Tbd
• http://www.isaca.org/Education/Conferences/Documents/COBIT/2.3.pdf
• COBIT 5 for Information Security
• Bright Talk Webcast :How to Achieve a DevSecOps Culture Using a Lean-Agile Approach (https://www.brighttalk.com/webcast/15811/330332?utm_campaign=viewing-history&utm_source=brighttalk-portal&utm_medium=web)
• https://resources.whitesourcesoftware.com/white-papers-datasheets/the-main-pillars-of-the-devops-2
Thank you!
& SPECIAL THANKS TO UNIVERSITY OF TORONTO FOR THE VENUE
Email: Contact Us, Questions about this presentationAmalia Barthel: [email protected]; [email protected] Blidaru: [email protected] Chalico: [email protected]; [email protected]
WEBSITE: http://www.soc.pmi.on.ca/ ➢ PDUs: 2.0 Technical, 1.0 Leadership, 1.0 Strategic
➢ Interested in IT Risk Management & Cybersecurity?➢ Visit School of Continuous Studies – course SCS_3373