As we continue the journey throughout the technology industry on building reliable, repeatable delivery pipelines for software, the shift to DevOps has become more prevalent than ever. Still, security is often considered at the start of a project and tested at the end with little injection into the DevOps processes that are being built for product delivery.

This leads to security gaps, large amounts of unpredictable work at the end of a project to rectify security issues identified late in the development timeline, and often the release of software that has immediate security related bugs added to the next iteration. All of this leads to increased cost both in money and resources. Often times, those "security bugs" have a direct impact on the company's reputation and can lead to user data leaks and privacy breaches.

Shifting security left isn't as simple as plugging in automated tooling. It requires knowledge of types of vulnerabilities and understanding of which vulnerabilities are most likely going to be present in the applications that you are building. This has to be paired with an insight about the impact of tooling on engineering workflow, empowerment of security through understandings of how to work with engineering teams and tooling, as well as useful feedback to engineers, security team members, and managers on the tradeoffs between fast delivery, security, and measures of effectiveness and quality around the choices made.

Our goal is not 100% secure systems. The overall goal of this seminar is to identify and mitigate security concerns at a level that decreases the number of vulnerabilities found in pre/post production testing. Thereby leaving more in-depth testing on production ready application able to focus on the hard to find security pathways and resulting in less cost on security work with each new release.

You will learn:

• About common attack vectors and how they can be addressed in a way that allows for security concerns while recognizing the importance of fast delivery of reliable software products.
• About shifting vulnerability discovery earlier in the engineering process.
• About automation of tooling around common vulnerabilities.
• About incorporation of automated feedback on vulnerabilities into the engineering teams' workflow.
• How to Fail early and often in a useful way, with an eye toward security risk mitigation as part of the DevOps workflow.

Prerequisites:
The session will be intermediate with some advanced information. The exercises will be intermediate level and participants should have a basic knowledge of DevOps to get the most out of the time.

Attendee Workstation Requirements:
You must provide your own computer (Windows or Mac) for this hands-on lab workshop with a camera, wired Internet connection, speakers, and a microphone.

You will also need the following software installed on your machine prior to the training:

• Azcli
• Git
• Docker