STAREAST 2022 - DevOps

Even if your code coverage is 80%, how much confidence do you have in your unit tests? Are they catching the edge cases? Can you fearlessly refactor? Add new features? Perhaps you are writing code that another team will rely on (or worse, you have to rely on!) Or maybe you have to untangle some ugly spaghetti code and want some idea of what it does before you start chopping it up. A mutation testing framework like PIT from pitest.org tests your JUnit tests and shows you what you are and aren’t testing. If your unit tests all pass, mutation tests make changes to a copy of your source code...

Synergies among AI and software testing include both leveraging AI for test automation, and devising methods for testing AI systems. Researchers, software vendors, and practitioners are already using AI to develop a new wave of test automation tools. These tools automatically explore, model, reason, learn, and test software applications. However, as with most AI and ML-based technologies, these tools raise concerns around whether or not we really trust and depend on them. ML-based systems tend to be highly dynamic and adaptable at runtime, thereby requiring extensive testing both offline,...

Remember the Indiana Jones movies? For those in infosec and security trying to navigate these days seems a lot like those movies. For instance, right from the very start of the series, we are shown how defense-in-depth is not enough - or have you forgotten that Indy escaped with the idol? Or how about how many of us, trying to keep up with threats, can relate to Indy, when going after a truck, said “I don’t know, I’m making this up as I go!”? And can't we ALL relate to trying to find the Security Holy Grail to help manage and mitigate risk – and felt the pain and scars from someone...

Chaos Engineering reduces the impact of component failure. Chaos Days (aka Game Days) are one practice within this field, whereby controlled failures are used to learn and improve system and team response. We will describe how to run a Chaos Day on a large microservices platform, using our experience of doing this across 60 teams, 1000 microservices. The session will explore why you’d run a Chaos Day, and how to know when you and your platform are ready to do so. We’ll share our learnings of the actual mechanics of running one: how do you plan, execute and retrospect a Chaos Day. We’ll...

Building a mature AppSec program is critical to the success of any product in managing the most vulnerable areas of the application. How can we ensure that the DevSecOps pipeline implemented is working effectively? The paper answers them by highlighting the key measures for every CISO to monitor and track the effectiveness of the AppSec maturity. The effective outcomes were measured by tracking 6 key metrics to validate if DevSecOps is successfully implemented. When done right, DevSecOps goes well beyond “shifting security left” to “shifting security everywhere” ensuring application is...