OSMC 2016: Security and Compliance Automation and Reports with Foreman by Shlomi Zadok

•

1 like•122 views

Schutz gegen die unnachgiebigen und adaptiven Cyber-Bedrohungen von heute erfordert dauerhafte Monitoring der Netzwerke und Systeme. Foreman und OpenSCAP gehen diese Herausforderung mittels eines zentralgesteuerten Security Managements, Configuration Scanning, Monitoring und Ausbesserung an. In diesem Talk werden wir diskutieren wie Foreman und Open SCAP automatisch nach Sicherheitslücken, Schwächen und nicht-genehmigten Änderungen suchen, und die Probleme überwachen und beheben um die Sicherheitskontrollen Ihrer bestehenden Sicherheits- Konfiguration wieder herzustellen

Software

Security & Compliance
automation and reports with
Foreman & OpenSCAP
#OSMC 2016
@shlomizadok

$/me https://{twitter,github}.com/shlomizadok Senior software engineer @ Red Hat Foreman team member Foreman-OpenSCAP plugins maintainer !security_expert ;)$

Stop the lies!!!!11
The internet is safe!
No one will attack you...

No one will abuse your servers / Vms. #3v3r!
E9:87:3D:79:C6:D8:7D:C0:FB:6A:57:78:63:33:89:F4:45:32:13:30:3D:A6:1F:20:BD:67:FC

Foreman 101
MonitoringConfigurationProvisioning

Provisioning
Provision new machines or containers to (almost)
anything:
Bare metal, oVirt, libvirt, VMware, Docker, EC2, Rackspace,
Digital Ocean, OpenStack, etc.
* If we don't support it today, we can via new plugins

Configuration
● Puppet
● Via plugins:
✔ Chef
✔ Salt
✔ Ansible
● Automatic registration & setup of
clients, including autosigning
certs/keys
● Defining:
● Classes / states
● Parameters / pillars
● Inventory data:
● Facts / Grains
● results of configuration runs

Monitoring
● Generic API with graphs/trends:
✔ System Inventories
✔ Reports from runs
✔ Generic reports: ABRT, OpenSCAP
● Context sensitive search:
✔ Not full-text (SQL level)
✔ Keyword completion
✔ Works across whole application

SCAP
Security Content Automation Protocol
Define security and audit rulez
Scan you systems and test if the rules apply
Report scan results, decide if compliant or not

14
OpenSCAP
Base tool `oscap`
SCAP Workbench
OSCAP Anaconda Add-on
OpenSCAP Daemon
Scaptimony
More @ open-scap.org

15
Foreman OpenSCAP
Helps you apply OpenSCAP scans on hosts
Helps scheduling OpenSCAP scans
UI for reporting and monitoring

Foreman OpenSCAP - flow
● Assign policy to host(group)
● Puppet installs foreman_scap_client,
and configures it
● SCAP content is downloaded to host
● `oscap` scanner runs, and generates Report
● Report parsed and uploaded to Foreman

Future improvements
● Tailoring file
● Remediation via ReX
● Improve monitoring

Similar to OSMC 2016: Security and Compliance Automation and Reports with Foreman by Shlomi Zadok

MariaDB is the new open source drop-in replacement for MySQL that has been adopted by IBM for use on Power Linux and IBM i. ZendDBi is the installer provided by Zend for installation of MariaDB on the IBM i. In this session we'll show how to use ZendDBi to install MariaDB and provide some important tips for post-installation. We'll also demonstrate troubleshooting some common installation issues. While most installations of MariaDB are trouble free, the troubleshooting procedures will give us a chance to understand a bit more about the operation of MariaDB on the IBM i. It'll also give us the opportunity to explore some concepts on IBM i that may not be familiar to some RPG programmers.

Install MariaDB on IBM i - Tips, troubleshooting, and more

Rod Flohr

In theory, post-exploitation after having remote access is easy. Also in theory, there is no difference between theory and practice. In practice, there is. Imagine a scenario, where you have deployed a malware on a user’s workstation, but the target information is on a secure server accessed via two-factor authentication, with screen access only (e.g. RDP, Citrix, etc.). On top of that, the server runs application white-listing, and only the inbound port to the screen server (e.g. 3389) is allowed through the hardware firewall. But you also need persistent interactive C&C communication (e.g. Netcat, Meterpreter, RAT) to this server through the user’s workstation. I developed (and will publish) two tools that help you in these situations. The first tool can drop malware to the server through the screen while the user is logged in. The second tool can help you to circumvent the hardware firewall after we can execute code on the server with admin privileges (using a signed kernel driver). My tools are generic meaning that they work against Windows server 2012 and Windows 8, and they work with RDP or other remote desktops. The number of problems you can solve with them are endless, e.g., communicating with bind-shell on webserver behind restricted DMZ. Beware, live demo and fun included!

DEFCON 22: Bypass firewalls, application white lists, secure remote desktops ...

Zoltan Balazs

CanSecWest (1)

Abhishek Singh

44CON 2014 - Switches Get Stitches, Eireann Leverett & Matt Erasmus This 2 hour workshop will introduce you to Industrial Ethernet Switches and their vulnerabilities. These are switches used in industrial environments, like substations, factories, refineries, ports, or other other homes of industrial automation equipment. In other words, scada and ICS switches. You will gain familiarity with the basic usage of these switches, and do some very light traffic analysis and firmware reverse engineering. Not only will vulnerabilities be disclosed for the first time (exclusively at 44CON), but the methods of finding those vulnerabilities will be shared. If you have never done any reverse engineering or firmware analysis, this might be a good place to start. You will need to be familiar with a linux commandline, and the usage of tools such as BURP and wireshark. If you are an IDA Pro wizard we welcome your attendance, but we won’t be teaching you anything new. However, we will examine firmware and device embedded webservers with tools such binwalk, strings, grep, xxd, python, scapy, and compression utilities. All vulnerabilities taught/disclosed will be in the default configuration state of the devices. While these vulnerabilities have been responsibly disclosed to the vendors, SCADA/ICS patching in live environments tends to take 1-3 years. So this work will be fresh and useful for your penetration tests in the future. You might even find new vulnerabilities with the chance to play with these devices (which are being brought to 44CON for this workshop)!

44CON 2014 - Switches Get Stitches, Eireann Leverett & Matt Erasmus

44CON

Security & ethical hacking p2

ratnalajaggu

Hackers, meet your match. No longer are web applications an easy target. You have been getting away for too long with laughing at poor programming practices, pissing on every parameter, and downloading entire tables from Web requests. In this talk, I will show a hands-on demo of a live application with a RASP, and without. I will cover the benefits of a RASP over a WAF, and explain how web sites should no longer rely on dumb traffic level regex tools for their security. I will attack a vulnerable web application, and demonstrate how a typical attack is carried out on it. Afterwards I will repeat the exercise on the same application, but this time with a RASP installed. I will point out what the key differences are, and in a vendor neutral manner show key mechanisms which differentiate a RASP from a WAF or a firewall. I will cover how brute force protection is done right, how aggregating application usage and sharing this data is beneficial, and how using a RASP can even be integrated into a SDLC.

HackFest 2015 - Rasp vs waf

IMMUNIO

There is a big bunch of tools offering HTTP/SSL traffic interception. However, when it comes to penetration tests of specialized embedded software or thick clients, we often encounter proprietary protocols with no documentation at all. Binary TCP connections, unlike anything, impossible to be adapted by a well-known local proxy. Without disassembling the protocol, pentesting the server backend is very limited. Though, based on our experience, it very often hides a shameful secret - completely unsecured mechanisms breaking all secure coding practices. To demonstrate, we will show a few case-studies - most interesting examples from real-life industry software, which in our opinion are a quintessence of "security by obscurity". We will challenge the security of proprietary protocols in pull printing solutions, FOREX trading software, remote desktops and home automation technologies.

CONFidence 2014: Jakub Kałużny: Shameful secrets of proprietary protocols

PROIDEA

Tesla Hacking to FreedomEV

Jasper Nuyens

Defense at Scale

Jan Schaumann

stackconf 2021 | Fuzzing: Finding Your Own Bugs and 0days!

NETWAYS

Nagios Conference 2014 - Gerald Combs - A Trillion Truths

Nagios

So, you want to build a hardware product? Every so often, a device comes along that changes the way we live our daily lives and things are never the same again. With today's digital technology, such devices may come more frequently than in the past - personal gadgets you cannot live without. What’s inside? What makes it tick? How do you find out? In this sharing session, Mark will provide an introduction to hardware hacking and why it matters, going through some quick tips on getting cosy with hardware to find out what makes it tick. Mark (MK FX) is a founder of Bazinga! Pte Ltd, a technology development and prototyping company that builds gadgets from ideas. An engineer since birth, because if you can dream it, think it - you can build it.

Hacker's and painters Hardware Hacking 101 - 10th Oct 2014

Takeda Pharmaceuticals

When speed and latency counts, there is no place for standard HTTP/SSL stack and a wise head comes up with a proprietary network protocol. How to deal with embedded software or thick clients using protocols with no documentation at all? Binary TCP connections, unlike anything, impossible to be adapted by a well-known local proxy. Without disassembling the protocol, pentesting the server backend is very limited. However, when you dive inside this traffic and reverse-engineer the communication inside, you are there. Welcome to the world full of own cryptography, revertible hash algorithms and no access control at all. We would like to present our approach and a short guideline how to reverse engineer proprietary protocols. To demonstrate, we will show you few case-studies, which in our opinion are a quintessence of ""security by obscurity"" - the most interesting examples from real-life financial industry software, which is a particularly risky business regarding security.

BSides London 2015 - Proprietary network protocols - risky business on the wire.

Jakub Kałużny

Fuzzing: Finding Your Own Bugs and 0days! 2.0

Rodolpho Concurde

HKG18-TR14 - Postmortem Debugging with Coresight

Linaro

44CON 2014 - Stupid PCIe Tricks, Joe Fitzpatrick. Hardware hacks tend to focus on low-speed (jtag, uart) and external (network, usb) interfaces, and PCI Express is typically neither. After a crash course in PCIe Architecture, we’ll demonstrate a handful of hacks showing how pull PCIe outside of your system case and add PCIe slots to systems without them, including embedded platforms. We’ll top it off with a demonstration of SLOTSCREAMER, an inexpensive device that’s part of the NSA Playset which we’ve configured to access memory and IO, cross-platform and transparent to the OS - all by design with no 0-day needed. The open hardware and software framework that we will release will expand your Playset with the ability to tinker with DMA attacks to read memory, bypass software and hardware security measures, and directly attack other hardware devices in the system.

44CON 2014 - Stupid PCIe Tricks, Joe Fitzpatrick

44CON

Information security is ever evolving, and Android's security posture is no different. Android users faces threats from a variety of sources, from the mundane to the extraordinary. Lost and stolen devices, malware attacks, rooting vulnerabilities, malicious websites, and nation state attackers are all within the Android threat model, and something the Android Security Team deals with daily. In this talk, we will cover the threats facing Android users, using both specific examples from previous Black Hat conferences and published research, as well as previously unpublished threats. For the threats, we will go into the specific technical controls which contain the vulnerability, as well as newly added Android N security features which defend against future unknown vulnerabilities. Finally, we'll discuss where we could go from here to make Android, and the entire computer industry, safer. (Source: Black Hat USA 2016, Las Vegas)

The Art of defence: How vulnerabilites help shape security features and mitig...

Priyanka Aash

#Include os - From bootloader to REST API with the new C++

IncludeOS

Raising the Bar on Robotics Code Quality

Thomas Moulard

機器學習應用於蔬果辨識

Kobe Yu

Similar to OSMC 2016: Security and Compliance Automation and Reports with Foreman by Shlomi Zadok (20)

Install MariaDB on IBM i - Tips, troubleshooting, and more

DEFCON 22: Bypass firewalls, application white lists, secure remote desktops ...

CanSecWest (1)

44CON 2014 - Switches Get Stitches, Eireann Leverett & Matt Erasmus

Security & ethical hacking p2

HackFest 2015 - Rasp vs waf

CONFidence 2014: Jakub Kałużny: Shameful secrets of proprietary protocols

Tesla Hacking to FreedomEV

Defense at Scale

stackconf 2021 | Fuzzing: Finding Your Own Bugs and 0days!

Nagios Conference 2014 - Gerald Combs - A Trillion Truths

Hacker's and painters Hardware Hacking 101 - 10th Oct 2014

BSides London 2015 - Proprietary network protocols - risky business on the wire.

Fuzzing: Finding Your Own Bugs and 0days! 2.0

HKG18-TR14 - Postmortem Debugging with Coresight

44CON 2014 - Stupid PCIe Tricks, Joe Fitzpatrick

The Art of defence: How vulnerabilites help shape security features and mitig...

#Include os - From bootloader to REST API with the new C++

Raising the Bar on Robotics Code Quality

機器學習應用於蔬果辨識

Recently uploaded

tonesoftg

lanshi9

WSO2CON 2024 - WSO2's Digital Transformation Journey with Choreo: A Platforml...

WSO2

WSO2CON 2024 - Building the API First Enterprise – Running an API Program, fr...

WSO2

This presentation covers the following topics: What is logging? The purpose of logging: Debugging The purpose of logging: Security The purpose of logging: Stats & analytics Traditional logging Traditional logging: Advantages Traditional logging: Disadvantages The solution: Large-scale logging Large-scale logging: Core principles Large-scale logging: Solution types Large-scale logging: Cloud vs on-prem Large-scale logging: Operational complexity Large-scale logging: Security Large-scale logging: Costs Large-scale logging: On-prem comparison - Elasticsearch - Grafana Loki - VictoriaLogs On-prem comparison: Setup and operation On-prem comparison: Costs On-prem comparison: Full-text search support On-prem comparison: How to efficiently query 100TB of logs? On-prem comparison: Integration with CLI tools VictoriaLogs for large-scale logging VictoriaLogs demo instance - Ingestion rate: 3600 messages / minute - The number of log messages: 1.1 billion - Uncompressed log messages’ size: 1.5TB - Compressed log messages’ size: 23GB - Compression ratio: 47x - Memory usage: 150MB VictoriaLogs CLI integration demo - Which errors have occurred in all the apps during the last hour? - How many errors have occurred during the last hour? - Which apps generated the most of errors during the last hour? - The number of per-minute errors for the last 10 minutes - Status codes for the last hour - Non-200 status codes for the last week - Top client IPs for the last 4 weeks with 404 and 500 response status codes - Per-month stats for the given IP across all the logs Large-scale logging solution MUST provide excellent CLI integration VictoriaLogs: (temporary) drawbacks VictoriaLogs: Recap - Easy to setup and operate - The lowest RAM usage and disk space usage (up to 30x less than Elasticsearch and Grafana Loki) - Fast full-text search - Excellent integration with traditional command-line tools for log analysis - Accepts logs from popular log shippers (Filebeat, Fluentbit, Logstash, Vector, Promtail, Grafana Agent) - Open source and free to use!

Large-scale Logging Made Easy: Meetup at Deutsche Bank 2024

VictoriaMetrics

%in Hazyview+277-882-255-28 abortion pills for sale in Hazyview

masabamasaba

We specialize in Psychic Readings, Psychic Love Spells, Binding Love Spells, Obsession Spells, Voodoo Spells, Lottery Spells, Marriage Spells, Black Magic Spells, Palm Readings & much more. Are you depressed? We perform this come-to-me love spell that works instantly with the aim of Winnipeg back the victim to the person performing the magic. Have you lost your lover? We perform this come-to-me love spell that works instantly with the aim of bringing back the victim to the person performing the magic. Have you lost your lover? Do u need to solve any relationship problem? Contact the powerful spells caster chief kule with love spells that work overnight and love spells that really work. Have you found yourself infatuated with a special someone you think could be the one? Are you looking for a spell to provide them with a nudge in the right direction? Or maybe the spell you cast didn’t achieve the results you were hoping for? Whether you’re new or versed in the ways of spell casting, we’re here to help. Today we’re going to provide you with a detailed guide on the types of love spells to cast. Not only that but there’s something for those who wish to find outside advice from more advanced spell casters. We’re also going to provide you with the top sites available to help you with your dilemma. Let’s begin our journey by educating ourselves on love magic and what a real love caster looks like. Love Magic and Love Casters Love magic made its first appearance back in Ancient Egypt and has been an active practice since. This type of magic is a branch of traditional magic and can be practiced in various ways. Typically the more common use of love magic is through the work of spells, but other methods look like Charms Rituals-LOVE Potions-Dolls and even Amulets If you are interested in becoming a love caster, be prepared for what’s to come. A genuine love caster knows that the art of love casting is no easy feat and shouldn’t be done casually. You should know that not only does it require you to be gifted spiritually, but you must be ready to serve others. Someone who is considered a real love caster has experience in all manner of spells, no matter the difficulty. Training yourself in attraction, commitment, and marriage spells is an excellent place to start. But this by no means will make you a professional. Practice your craft and expand your knowledge; understand that you will possess the ability to help others in time truly. Types of Love Spells What better way to start broadening your experiences with love spells than by learning more about them? These spells work like just about any other spell. Simply apply your intention, use a medium (sigils, mantras, candles, or charm bags), and top it off with establishing the belief that you will receive what you want. So what kind of spells are available and which ones suit your needs the best? Let’s take a look at the many options you have at your disposal. Attraction Spells

%+27788225528 love spells in Knoxville Psychic Readings, Attraction spells,Br...

masabamasaba

We specialize in Psychic Readings, Psychic Love Spells, Binding Love Spells, Obsession Spells, Voodoo Spells, Lottery Spells, Marriage Spells, Black Magic Spells, Palm Readings & much more. Are you depressed? We perform this come-to-me love spell that works instantly with the aim of bringing back the victim to the person performing the magic. Have you lost your lover? We perform this come-to-me love spell that works instantly with the aim of bringing back the victim to the person performing the magic. Have you lost your lover? Do u need to solve any relationship problem? Contact the powerful spells caster chief kule with love spells that work overnight and love spells that really work. Have you found yourself infatuated with a special someone you think could be the one? Are you looking for a spell to provide them with a nudge in the right direction? Or maybe the spell you cast didn’t achieve the results you were hoping for? Whether you’re new or versed in the ways of spell casting, we’re here to help. Today we’re going to provide you with a detailed guide on the types of love spells to cast. Not only that but there’s something for those who wish to find outside advice from more advanced spell casters. We’re also going to provide you with the top sites available to help you with your dilemma. Let’s begin our journey by educating ourselves on love magic and what a real love caster looks like. Love Magic and Love Casters Love magic made its first appearance back in Ancient Egypt and has been an active practice since. This type of magic is a branch of traditional magic and can be practiced in various ways. Typically the more common use of love magic is through the work of spells, but other methods look like Charms Rituals-LOVE Potions-Dolls and even Amulets If you are interested in becoming a love caster, be prepared for what’s to come. A genuine love caster knows that the art of love casting is no easy feat and shouldn’t be done casually. You should know that not only does it require you to be gifted spiritually, but you must be ready to serve others. Someone who is considered a real love caster has experience in all manner of spells, no matter the difficulty. Training yourself in attraction, commitment, and marriage spells is an excellent place to start. But this by no means will make you a professional. Practice your craft and expand your knowledge; understand that you will possess the ability to help others in time truly. Types of Love Spells What better way to start broadening your experiences with love spells than by learning more about them? These spells work like just about any other spell. Simply apply your intention, use a medium (sigils, mantras, candles, or charm bags), and top it off with establishing the belief that you will receive what you want. So what kind of spells are available and which ones suit your needs the best? Let’s take a look at the many options you have at your disposal. Attraction Spells

%+27788225528 love spells in Toronto Psychic Readings, Attraction spells,Brin...

masabamasaba

ADR, or Architecture Decision Record, is a valuable tool in software development for several reasons. It provides a centralized location for documenting and tracking architectural decisions, aiding both current and future team members. ADRs enhance communication among team members by documenting the rationale behind architectural decisions, especially beneficial during onboarding of new team members or when revisiting decisions. They serve as a knowledge base, enabling teams to learn from past decisions and refine their decision-making process. Additionally, ADRs contribute to transparency by helping stakeholders understand the reasons behind specific architectural choices. As with any other tool or process, introducing them into an organization can face several obstacles, and overcoming these challenges is crucial for successful implementation. In this talk I go through some common problems and our way of solving them.

Architecture decision records - How not to get lost in the past

Papp Krisztián

8257 interfacing 2 in microprocessor for btech students

HimanshiGarg82

WSO2CON 2024 - Does Open Source Still Matter?

WSO2

%in Rustenburg+277-882-255-28 abortion pills for sale in Rustenburg

masabamasaba

VTU technical seminar 8Th Sem on Scikit-learn

AmarnathKambale

%in tembisa+277-882-255-28 abortion pills for sale in tembisa

masabamasaba

%in Soweto+277-882-255-28 abortion pills for sale in soweto

masabamasaba

OpenChain - The Ramifications of ISO/IEC 5230 and ISO/IEC 18974 for Legal Pro...

Shane Coughlan

The title is not connected to what is inside

shinachiaurasa2

Investing in AI transformation today The modern business advantage: Uncovering deep insights with AI Organizations around the world have come to recognize AI as the transformative technology that enables them to gain real business advantage. AI’s ability to organize vast quantities of data allows those who implement it to uncover deep business insights, augment human expertise, drive operational efficiency, transform their products, and better serve their customers

Microsoft AI Transformation Partner Playbook.pdf

Willy Marroquin (WillyDevNET)

+971565801893 Mtp-Kit (500MG) Prices » Dubai [(+971565801893**)] Abortion Pills For Sale In Dubai, UAE, Mifepristone and Misoprostol Tablets Available In Dubai, UAE CONTACT DR.Leen Whatsapp +971565801893 We Have Abortion Pills / Cytotec Tablets /Mifegest Kit Available in Dubai, Sharjah, Abudhabi, Ajman, Alain, Fujairah, Ras Al Khaimah, Umm Al Quwain, UAE, Buy cytotec in Dubai +971565801893''''Abortion Pills near me DUBAI | ABU DHABI|UAE. Price of Misoprostol, Cytotec” +971565801893' Dr.DEEM ''BUY ABORTION PILLS MIFEGEST KIT, MISOPROTONE, CYTOTEC PILLS IN DUBAI, ABU DHABI,UAE'' Contact me now via What's App…… abortion Pills Cytotec also available Oman Qatar Doha Saudi Arabia Bahrain Above all, Cytotec Abortion Pills are Available In Dubai / UAE, you will be very happy to do abortion in Dubai we are providing cytotec 200mg abortion pill in Dubai, UAE. Medication abortion offers an alternative to Surgical Abortion for women in the early weeks of pregnancy. We only offer abortion pills from 1 week-6 Months. We then advise you to use surgery if its beyond 6 months. Our Abu Dhabi, Ajman, Al Ain, Dubai, Fujairah, Ras Al Khaimah (RAK), Sharjah, Umm Al Quwain (UAQ) United Arab Emirates Abortion Clinic provides the safest and most advanced techniques for providing non-surgical, medical and surgical abortion methods for early through late second trimester, including the Abortion By Pill Procedure (RU 486, Mifeprex, Mifepristone, early options French Abortion Pill), Tamoxifen, Methotrexate and Cytotec (Misoprostol). The Abu Dhabi, United Arab Emirates Abortion Clinic performs Same Day Abortion Procedure using medications that are taken on the first day of the office visit and will cause the abortion to occur generally within 4 to 6 hours (as early as 30 minutes) for patients who are 3 to 12 weeks pregnant. When Mifepristone and Misoprostol are used, 50% of patients complete in 4 to 6 hours; 75% to 80% in 12 hours; and 90% in 24 hours. We use a regimen that allows for completion without the need for surgery 99% of the time. All advanced second trimester and late term pregnancies at our Tampa clinic (17 to 24 weeks or greater) can be completed within 24 hours or less 99% of the time without the need surgery. The procedure is completed with minimal to no complications. Our Women's Health Center located in Abu Dhabi, United Arab Emirates, uses the latest medications for medical abortions (RU-486, Mifeprex, Mifegyne, Mifepristone, early options French abortion pill), Methotrexate and Cytotec (Misoprostol). The safety standards of our Abu Dhabi, United Arab Emirates Abortion Doctors remain unparalleled. They consistently maintain the lowest complication rates throughout the nation. Our Physicians and staff are always available to answer questions and care for women in one of the most difficult times in their lives. The decision to have an abortion at the Abortion Clinic in Abu Dhabi, United Arab Emirates.+971565801893

+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...

Health

%+27788225528 love spells in Huntington Beach Psychic Readings, Attraction sp...

masabamasaba

%in kempton park+277-882-255-28 abortion pills for sale in kempton park

masabamasaba

Recently uploaded (20)

tonesoftg

WSO2CON 2024 - WSO2's Digital Transformation Journey with Choreo: A Platforml...

WSO2CON 2024 - Building the API First Enterprise – Running an API Program, fr...

Large-scale Logging Made Easy: Meetup at Deutsche Bank 2024

%in Hazyview+277-882-255-28 abortion pills for sale in Hazyview

%+27788225528 love spells in Knoxville Psychic Readings, Attraction spells,Br...

%+27788225528 love spells in Toronto Psychic Readings, Attraction spells,Brin...

Architecture decision records - How not to get lost in the past

8257 interfacing 2 in microprocessor for btech students

WSO2CON 2024 - Does Open Source Still Matter?

%in Rustenburg+277-882-255-28 abortion pills for sale in Rustenburg

VTU technical seminar 8Th Sem on Scikit-learn

%in tembisa+277-882-255-28 abortion pills for sale in tembisa

%in Soweto+277-882-255-28 abortion pills for sale in soweto

OpenChain - The Ramifications of ISO/IEC 5230 and ISO/IEC 18974 for Legal Pro...

The title is not connected to what is inside

Microsoft AI Transformation Partner Playbook.pdf

+971565801893>>SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHAB...

%+27788225528 love spells in Huntington Beach Psychic Readings, Attraction sp...

%in kempton park+277-882-255-28 abortion pills for sale in kempton park

OSMC 2016: Security and Compliance Automation and Reports with Foreman by Shlomi Zadok

1. Security & Compliance automation and reports with Foreman & OpenSCAP #OSMC 2016 @shlomizadok

2. /me https://{twitter,github}.com/shlomizadok Senior software engineer @ Red Hat Foreman team member Foreman-OpenSCAP plugins maintainer !security_expert ;)

3. Stop the lies!!!!11 The internet is safe! No one will attack you...

4. No one will abuse your servers / Vms. #3v3r! E9:87:3D:79:C6:D8:7D:C0:FB:6A:57:78:63:33:89:F4:45:32:13:30:3D:A6:1F:20:BD:67:FC

5. Or steal your clients data

6. Or maybe they will?

7. * much needed promotional video ;)

8. Foreman + OpenSCAP for the rescue!

9. Foreman 101 MonitoringConfigurationProvisioning

10. Provisioning Provision new machines or containers to (almost) anything: Bare metal, oVirt, libvirt, VMware, Docker, EC2, Rackspace, Digital Ocean, OpenStack, etc. * If we don't support it today, we can via new plugins

11. Configuration ● Puppet ● Via plugins: ✔ Chef ✔ Salt ✔ Ansible ● Automatic registration & setup of clients, including autosigning certs/keys ● Defining: ● Classes / states ● Parameters / pillars ● Inventory data: ● Facts / Grains ● results of configuration runs

12. Monitoring ● Generic API with graphs/trends: ✔ System Inventories ✔ Reports from runs ✔ Generic reports: ABRT, OpenSCAP ● Context sensitive search: ✔ Not full-text (SQL level) ✔ Keyword completion ✔ Works across whole application

13. SCAP Security Content Automation Protocol Define security and audit rulez Scan you systems and test if the rules apply Report scan results, decide if compliant or not

14. 14 OpenSCAP Base tool `oscap` SCAP Workbench OSCAP Anaconda Add-on OpenSCAP Daemon Scaptimony More @ open-scap.org

15. 15 Foreman OpenSCAP Helps you apply OpenSCAP scans on hosts Helps scheduling OpenSCAP scans UI for reporting and monitoring

16. Foreman OpenSCAP - Concepts ● SCAP content ● Profile ● Policy ● ARF Report

17. Foreman OpenSCAP - flow ● Assign policy to host(group) ● Puppet installs foreman_scap_client, and configures it ● SCAP content is downloaded to host ● `oscap` scanner runs, and generates Report ● Report parsed and uploaded to Foreman

18. DEMO

19. Future improvements ● Tailoring file ● Remediation via ReX ● Improve monitoring

20. Questions?

OSMC 2016: Security and Compliance Automation and Reports with Foreman by Shlomi Zadok

Recommended

Recommended

More Related Content

Similar to OSMC 2016: Security and Compliance Automation and Reports with Foreman by Shlomi Zadok

Similar to OSMC 2016: Security and Compliance Automation and Reports with Foreman by Shlomi Zadok (20)

Recently uploaded

Recently uploaded (20)

OSMC 2016: Security and Compliance Automation and Reports with Foreman by Shlomi Zadok