Joshua McKenty Talks OpenControl @ Cloud Native DC Meetup || March 8, 2016

1. 1© 2014 Pivotal Software, Inc. All rights reserved. 1© 2014 Pivotal Software, Inc. All rights reserved.
Compliance as Code thru Continuous
Authorization for A&A
Joshua McKenty, Pivotal

2. “Bureaucracy is the art of making
the possible impossible.”
~ Javier Pascal Salcedo

3. 3© 2014 Pivotal Software, Inc. All rights reserved.
What: Automated Pipelines of A&A
As TDD is to Development, and
DevOps is to Operations, so
OpenControl is to Compliance.

4. 4© 2014 Pivotal Software, Inc. All rights reserved.
Why?
Ÿ Speed is everything
– Respond quickly to CVEs
– Respond quickly to mission requirements
– Deploy frequently to avoid “Big-Bang” risks
Ÿ Automation makes Speed possible
Ÿ (Bonus: Automation makes security BETTER!)

5. 5© 2014 Pivotal Software, Inc. All rights reserved.
How (Theory)
Ÿ Unified or parallel pipelines of code and compliance
Ÿ Pipeline requirements:
– Dependency injection
– Task reuse
– Multiple inputs, multiple outputs
Ÿ Common schema, common components
Ÿ Separation of components from system details

6. 6© 2014 Pivotal Software, Inc. All rights reserved.
How (Practice): http://open-control.org
Ÿ Schema (YAML)
Ÿ Tools (CLI and web)
Ÿ Pipelines (Concourse.ci)
Ÿ Common compliance packages (800-53, FedRAMP, etc)

7. 7© 2014 Pivotal Software, Inc. All rights reserved. 7© 2014 Pivotal Software, Inc. All rights reserved.
YAML!!!!!

9. 9© 2014 Pivotal Software, Inc. All rights reserved.
How (Practice)
Ÿ Inputs:
– Certifications
– Standards
– Component Controls
– System Details
Ÿ Outputs:
– BoE / SPP (as a .docx)
– Inventory reports (in .xsl)
– POAM details
– OpenSCAP config

10. 10© 2014 Pivotal Software, Inc. All rights reserved.
Community

11. 11© 2014 Pivotal Software, Inc. All rights reserved.

12. 12© 2014 Pivotal Software, Inc. All rights reserved.
Schemas

13. 13© 2014 Pivotal Software, Inc. All rights reserved.

15. 15© 2014 Pivotal Software, Inc. All rights reserved.

16. 16© 2014 Pivotal Software, Inc. All rights reserved. 16© Copyright 2014 Pivotal. All rights reserved.
"Culture does not change because we
desire to change it. Culture changes
when the organization is transformed;
the culture reflects the realities of
people working together every day.”
- Frances Hesselbein