2024-08-07 –, Boardroom
This workshop on DevSecOps and securing your SDLC provides BSides Las Vegas participants
with a basic guide to using DevSecOps tooling including open source options, and those native
to GitHub
BSidesLV attendees will learn about setting up IDE plugins, pre-commit hooks and other
techniques to harden their development environment. Attendees will then progress into building
out CI/CD pipeline that use DevSecOps concepts such as secrets scanning, dependency analysis
and Static Analysis Security Testing.
Introduction (15 mins)
Introduction to the BSidesLV workshop and the team giving it. We will also cover some basics
around how to ask for help.
Pre-setup Phase (15 mins)
Students will be guided through:
● The basic steps to setup their environment
● Some key concepts that will be covered during the workshop
Security within the IDE (120 mins)
Attendees will learn to integrate security control into their local development environment. These
will act as a first line of defense:
● VSCode IDE plugin configuration and usage
● Setting up pre-commit hooks and exploring libraries to aid with security
● Preventing config files containing secrets, or other sensitive files being committed to a
source code repository.
Scanning the Repository (75 mins)
Attendees will build a simple CI/CD pipeline using GitHub Actions. This will demonstrate how to
introduce techniques such as SAST, secrets scanning and vulnerability detection into the
development process. This phase will include:
● A demonstration of how secret scanning can be performed within the repository using
GitHub native and third party tools
● Detecting security vulnerabilities (CVEs) in the source code repository. A combination of
third party tools and GitHub’s CodeQL will be used to demonstrate these concepts.
● Enabling branch protection rules and PR gating mechanisms in GitHub to ensure best
practices are being followed.
● Dependency analysis and SBOMs. Techniques to review dependencies for security issues
and generate SBOMs are then explored. We will demo how to explore detecting issues in
sub-dependencies such as Log4J.
Wrap-up (15 mins)
● Recap and conclusion.
Andy Dennis - Andy heads up the Cloud and Platform practice at Modus Create. This covers
DevOps/DevSecOps, Build Systems, Internal Developer Platforms, Cloud Infrastructure and
Cybersecurity. Andy has spoken at multiple BSides events around the US (including BSides CT,
and BSides Tampa ) and also at the DEFCON Recon Village.
William F. Reyor III is a seasoned cybersecurity professional and the Director of Security at Modus Create, where he leads the security consulting practice. With a passion for solving complex puzzles, William's journey into cybersecurity was inspired by curiosity and his love for solving puzzles. His role at Modus Create involves overseeing a talented team of DevSecOps, AppSec, and Security Architects, all dedicated to enhancing the security posture of their clients. As a core organizer and co-founder of BSidesCT since 2011, William has been instrumental in fostering a collaborative and educational environment for security enthusiasts and professionals. In addition to his professional achievements, William is also a ham radio operator, known by his call sign KB1HAX, and a co-author of the Defensive Security Handbook, Second Edition a great resource for the infosec neophyte.