devopsdays Galway, November 2017

1. Vulnerability Testing in the Cloud
by dint of DevSecOps
Owen Byrne
Cisco dCloud
obyrne@cisco.com
https://www.linkedin.com/in/owen-byrne/
@owbyrne
devopsdays Galway 2017

2. Our journey begins..

3. Enabled by some great OpenSource tools…

4. Cloud ‘Authorisation to Operate’ (CATO)

5. Conundrum

6. Security? Not my job!

7. • CD model means deployed code is constantly changing
• Security Tools vary in:
• Skill level to operate (developer friendly, automation possible?)
• Coverage (gaps & detection – false positives/negatives)
• Varied output formats (JSON, XML, Unstructured,
But…Security Testing is Hard

8. OpenSource: https://norad.gitlab.io/
License: Apache 2
8

9. Enabling DevSecOps

10. • Ability to plug in new, home-grown
tests & 3rd party tools quickly
• Docker images containing
preconfigured tools to scan for a
specific type of vulnerability
Containerised Security Tests

11. How Norad Works
Cust omer Cl oud
NORAD
Cisco Confidential

12. Centralised Results

13. Pipeline Integration

14. Python (boto) AWS CLIAWS Console Powershell
Tools
Cloud Module
Cloudformation
BUT…many other ways to create Infra…
AutoScaling

15. “You can think of CloudWatch Events as the central nervous system
for your AWS environment. It is wired in to every nook and cranny of the
supported services, and becomes aware of operational changes as they
happen. Then, driven by your rules, it activates functions
and sends messages (activating muscles, if you will) to respond to the
environment, making changes, capturing state information, or taking
corrective action.”
AWS CloudWatch Events

16. “AWS Lambda is a compute service that lets you run
code without provisioning or managing servers”
“…use AWS Lambda to run your code in response to
events”
AWS Lambda

17. Stitching Things Together

18. Continuous Compliance
with Lambda
Based on: https://github.com/awslabs/aws-security-
benchmark
Config Check Rule evaluated every 24hours

19. When SecOps show up to the meeting
http://devopsreactions.tumblr.com/post/142837211682/when-secops-shows-up-to-the-meeting

20. Thank You!