Narrator: You're listening to the humans of DevOps podcast, a
podcast focused on advancing the humans of DevOps through skills,
knowledge, ideas and learning, or the SK il framework.
Jamal Walsh: I think what's hard in when it comes to software
development and security is thinking like someone who wants
to attack kill your system, your services. And I think working
out how you embed that into your engineering teams is kind of the
big challenge around dev SEC ops.
Jason Baum: Hey, everyone, it's Jason Baum, Director of Member
experience at DevOps Institute, and this is the humans of DevOps
podcast. Welcome back. Hope you had a great week. Last Tuesday,
February 8, we actually celebrated safer internet day.
Never heard of it. I actually heard hadn't heard of it either.
But safer internet Day was celebrated for the first time in
2005. And the goal is to spread awareness about online privacy
and security. This year, its theme was together for a better
internet and called upon stakeholders to join together to
make the internet a safer and better place for all sounds
pretty great to me. And so with that in mind, we we found our
next guest and and begged him to come back to the show. Jamal
Walsh is here with me to discuss online security and more
specifically, def SEC ops. Jamal is a passionate agile and DevOps
practitioner with a keen interest in the human side of
agile and DevOps practices. He also happens to be a DevOps
Institute ambassador, and was a guest of this podcast back on
episode 36. So if you'd like to learn more about Jamal, I
definitely encourage you to have a listen to that episode. We
discussed everything from applying DevOps practices to
legacy platforms, to airline hangars, to mountain biking, and
more. So definitely have a listen to that you'll learn a
whole lot about Jamal. It's a lot of fun. And that description
sounds about right for this podcast. So Jamal, welcome back
to the podcast. Thanks so much for coming.
Jamal Walsh: Thanks, Jason. Great to be here. Again, always
a fun conversation. I think this one today is probably front and
center of everything I'm doing at the moment. So I'm really
looking forward to having a chat with you.
Jason Baum: Awesome. Well, we're excited to have you and are you
ready to get human again? Oh, yes.
Jamal Walsh: 100%.
Jason Baum: Excellent. So dev SEC ops. So there's DevOps, I
know of all the ops, there's a ton of ops. Yeah. So dev SEC
ops, I know, applying DevOps principles to security
practices, I'm assuming, and then what?
Jamal Walsh: Yeah, I guess I guess it. So it's always an
interesting one, right. I think I think when people see dev SEC
ops and wonder what it means, for me personally, I think it's
about ensuring you apply security thinking, to you know,
every step of your kind of software lifecycle. You know,
and that can be from really early on when you're actually
discussing and designing things that you're going to implement
to the actual kind of operation and support and monitoring of
the stuff that you build. So it's kind of all encompassing,
in my view, you know, it's about thinking about security every
step of the way. And obviously, embedding that within your
development teams, and ensuring you know, the things that you
build a secure, and you do it in a way that doesn't slow you
down, because I think a lot of the old security practices can
sometimes get in the way of being, you know, agile and
delivering things quickly to customers. So yeah, that's
that's my personal view on it anyway. Yeah.
Jason Baum: When you say the security practices, I mean, I
think of I mean, on the front end side of using something like
two factor are often often, often often taken. Ah, gosh, I
can't say the word. So hard. Yeah. Thank you. It's so hard to
even say the word, let alone then have to do it and get the
text message or the email. And so yeah, I mean, it becomes
cumbersome. When you're applying it to software development, is
it kind of like when you're testing something you like build
it to break it? And just so you're building something to
kind of get around it? Is that Is that what you mean by that?
Or
Jamal Walsh: I think, I think, I think what's hard in when it
comes to software development, and security is thinking like a
malicious actor, someone who wants to, he wants to attack
your, your system, your services. And I think, I think,
you know, a lot of a lot of software engineers kind of find
that hard because essentially, they want to build, you know,
they want to build great products, great features. And I
guess it's hard to actually think about how could someone
take advantage of what I'm building? What can they do, how
could they access it and what could they do if they if they
actually access it? What kind of information can they get and
what kind of problems causes as an organization. So yeah, I
think it's the mindset and the way of thinking is very
different to kind of your standard engineering practices,
and kind of working out how you embed that into your engineering
teams is kind of the big challenge around DevStack. Ops.
Yeah, it's
Jason Baum: interesting, because it's not really a bug, right?
It's working, it's working fine. But how would someone circumvent
yesterday, the rules that exist, I guess, the logic that exists?
Jamal Walsh: Yeah, yeah. And you have to, you know, you really
have to think about it every step of the way. Because, you
know, even from the point, you start thinking about what you're
going to build and how you're going to build it, it's a we do
something called threat modeling, a very group. And that
means we will take a design, before we even code anything,
we'll design the system, and then we'll do something called
Threat Modeling before we even write a line of code. And that
will allow us to think, like a malicious actor. And think about
the, you know, the attack vectors of the application,
where someone where there might be some exploits and things like
that. And then, as we design and implement the system, we'll take
those risks. And we'll make sure we put security controls in
place to mitigate anything we've identified really early on.
Because the last point you want to find a problem with security
is in production. So you know, there's lots of different steps
you can take, right? Through your software development
lifecycle workflow, you know, it's this whole, this whole old
concept of shifting stuff left, security is the same, right?
The, the sooner the, if you move it more towards the left, then
you can find these problems sooner, fix them sooner, and the
impact of those things is much less. So this
Jason Baum: is the humans of DevOps. And so I find it
interesting to get in the head of a malicious actor, what does
that look like? How does it how do how does one channel that
that malicious actor rather than just, you know, looking at the
code, and where one might, I think, I'm assuming you have to
get in their their brain a little bit, right?
Jamal Walsh: Absolutely. I mean, we have, we have security
experts working in the business, and we also have partners who
will speak to as well. It's, I think, it's, it's really hard to
put yourself in that mindset, because it's not a natural
mindset. You know, you know, it's not a day to day you don't
think on it, you know, a good engineer is not thinking about
how, how they can take advantage of a software system. So I
think, yeah, I think, I think helping people get in that
mindset, you need to help people with experience of that. And,
you know, I've worked with some great security consultants, pen
testers, and, you know, there's these concepts of red and blue
teams and purple teams in the security space. And it's purely
their job to think in that way. But I think it's really
important that they don't just do that alone, that they sit
with other engineers, and, you know, your QA engineers, your
software engineers, and impart that knowledge in that way of
thinking on to the engineer, so they can think about those
things when developing software.
Jason Baum: So it's pretty safe to say that security should be
more of a consideration for all dev SEC ops teams.
Jamal Walsh: Yes, absolutely. 100%. I mean, you know, you just
have to look at the, you know, I think there was a the lock for J
incident recently, where, you know, the logging package had
been activated, there was an extra zero day vulnerability in
log for J. And, you know, instantly people are scrambling
around trying to patch that. And, you know, some companies
were, you know, fell foul of that, because they, they weren't
able to patch their systems quick enough, or they were
unlucky enough to have someone take advantage of that, that
that vulnerability. And then there's so many ransomware
attacks happening these days, I mean, that, that, that for me at
the moment that the kind of plural proliferation of the
ransomware attacks at the moment, is staggering. And that
that for me and for the company I'm working with at the moment
and probably most companies is probably the scariest thing
right now from a security point of view. You know, if, if one of
these bad actors gets in and can get this ransomware on your on
your machines, you know, they can completely encrypt your
entire data. I mean, there's a company in the UK called KP
snacks. They actually make my favorite brand of crisps be
fooled hoops. And they were attacked with ransomware just
last month, and that's completely affected their supply
chain massively. So none of their crisps are in the shops at
the moment. And while you're pretty angry, I'm an unhappy
customer. Yeah, that
Jason Baum: would drive me crazy.
Jamal Walsh: You know, this is this is you know, this is the
kind of the fallout from you know, not, you know, be having
those exploits. How In your systems, they can they can cause
real problems. You know, from a, from a, from a brand point of
view and just from a trainer trying to fix these kinds of
things is real.
Jason Baum: Yeah, I mean, let's talk about that. So it's it's
safer internet day and just talking about security and or
last week was safer internet day. And we're talking about
security. And we're not talking about just safer internet for
our children to go on to I mean, obviously, that's very
important. And, and all that. But we're also talking about
safer internet as far as practices to keep your data safe
and companies safe and their data safe. More importantly,
because your data's their data. So where it How does that all
fit in? We talked about the ransomware attack, what what are
they after? What are they looking to exploit? And why
should that become more of a priority for businesses? Or why
is that a priority for businesses? Right?
Jamal Walsh: So I think ransomware is, I think, one of
the things as well as I don't think, I don't think we actually
know how rife is because I think a lot of companies just pay the
ransom, and get the concept. Yeah, and so. So you know, a lot
of these things we're not we're not aware of even happen,
because the companies don't want to publicize the fact that this
has happened in a lot of cases, because it affects their brand.
And in some in some scenarios they do, and they have to
because they're just impacted so badly. But from a, you know, a
mitigation point of view, there are so many things you need to
think about, you know, you know, encrypting your data at rest,
making sure you have regular backups, and your backups are
stored completely separate from everything else that you're
doing. You know, and just being able to practicing the disaster
recovery side of things to ensure that if, you know, if
something like that does happen, how quickly can you restore? How
much is it going to impact you. And, you know, sometimes, with
these attacks, you just don't know, you know, if you're, if
you're a large enterprise, and they've managed to infiltrate a
large portion of your network, then you know, recovering from
that can be a hell of a, you know, a hell of a job. And, you
know, sometimes the cost of trying to recover from that,
versus the ransom demands, you know, this is why a lot of
companies kind of, you know, weighing those things up, and
obviously, just some of them are settling, without even, you
know, telling anyone or letting anyone know that something's
happened. But you know, the there are, there are lots of
things you can do to mitigate it. But again, I think it's more
about planning, planning for it to happen, I think is the most
important thing, and making sure you've got the right processes
and tools and steps in place to and you practice, you know, what
you would do in that kind of scenario, I think is really
important.
Jason Baum: Well, it kind of goes back to what you said,
catching it in production, right? I mean, those earlier
phases, so that you don't get to that point where you're working
too far.
Jamal Walsh: Yeah, so there's the there's the kind of the
processes you take between during your development
lifecycle. So you've got things like Threat Modeling really
early on to identify any potential gaps in your security
and the design of your system and its architecture. And then
next, you've got kind of checking your code to ensure
that there's no vulnerabilities being developed within the
source code itself. And then the big one at the moment is kind of
the dependencies that a lot of you know, organizations pull
into the software that they're developing. So you know, you're
pulling in packages from external sources, and you want
to be you want to be checking, you know, scanning those
dependencies and ensuring there's no vulnerabilities in
the software that you're pulling in from other people. You know,
and then there's obviously, load lots of other stuff you can do
in the in the development part, if you're using containers, you
can have scanning, you can scan the images of your operating
systems in those containers, and then all the way down to kind of
securely monitoring your, your, your website and applications
from, you know, putting web application firewalls in place.
And there's tons of, you know, kind of bought detection
software that will detect if people are trying to do
credential stuffing on your website and things like that. So
there's, there's a vast amount of things you can do as an
organization to kind of protect yourself.
Jason Baum: We're investing a lot in security, and I would
assume that businesses, you know, obviously they see this
threat. We've we talked about that, but how has that kind of
changed or the the landscape of the role of US security
specialists, you know, the type of people that companies are
looking to, to hire bring in to solve this?
Jamal Walsh: Yeah, I think I think there are different types
of security specialists. So there, you get your consultant
types, you'll come in and consult around a large, you
know, security in you especially in an enterprise organized
organization is vast. I mean, you've got you've got the, you
know, from from, you know, uses laptops, and the networks and
all of that, that they use to the software they're developing.
I mean, security as a subject matter in a large organization
is enormous. And generally, that's where you'll have
security consultants, and, and C ISO type people who kind of
manage the whole scope of that. But from a software development
point of view, I think it's always good to have someone who
deals with the security having a software development background,
because I think that allows you to have a conversation about
security and software development at a level that
really helps your engineers understand, you know, the
implications and the cost of not doing security properly.
Jason Baum: Today's episode of the humans of DevOps podcast is
sponsored by collide collide is an endpoint security solution
that sends your employees important and timely security
recommendations for their Linux, Mac and Windows devices, right
inside Slack collide is perfect for organizations that care
deeply about compliance and security, but don't want to get
there by locking down devices to the point where they become
unusable, instead of frustrating your employees collide educates
them about security, and device management while directing them
to fix important problems. You can try collide with all its
features on an unlimited number of devices, free for 14 days, no
credit card required. Visit callide.com/h o DEP to sign up
today. That's callide k olid.com/h. O DEP enter your
email when prompted to receive your free collide gift bundle
after trial activation. Yeah, and I'd be remiss to mention
that our sponsor collide, we had Jason Miller, the CEO of collide
on and talked about, he's the author of honor security. And we
talked about how, you know, all these threats are becoming more
sophisticated, the steps to prevent them are becoming more
sophisticated. But then you have a whole line of all the people
who who are employed by you, and you need to take steps to make
sure that they are being safe, and that they are not
compromising the organization. And but you need to do it in an
honest way. And one that's not too cumbersome. And I'm assuming
that's a big piece of what plays into this, how do you make the
employees feel like, the big brother isn't like just watching
every move that they take?
Jamal Walsh: Yeah, it's really interesting. And you know, I
work we work, we work in a financially regulated business
as well. So, you know, it's even even more stringent in
financially regulated businesses, when it comes to
security and things like that. There are certain changes
happening in the PCI compliance space where you have to start,
you know, talking about how you're securing your software
development. And they never, never seen that in any kind of
PCI audits before, and now they're really starting, you
know, if you're financially regulated, and you're doing
payments and things like that, then yeah, they're starting to
really delve deeper into your architecture and ensuring your
engineers are kind of up to date with everything that's going on.
There's, there's obviously a lot of training. And I think the
other thing we seen in one of the latest PCI audits that we
had to do is we had to prove that our engineers were taking
regular security training. So you know, these, these are the
things that are starting to happen now with, especially in
the regulated space is that you're now having to show that
the engineers that are developing your software that is
financially regulated, for example, have taken some
relevant training to ensure that they practice secure coding and
things like that.
Jason Baum: It's so funny, I remember at one of my my very
first jobs, we during orientation, you all go into the
room and they have the chief, you know of information
technology, and they sit you know, they have everybody sit
down, I do the presentation on if you get a suspicious email,
make sure you forward up to us and don't open it. I feel like
we have come such a long way from that, you know, that that
orientation meeting, but in many ways, it still holds true, but
yeah, it's like, this is a completely different world.
Jamal Walsh: Yeah, so we have a we have some software in the
company that actually sends out malicious emails. Purposely. Oh,
really to see if there yeah, if you click on them, it will tell
you if you forward it on like you're supposed to you get a
little pat on the back. So
Jason Baum: I was gonna say what happens if you click on it? Do
they like send yell?
Jamal Walsh: No, no, no, it's much more friendly than that. I
think it's just This day is to help people recognize when, as
you know, I think it's really helpful for everyone, right?
It's not just for, for work, it's people in their, in their
personal circumstances and things like that. Being able to,
you know, recognize those kinds of malicious requests and emails
and things like that is a really, you know, important
thing, not just inside workbook personally as well.
Jason Baum: Yeah, I mean, you see it all the time, my Twitter
was hacked, my Facebook was hacked, please don't respond to
this email for me. It's not me. Yeah. It's, it's, it's very
prevalent. So what are the biggest security issues facing
DevOps teams?
Jamal Walsh: Um, I think, I think, I think training is one
of the biggest things, kind of, you know, from, from a, from a
DevOps team point of view, it's about having multidisciplinary
teams, where you all work together to deliver, you know,
fast, secure software. And I think, I think from a from a
security point of view, it's, it's, it's bringing everyone up
to speed, to be able to understand, you know, what it
means to be secure what, what tools and processes, can you and
there's so much to think about? Engineers have a lot to think
about anyway, when it comes to software development. And then
this just adds another layer of complexity on top of that. So
yeah, it's, it's, it's, for me, the biggest challenge, and the
biggest issue is, is understanding how you can
improve that awareness. And, you know, add those security skills
and mindsets to the engineers, not just software engineers, QA
engineers, you know, all the roles within your, your kind of
your DevOps team.
Jason Baum: And you're doing all that, and you can't slow things
down. I think that's right. I mean, that's a huge piece.
Jamal Walsh: So that is probably the most important part of the
whole thing for me is the fact that if you if you get it wrong,
security can absolutely cripple you. Because, you know, security
can turn around and go, you can't release that into
production. Yeah. And then you stopped. And it's for me, it's
finding the right balance of security versus getting features
and products out to your customers. And that part is the
balance is the the most heart the hardest thing to kind of
find wins in that scenario. Well, it's, it's a negotiation,
right? Security want you to be 100%, secure, and you want to
get product out to customer. And in the end, it's a lot of risk
management. So it's about, you know, understanding, you know,
why you're not going to do something and saying, you know,
if you're not going to, if you're not going to implement a
specific thing, because it may take a long time and the risk is
quite low, then it's something you can discuss and negotiate
and say, right, well, maybe, you know, we'll do this, this and
this, which will give us, you know, this level of security,
and then we will start to develop the other parts and add
that over time. It's about for me, it's about continuous
improvement if you try and if you try and go for 100%,
security upfront, you're never going to deliver anything to
your customers. So yeah, it's about the continuous improvement
and working with security to gradually get more and more and
more secure.
Jason Baum: What are the little things we can do because, you
know, celebrating the Safer Internet day and with that
general theme of together for a better internet, and things that
we can all do personally to help secure ourselves or family make
the internet just in general safer? What are the little
things that we can do?
Jamal Walsh: So my number absolute number one tip is get a
password manager. So I use LastPass other password managers
are available. But yeah, I think I think, you know, we spoke
before about credential stuffing. So for those who don't
know what credential stuffing is, it's where malicious actors
go on the dark web, get a list of credentials that have been
taken from a hacked website. So if your credentials are in that
list, your email and your password, they use credential
stuffing, then and what they'll do is they'll take that email
address and that password, and they will go off to hundreds and
hundreds and 1000s of websites and they will try and access.
Those are the sites Facebook, you know all the social sites
with those credentials that they've taken from another
system. And if they get access to that, that then got access to
you know, and if you're using the same email and password on
all those different sites, you're going to be in real
trouble trouble pretty quickly. So having Password Manager and
making sure all your passwords are unique in each different
system and password managers make that really easy. Some of
them will even go in and automatically change your
passwords every month for you. So yeah, that would be my number
one thing And then the second one is, anywhere you're doing
any kind of financial transactions, or anything to do
with money, because this is where, you know, bad actors are
really focusing on that's where they want to get your get your
hard earned cash. I would definitely have MFA, so multi
factor authentication, any any kind of banking or anything like
that any way, anywhere where you're spending if MFA is
available, and switch it on, get the app on your phone, and use
the apps don't use text MFA, because text MFA sends a coding
clear text. So always try and use an authenticator app on your
phone.
Jason Baum: I mean, are we at the point where biometrics needs
to be part of this? And eventually, you know, some of
the most secure sites that I've been on at least, the government
sites use biometrics, but at this point?
Jamal Walsh: Yeah, I think I think there's I think there's a
big push to I think, I read a statistic that MFA, I mean, MFA
can use different types of biometrics is a way of having
multi multi factor authentication, there are
different, there are different levels of multi factor
authentication, biometrics being one of them. But you know, just
just the fact that, you know, when you when you look at the
stats around MFA, and how many, you know, the percentage of
malicious access to a person's account is stopped. I think it's
somewhat like 99% of, you know, accounts that have MFA or not or
not. You it's very difficult to get an account that has MFA on
basically,
Jason Baum: yeah, yeah. That's, that's great. So back in 2009, I
was part of an organization an association that had frank abig
nail speak. Frank Abagnale is the Catch Me If You Can main
character, he now works for the FBI. But he's known for forging
checks and money and, but he's also I mean, he's also he was a
kind of a hacker as well. And, and obviously, the FBI has,
like, recruited him, but but we also had Colin Powell. And, and
the two of them were speaking so frank McNeil, during his
presentation did one of the most amazing things I've ever seen
anybody do during a presentation, and he's like, I'm
gonna hack Colin Powell. He's like, I'm gonna steal his
identity is a Colin Powell is pretty, pretty important, dude.
Right? I mean, he's, he's pretty high up there in the government,
you think he's super secure everything secure, right. And
he's like, I'm going to hack him. And not only I'm going to
hack him, I'm going to steal basically his identity in 15
minutes. And he's like, all I need is his address, his
birthday, and, and his password. And he got everything. And he
got it in 15 minutes. And so he stole compounds identity now, I
would hope that things are a little more secure now, in 2022,
than they were in 2009.
Jamal Walsh: Wow. So I think what you're talking about,
there's something called social engineering. And I think it's,
it's a really big thing at the moment. So it comes down to
privacy, and people not realizing what privacy means.
And when you go on to the social media sites, the more
information you publish about yourself, the easier it is for
people to then take advantage of that. So it's really important
that you think about what you're posting online, what you're
sharing online, who you're accepting as friends online,
like just accepting random people, and then not realizing
that by accepting that request, you are then exposing a ton of
data that can be used against you, right? So you always have
to think about, you know, how much am I sharing here? Do I
know this person? You know, it's kind of like, it's kind of like,
you know, going out in the street, would you hand a
complete stranger your well, it was all your ID cards,
Jason Baum: right? I was just gonna use the example of like,
when you post on the internet, like in a social media setting,
and if it's a public post, and you're basically saying you're
on vacation, it's like, would you just stand out with a
megaphone and announce to the whole neighborhood? I am going
on vacation now. At my house is empty. No one's home? No. But we
don't think of it that way.
Jamal Walsh: No, we should shoot. Absolutely. Yeah. Yeah.
Jason Baum: Thank you so much, Jamal. I mean, we could talk
about this is a really interesting topic. It's a very
timely topic. And I hope you know, now through this podcast
and all the different means that you have out there that we can
all learn to to be safer together for a better internet,
not just for our data, but for our families and ourselves.
Yeah, absolutely. Thanks again for coming on. I'm going to ask
our last questions. So you were on Last time we asked. We asked
a question very much focused on you And what was something that
you would like to share that no one else knows. So if you're
curious about what Jamal's answer was to that question, you
have to go back and listen to episode 36. I'm not gonna, I'm
not gonna repeat it here. So there you go. But our question
today for you is, what's something everybody in your
industry should stop or start doing? Immediately?
Jamal Walsh: It's a really good question. So I've ever seen that
kind of, say pretty much anywhere and everywhere I've
worked, which is stop starting and start finishing. And that
basically means stop trying to do too many things at once,
break your work down into small, achievable pieces, and start
delivering stuff. I think, I think sometimes people have a
concept that by doing many things at once, they're
delivering a lot, when actually you're not. If you just deliver
one thing at a time, when you deliver that one thing, move on
to the next, you're actually getting value delivered much
quicker. And it's a concept that, you know, should be
practicing in DevOps and all DevOps teams is the fact that,
you know, if you try and work on 10 things at the same time,
there's only so many things you can you know, it takes longer
for those 10 things to finish, right. Whereas if you just work
on the one thing, finish that and then start in the next
thing. Easier said than done. I've got to admit, I do have
trouble with it myself sometimes. But yeah, I just keep
reminding myself every day.
Jason Baum: I think getting to the finish line. Don't we all
need that feeling of like you did it? You know, it's it keeps
you going and motivated to do the next thing. Exactly,
exactly. Well, thanks so much, Jamal. I really appreciate it.
You're always welcome to come back.
Jamal Walsh: Anytime I love. I love having a chat with you.
It's great. Awesome.
Jason Baum: And thank you for listening to this episode of the
humans of DevOps Podcast. I'm going to end this episode the
same way I always do encourage you to become a member of DevOps
Institute to get access to even more great resources just like
this one. Until next time, stay safe, stay healthy, and most of
all, stay human, live long and prosper.
Narrator: Thanks for listening to this episode of the humans of
DevOps podcast. Don't forget to join our global community to get
access to even more great resources like this. Until next
time, remember, you are part of something bigger than yourself.
You belong