Post on 28-Jul-2015
transcript
Continuous SecurityThe DevOps Way
Tim PrendergastFounder: Evident.io
Tweeter: @Auxome
@Auxome / @Evidentdotio
#devsecops
@Auxome
Why I’m Here
THIS IS THE SECURITY ROLLERCOASTER
Elation Pain Suffering Winning Losing Failing InnovatingSecOps
@Auxome
Why Do Security?
REGULATORY
PARTNERS DEMAND ITINDUSTRIAL
SELF-IMPOSED
IMPOSED UPON YOU
CUSTOMERS DEMAND IT
PROTECT YOUR IP
STEAL THEIR IP >:)
REASONS VARY BY ORGANIZATION
@Auxome
Needs of DevOps
SPEEDRELIABILITY
RESILIENCE
FLEXIBILITY
AUTOMATION
@Auxome
Needs of Security
ACCOUNTABILITY
CONFIDENCE
STABILITYCONTROL
RISK AVERSION
@Auxome
A Converged World…
ACCOUNTABILITYCONFIDENCE
STABILITYCONTROL
RISK AVERSIONSPEED
RELIABILITY
RESILIENCEFLEXIBILITY
AUTOMATION
&&&&
&SPEED
RELIABILITY
RESILIENCEFLEXIBILITY
AUTOMATION
ACCOUNTABILITYCONFIDENCE
STABILITYCONTROL
RISK AVERSION
@Auxome
We’ve Been Stuck…
SECURITYhas NOT
EVOLVEDas rapidly as
INFRASTRUCTURE
@Auxome
The Gap is Technical
OVERCOMINGpeople-objections
is EASY
@Auxome
MSS (Modern Security Sucks)
Dependent on presence
Doesn’t understand non-TCP/IP stacks
Too human-dependent
Assumptions that resources are relatively static
Attackers use automation, defenders do not
Security companies don’t get Cloud & DevOps
@Auxome
DevSecOps > sum(dev,sec,ops)
Take the best of
Now we can have some fun…Dev , Sec , and Ops
@Auxome
DevSecOps, Rugged DevOps… a rose
DevOps.com published a great e-book at RSA:
http://devops.com/2015/04/20/the-rugged-devops-ebook
/
Disclaimer: Evident.io was one of the corporate sponsors for the production cost of the book – we believe in it!
@Auxome
Security Scanning
Old & Busted: Run security scans weekly/monthly/quarterly
Does this work in dynamic environments?
@Auxome
New & Hot: Continuous scanning for threats
Bonus — API-based services, too!
Security Scanning
@Auxome
Security analysis at time (T)
Scan Node
Host NHost NHost NHost N
Cloud API Svc NSvc NSvc NSvc NSvc NSvc NSvc NSvc NSvc N
Svc NSvc NSvc NSvc NSvc NSvc NSvc NSvc NSvc A
IP Scans
API Scans
No unexpected results/changes
@Auxome
Security analysis at time (T+1)
Scan Node
Host NHost NHost NHost N
Cloud API Svc NSvc NSvc NSvc NSvc NSvc NSvc NSvc NSvc N
Svc NSvc NSvc NSvc NSvc NSvc NSvc NSvc NSvc A
IP Scans
API Scans
A user identity disabled MFA
Iden-tity
Change
@Auxome
Security analysis at time (T+2)
Scan Node
Host NHost NHost NHost N
Cloud API Svc NSvc NSvc NSvc NSvc NSvc NSvc NSvc NSvc N
Svc NSvc NSvc NSvc NSvc NSvc NSvc NSvc NSvc A
IP Scans
API Scans
A new host running an unapproved im-age appears
Malicious Host
@Auxome
Security analysis at time (T+3)
Scan Node
Host NHost NHost NHost N
Cloud API Svc NSvc NSvc NSvc NSvc NSvc NSvc NSvc NSvc N
Svc NSvc NSvc NSvc NSvc NSvc NSvc NSvc NSvc A
IP Scans
API Scans
Both malicious security events have exited
@Auxome
@Auxome
Host Integrity
Old & Busted:Expensive, Single-purpose tools
@Auxome
New & Hot:Helllooooo, Chef/Puppet/Ansible
Host Integrity
@Auxome
Cool security-related CfgMgmt Resourceshttps://github.com/hardening-io/chef-os-
hardeninghttps://supermarket.chef.io/cookbooks/
aws_securityhttps://supermarket.chef.io/cookbooks/
cis_benchmarkhttps://forge.puppetlabs.com/netmanagers/
fail2banhttps://forge.puppetlabs.com/arusso/iptables
… and so many more!!!
@Auxome
Compliance
Old & Busted:Quarterly Audits, Manual Reviews
@Auxome
New & Hot: Automated Compliance Audits
Compliance
“You are in direct violation of PCI DSS 3.0 requirement 3 section 6.1. You have 10 seconds to comply…”
@Auxome
Old & Busted:Manual, Reactive behaviors
Enforcement
@Auxome
New & Hot:Automated Defense
Enforcement
@Auxome
Automated Defense Toys
Best Example that is opensourced:SecuritySquirrel (by Rich Mogull of Securosis)https://github.com/securosis/securitysquirrel
@Auxome
What to Take Away
Don’t wait for security to come to you – chase it1
Automate your security behaviors2
Champion the marriage of DevOps & Security3
@Auxome
Any questions?
@Auxomehttps://www.eviden-
t.io