SlideShare a Scribd company logo

Compliance As Code

•
•
E
Ebru Cucen Çüçen

A brief intro to Compliance and Azure platform. Overview of tools available on Azure such as Policies, BluePrints. It has a demo of Azure DevOps Kit (aka azsk PowerShell module) to continuously assure your compliance.

Technology
1 of 65
Download to read offline
COMPLIANCE AS CODE EBRU CUCEN
@ebrucucen 2019/02/11 WHO AM I? ▸ DevOps Consultant at Contino, spent 11 years of 16 years of career in consulting financial institutions delivering applications/platforms
 Banksoft, AXA, BUPA, Investec, VanquisBank, LloydsBank ▸ Life time student, with more questions than answers, developer in heart, loves APIs, automation, cloud/hybrid solutions, vegan, mum… @ebrucucen 2019/02/11
@ebrucucen 2019/02/11 AGENDA PART I 1. Compliance 2. Compliance On Azure ‣ Data Sources ‣ Metrics/Logs ‣ Monitoring ‣ Log Analytics PART II 3. Governance on Azure ‣ Security Center ‣ BluePrints 4. AzSK ‣ CI/CD ‣ Customize
@ebrucucen 2019/02/11 THIS TALK IS NOT ▸ By a security expert ▸ a personal experience/battles with the Operations/ Security/Risk teams ▸ About saving money ▸ almost every solution will incur cost
@ebrucucen 2019/02/11 I. COMPLIANCE CONFORMING TO A RULE, SUCH AS A SPECIFICATION, POLICY, STANDARD OR LAW
@ebrucucen 2019/02/11 COMPLIANCE CHALLENGES ▸ Data Protection Compliance ▸ Risk assessment, auditing, operations, technology ▸ Industrial regulations and standards <> tech knowledge ▸ Multi-device/cloud/ ▸ Cost: ▸ >200 updates from 750 regulatory bodies ▸ 32% of companies spend >4h/w to create/amend reports
 
 
 
 
 
 Human effort required for organisational compliance
@ebrucucen 2019/02/11 COMPLIANCE ON CLOUD? ▸ Azure Complied with Shared Responsibility Model ▸ Azure “MORE CERTIFICATIONS THAN ANY OTHER CLOUD PROVIDER”
@ebrucucen 2019/02/11 AZURE SUPPORT ▸ Documents ▸ Audit Reports ▸ Data Protection Guides ▸ Azure Security and Compliance BluePrints https://servicetrust.microsoft.com/ViewPage/BlueprintOverview
 http://aka.ms/pciblueprint
 https://docs.microsoft.com/en-us/azure/security/blueprints/pcidss-paaswa-overview#compliance-documentation Government Blueprints
 FedRAMP Blueprint
 UK OFFICIAL Blueprint
 NIST SP 800-171 Blueprint
 AU-PROTECTED
 Additional Frameworks Finance Blueprints
 
 FFIEC Blueprint
 PCI-DSS Blueprint Healthcare Blueprints
 
 HIPAA / HITRUST Blueprint
 UK NHS Blueprint Retail Blueprints
 
 PCI-DSS Blueprint Customer Responsibility Matrix
 Reference Architecture
 Implementation Matrix
 Overview
 Threat Model Data Analytics/Data Warehouse/IAAS/PAAS
@ebrucucen 2019/02/11 QUICK INSIGHT ▸ What does PCI-DSS BluePrint look like? http://aka.ms/pciblueprint
@ebrucucen 2019/02/11 II. AZURE BASICS FOR COMPLIANCE DATA
@ebrucucen 2019/02/11 Azure MonitorData Sources
@ebrucucen 2019/02/11 ▸ Are collected at regular intervals ▸ One minute by default ▸ Unique: Category = Metric + Namespace ▸ Stored for 93 days ▸ Multi-dimensional ▸ Properties [up to 10] ▸ Resource ▸ Type of Measurement ▸ Value ▸ Time DATA SOURCES - METRICS
@ebrucucen 2019/02/11 ▸ Properties ▸ Irregular ▸ Stored for x days ▸ Metrics -> Logs ▸ Types ▸ Control/Management Plane ▸ Data Plane ▸ Processed Events DATA SOURCES - LOGS
@ebrucucen 2019/02/11 ▸ Properties ▸ Irregular ▸ Stored for x days ▸ Metrics -> Logs ▸ Types ▸ Control/Management Plane ▸ Data Plane ▸ Processed Events DATA SOURCES - LOGS Audit Logs Azure Tenant Metrics Application Azure Subscription Service Health Activity Logs Azure Resources Diagnostic Logs Monitoring Solutions Guest OS Application Insights Dependency Agent Log Analytics Agent Diagnostics Extension Azure Custom API Data Collector API Non-Azure Service Configuration
@ebrucucen 2019/02/11 AZURE AD LOGS ▸ Editions: Basic, Free, Premium P1, Premium P2 ▸ Diagnostics Settings ▸ Audit Logs ▸ Sign-in Logs (PP2) ▸ Security Signals (opt-in IPC) ▸ Users at risk ▸ Risky sign-ins ▸ Activity Data is available 2 hours after turning on reporting ▸ 30 days of retention reports (PP1/PP2) ▸ 30/90 days of retention of security signals (PP1/PP2)
@ebrucucen 2019/02/11 AZURE SERVICES AZURE PLATFORM
@ebrucucen 2019/02/11 VIRTUAL MACHINES APPLICATIONS
@ebrucucen 2019/02/11 LOG ANALYTICS ▸ Kusto query language
@ebrucucen 2019/02/11 LOG ANALYTICS WORKSPACE
@ebrucucen 2019/02/11
@ebrucucen 2019/02/11 SOLUTIONS TO QUERY
@ebrucucen 2019/02/11 ▸ Low Latency (min 1 min interval) ▸ Control over metric condition ▸ Combined monitoring of multiple metrics ▸ Modular notification system ▸ Tip: Unify your alerts/sampling intervals for sanity ALERTS (NEW)
@ebrucucen 2019/02/11 DEMO ▸ WebApp & VM ▸ Metrics/Logs ▸ Query ▸ Alert
@ebrucucen 2019/02/11 PART II
@ebrucucen 2019/02/11 SECURITY
@ebrucucen 2019/02/11 SECURITY DON’T YOU DARE!
@ebrucucen 2019/02/11 SECURE? ✓ Data Protection ✓ Identity and Access Management ✓ Network Security ✓ Threat Protection ✓ Security Management https://www.cisecurity.org/benchmark/azure/
@ebrucucen 2019/02/11
@ebrucucen 2019/02/11 AZURE SPACE COVERED
@ebrucucen 2019/02/11 AZURE SECURITY CENTRE https://www.gartner.com/reviews/market/cloud-workload-protection-platforms/vendors
@ebrucucen 2019/02/11
@ebrucucen 2019/02/11 COMPLIANCE DASHBOARD
@ebrucucen 2019/02/11 SECURITY CENTRE ▸ One Step Closer to Automation
@ebrucucen 2019/02/11 DEMO ▸ Security Dashboard ▸ Issues ▸ Recommendations
@ebrucucen 2019/02/11 AZURE MANAGEMENT/GOVERNANCE ▸ How to do Compliance As Code with Azure
@ebrucucen 2019/02/11 MANAGEMENT GROUPS
@ebrucucen 2019/02/11 RESOURCE GRAPH where type =~ 'Microsoft.Compute/virtualMachines' | project name, properties.storageProfile.osDisk.osType | top 5 by name desc Search-AzGraph -Query "project tags | summarize buildschema(tags)” # Use Resource Graph to get all NICs and store in the 'nic' variable az graph query -q "where type =~ 'Microsoft.Compute/virtualMachines' | project nic = tostring(properties['networkProfile']['networkInterfaces'][0]['id']) | where isnotempty(nic) | distinct nic | limit 20" --output table | tail -n +3 > nics.txt # Review the output of the query stored in 'nics.txt' cat nics.txt # Use Resource Graph with the 'nics.txt' file to get all related public IP addresses and store in 'publicIp.txt' file az graph query -q="where type =~ 'Microsoft.Network/networkInterfaces' | where id in ('$(awk -vORS="','" '{print $0}' nics.txt | sed 's/,$//')') | project publicIp = tostring(properties['ipConfigurations'][0]['properties'] ['publicIPAddress']['id']) | where isnotempty(publicIp) | distinct publicIp" --output table | tail -n +3 > ips.txt # Review the output of the query stored in 'ips.txt' cat ips.txt # Use Resource Graph with the 'ips.txt' file to get the IP address of the public IP address resources az graph query -q="where type =~ 'Microsoft.Network/publicIPAddresses' | where id in ('$(awk -vORS="','" '{print $0}' ips.txt | sed 's/,$//')') | project ip = tostring(properties['ipAddress']) | where isnotempty(ip) | distinct ip" --output table ALL VM PUBLIC IPS: (AZ CLI) ALL TAG NAMES: (POWERSHELL) FIRST 5 VM OS TYPES: (KUSTO QUERY*) https://docs.microsoft.com/en-us/azure/kusto/query/index
@ebrucucen 2019/02/11 ▸ Enforce ▸ ASC on? ▸ Level of compliance? ▸ Threat detection/protection? ▸ Monitoring and auditing on? ▸ Network Security ▸ JIT and NSG for everything ▸ Adaptive Application Controls ▸ SIEM? ▸ WAF (Tested)? ▸ Integrate other sec tools (IPS/IDS/HIPS/Other) POLICY (SET) WHAT? PAAS? IAAS? NETWORK? HOW? IDENTITY & ACCESS MANAGEMENT? DATA & ENCRYPTION? AUDIT DEPLOY APPENDDENY
@ebrucucen 2019/02/11 BLUEPRINTS
@ebrucucen 2019/02/11 AZURE MANAGEMENT/GOVERNANCE
@ebrucucen 2019/02/11 HOW TO PIPELINE?
@ebrucucen 2019/02/11 SECURE PIPELINE? APPLICATION CI/CD NIGHTLY TEST RUNS Static code analysis Code Review WI Linking Static Code Analysis OSS Vulnerability Scan Unit Tests Code Metrics Passive Pen Test SSL Scanner
 Infrastructure Scan Infrastructure Scan Load and Performance Testing Automated Regression Testing Infrastructure Scan Active Pen Test Infrastructure Scan LOCAL/
 PR CI DEV TEST FEEDBACK Code Review Comments
 Static Code Rules Warnings OSS Library Vulnerabilities
 OSS Licence Violations
 Failed Unit Testing
 Static Code Rule Warnings Pen Test Issues
 SSL Issues
 Performance Issues
 Regression Issues Pen Test Issues
 Infrastructure Issues
@ebrucucen 2019/02/11 SECURE PIPELINE? APPLICATION CI/CD NIGHTLY TEST RUNS Static code analysis Code Review WI Linking Static Code Analysis OSS Vulnerability Scan Unit Tests Code Metrics Passive Pen Test SSL Scanner
 Infrastructure Scan Infrastructure Scan Load and Performance Testing Automated Regression Testing Infrastructure Scan Active Pen Test Infrastructure Scan LOCAL/
 PR CI DEV TEST FEEDBACK Code Review Comments
 Static Code Rules Warnings OSS Library Vulnerabilities
 OSS Licence Violations
 Failed Unit Testing
 Static Code Rule Warnings Pen Test Issues
 SSL Issues
 Performance Issues
 Regression Issues Pen Test Issues
 Infrastructure Issues POLICY
@ebrucucen 2019/02/11
@ebrucucen 2019/02/11 AZ-SK
@ebrucucen 2019/02/11 AZSK - OVERVIEW ▸ Requires SPN / OMS ▸ Runs Default policies ▸ Creates a Log/PDF Report for each execution ▸ Generates Manual/AutoFix scripts
@ebrucucen 2019/02/11 DEMO: AZSK ▸ Set up Policy Configuration ▸ CI/CD ▸ Check ARM Template ▸ Security Verification Test
@ebrucucen 2019/02/11 CONTINUOUS ASSURANCE
@ebrucucen 2019/02/11 CONTINUOUS ASSURANCE
@ebrucucen 2019/02/11 PLAN B -DEMO FAILS ▸ GSS
@ebrucucen 2019/02/11
@ebrucucen 2019/02/11 PLAN B - #3 CI/CD
@ebrucucen 2019/02/11 ▸ IOP PLAN B -DEMO FAILS
@ebrucucen 2019/02/11 PLAN B: DEMO FAILS CI/CD
@ebrucucen 2019/02/11 EXTRAS: WEB APP - BEST PRACTICES ▸ Use Certs ▸ Authenticate users (with) ▸ Advanced auth ▸ Configure TLS mutual auth ▸ Managed Identity ▸ Reference secrets from Key Vault ▸ Restrict IPs ▸ Turn on Web Server/Application Logging ▸ Automate Backups https://docs.microsoft.com/en-us/azure/app-service/web-sites-purchase-ssl-web-site
@ebrucucen 2019/02/11 EXTRAS: HARDENING VM ▸ Control VM access ▸ Reduce variability in your setup and deployment of VMs ▸ Secure privileged access ▸ Use multiple VMs for better availability ▸ Protect against malware ▸ Keep VMs current ▸ Deploy and test a backup solution ▸ Encrypt your virtual hard disk files https://docs.microsoft.com/en-us/azure/security/azure-security-iaas
@ebrucucen 2019/02/11 EXTRAS: HARDENING IDENTITY MANAGEMENT 
 Protect privileged accounts with MFA 1. Strengthen your credentials. 2. Reduce your attack surface area. 3. Automate threat response. 4. Increase your awareness of auditing and monitoring. 5. Enable more predictable and complete end-user security with self-help https://docs.microsoft.com/en-us/azure/security/azure-ad-secure-steps
@ebrucucen 2019/02/11 EXTRAS: IDENTITY MANAGEMENT BEST PRACTICES 1. Treat Identity as the primary security perimeter 2. Centralise Identity Management 3. Enable SSO 4. Turn on Conditional Access 5. Enforce MFA 6. Use RBAC 7. Lower exposure of privileged accounts (JIT, 2 EmergencyAccess) 8. Actively monitor for suspicious activities
@ebrucucen 2019/02/11 EXTRAS: NETWORK SECURITY BEST PRACTICES 1. Logically segment subnets 2. Control routing behaviour 3. Enable forced tunnelling 4. Use virtual network appliances 5. Deploy perimeter network for security zones 6. Avoid exposure to Internet with dedicated WAN links 7. Optimise uptime and performance 8. Disable RDP/SSH to VMs
@ebrucucen 2019/02/11 EXTRAS: THREAT MODELLING Threat Security property Potential Azure platform mitigation Spoofing Authentication Require HTTPS connections. Tampering Integrity Validate SSL/TLS certificates.Applications that use SSL/TLS must fully verify the X.509 certificates of the entities they connect to. Use Azure Key Vault certificates to manage your x509 certificates. Repudiation Non-repudiation Enable Azure monitoring and diagnostics. Information Disclosure Confidentiality Encrypt sensitive data at rest and in transit. Denial of Service Availability Monitor performance metrics for potential denial of service conditions. Implement connection filters. Azure DDoS protection combined with application design best practices provides defense against DDoS attacks. Elevation of Privilege Authorization Use Azure Active Directory Privileged Identity Management.
@ebrucucen 2019/02/11 REFERENCES - BOOKS ▸ Microsoft Security Center
 https://www.amazon.co.uk/Microsoft-Azure-Security-Center-Practices-ebook/ dp/B07D5J97JV ▸ Pentesting Azure Applications
 https://www.amazon.co.uk/Pentesting-Azure-Definitive-Attack-Defense/dp/ 1593278632 ▸ Deep dive Presentation:
 https://www.sans.org/cyber-security-summit/archives/file/summit- archive-1540308627.pdf ▸ AZSK: 
 https://github.com/azsk/DevOpsKit-docs ▸ Security White Papers
 https://docs.microsoft.com/en-us/azure/security/security-white-papers
@ebrucucen 2019/02/11 BRK3062 - Architecting Security and Governance Across your Azure Subscriptions THR2291 - Secure architecting for Azure BRK2368 - Practical guide for using Azure Security Center to protect hybrid cloud environment BRK3384 - Best practices for protecting modern cloud application architectures BRK2021 - Azure security & management THR3085 - The wizarding world of Microsoft CloudApp Security GS008 - Microsoft security: How the cloud helps us all be more secure REFERENCES - VIDEOS IGNITE/2018
@ebrucucen 2019/02/11 SO AS A SUMMARY ▸ Enable Security Center ▸ Enable all the logs you can ▸ Automate your policy management: Think AZSK! ▸ Give AppDevs freedom on the ring fenced cloud!
@ebrucucen 2019/02/11 QUESTIONS?
@ebrucucen 2019/02/11 QUESTIONS? THANK YOU

Recommended

Compliance as Code
Compliance as CodeCompliance as Code
Compliance as CodePaul Czarkowski
 
Transform your DevOps practices with Security
Transform your DevOps practices with SecurityTransform your DevOps practices with Security
Transform your DevOps practices with SecurityPaul Czarkowski
 
What’s New with NGINX Controller Load Balancing Module 2.0?
What’s New with NGINX Controller Load Balancing Module 2.0?What’s New with NGINX Controller Load Balancing Module 2.0?
What’s New with NGINX Controller Load Balancing Module 2.0?NGINX, Inc.
 
IT Governance and Security Architecture in Docker, Kubernetes, OpenShift
IT Governance and Security Architecture in Docker, Kubernetes, OpenShiftIT Governance and Security Architecture in Docker, Kubernetes, OpenShift
IT Governance and Security Architecture in Docker, Kubernetes, OpenShiftAarno Aukia
 
Making Git Work for the Enterprise Through the Power of Perforce Helix
Making Git Work for the Enterprise Through the Power of Perforce HelixMaking Git Work for the Enterprise Through the Power of Perforce Helix
Making Git Work for the Enterprise Through the Power of Perforce HelixPerforce
 
Flight East 2018 Presentation–Continuous Integration––An Overview
Flight East 2018 Presentation–Continuous Integration––An OverviewFlight East 2018 Presentation–Continuous Integration––An Overview
Flight East 2018 Presentation–Continuous Integration––An OverviewSynopsys Software Integrity Group
 
Managing the SSL Process
Managing the SSL ProcessManaging the SSL Process
Managing the SSL ProcessRocket Software
 
Get the Most Out of Kubernetes with NGINX
Get the Most Out of Kubernetes with NGINXGet the Most Out of Kubernetes with NGINX
Get the Most Out of Kubernetes with NGINXNGINX, Inc.
 

Recommended

Compliance as Code
Compliance as CodeCompliance as Code
Compliance as CodePaul Czarkowski
 
Transform your DevOps practices with Security
Transform your DevOps practices with SecurityTransform your DevOps practices with Security
Transform your DevOps practices with SecurityPaul Czarkowski
 
What’s New with NGINX Controller Load Balancing Module 2.0?
What’s New with NGINX Controller Load Balancing Module 2.0?What’s New with NGINX Controller Load Balancing Module 2.0?
What’s New with NGINX Controller Load Balancing Module 2.0?NGINX, Inc.
 
IT Governance and Security Architecture in Docker, Kubernetes, OpenShift
IT Governance and Security Architecture in Docker, Kubernetes, OpenShiftIT Governance and Security Architecture in Docker, Kubernetes, OpenShift
IT Governance and Security Architecture in Docker, Kubernetes, OpenShiftAarno Aukia
 
Making Git Work for the Enterprise Through the Power of Perforce Helix
Making Git Work for the Enterprise Through the Power of Perforce HelixMaking Git Work for the Enterprise Through the Power of Perforce Helix
Making Git Work for the Enterprise Through the Power of Perforce HelixPerforce
 
Flight East 2018 Presentation–Continuous Integration––An Overview
Flight East 2018 Presentation–Continuous Integration––An OverviewFlight East 2018 Presentation–Continuous Integration––An Overview
Flight East 2018 Presentation–Continuous Integration––An OverviewSynopsys Software Integrity Group
 
Managing the SSL Process
Managing the SSL ProcessManaging the SSL Process
Managing the SSL ProcessRocket Software
 
Get the Most Out of Kubernetes with NGINX
Get the Most Out of Kubernetes with NGINXGet the Most Out of Kubernetes with NGINX
Get the Most Out of Kubernetes with NGINXNGINX, Inc.
 
Flight East 2018 Presentation–A DevOps State of Mind: Continuous Security wit...
Flight East 2018 Presentation–A DevOps State of Mind: Continuous Security wit...Flight East 2018 Presentation–A DevOps State of Mind: Continuous Security wit...
Flight East 2018 Presentation–A DevOps State of Mind: Continuous Security wit...Synopsys Software Integrity Group
 
Moving Data Efficiently with Real-Time Streaming
Moving Data Efficiently with Real-Time StreamingMoving Data Efficiently with Real-Time Streaming
Moving Data Efficiently with Real-Time StreamingWSO2
 
Driving a PHP Application with MultiValue Data
Driving a PHP Application with MultiValue DataDriving a PHP Application with MultiValue Data
Driving a PHP Application with MultiValue DataRocket Software
 
Red Hat multi-cluster management & what's new in OpenShift
Red Hat multi-cluster management & what's new in OpenShiftRed Hat multi-cluster management & what's new in OpenShift
Red Hat multi-cluster management & what's new in OpenShiftKangaroot
 
Pivotal Cloud Foundry 2.4: A First Look
Pivotal Cloud Foundry 2.4: A First LookPivotal Cloud Foundry 2.4: A First Look
Pivotal Cloud Foundry 2.4: A First LookVMware Tanzu
 
Achieve Full API Lifecycle Management Using NGINX Controller – EMEA
Achieve Full API Lifecycle Management Using NGINX Controller – EMEAAchieve Full API Lifecycle Management Using NGINX Controller – EMEA
Achieve Full API Lifecycle Management Using NGINX Controller – EMEANGINX, Inc.
 
12-Factor Apps
12-Factor Apps12-Factor Apps
12-Factor AppsSiva Rama Krishna Chunduru
 
Efficient Security Development and Testing Using Dynamic and Static Code Anal...
Efficient Security Development and Testing Using Dynamic and Static Code Anal...Efficient Security Development and Testing Using Dynamic and Static Code Anal...
Efficient Security Development and Testing Using Dynamic and Static Code Anal...Perforce
 
A Secure DevOps Journey
A Secure DevOps JourneyA Secure DevOps Journey
A Secure DevOps JourneySonatype
 
APIs: Intelligent Routing, Security, & Management
APIs: Intelligent Routing, Security, & ManagementAPIs: Intelligent Routing, Security, & Management
APIs: Intelligent Routing, Security, & ManagementNGINX, Inc.
 
DevOps Spain 2019. Beatriz Martínez-IBM
DevOps Spain 2019. Beatriz Martínez-IBMDevOps Spain 2019. Beatriz Martínez-IBM
DevOps Spain 2019. Beatriz Martínez-IBMatSistemas
 
Monitoring Application Attack Surface to Integrate Security into DevOps Pipel...
Monitoring Application Attack Surface to Integrate Security into DevOps Pipel...Monitoring Application Attack Surface to Integrate Security into DevOps Pipel...
Monitoring Application Attack Surface to Integrate Security into DevOps Pipel...Denim Group
 
Architecting for now & the future with NGINX London April 19
Architecting for now & the future with NGINX London April 19Architecting for now & the future with NGINX London April 19
Architecting for now & the future with NGINX London April 19NGINX, Inc.
 
Modernizing Applications by Replacing F5 with the NGINX Application Delivery ...
Modernizing Applications by Replacing F5 with the NGINX Application Delivery ...Modernizing Applications by Replacing F5 with the NGINX Application Delivery ...
Modernizing Applications by Replacing F5 with the NGINX Application Delivery ...NGINX, Inc.
 
Dev secops security and compliance at the speed of continuous delivery - owasp
Dev secops security and compliance at the speed of continuous delivery - owaspDev secops security and compliance at the speed of continuous delivery - owasp
Dev secops security and compliance at the speed of continuous delivery - owaspDag Rowe
 
DevOps Presentation
DevOps PresentationDevOps Presentation
DevOps PresentationSmruti Ranjan Tripathy
 
Do You Need A Service Mesh?
Do You Need A Service Mesh?Do You Need A Service Mesh?
Do You Need A Service Mesh?NGINX, Inc.
 
Barbican 1.0 - Open Source Key Management for OpenStack
Barbican 1.0 - Open Source Key Management for OpenStackBarbican 1.0 - Open Source Key Management for OpenStack
Barbican 1.0 - Open Source Key Management for OpenStackjarito030506
 
Perforce Innovations Showcase 
Perforce Innovations Showcase Perforce Innovations Showcase 
Perforce Innovations Showcase Perforce
 
Implementing Microservices Security Patterns & Protocols with Spring
Implementing Microservices Security Patterns & Protocols with SpringImplementing Microservices Security Patterns & Protocols with Spring
Implementing Microservices Security Patterns & Protocols with SpringVMware Tanzu
 
SplunkSummit 2015 - Security Ninjitsu
SplunkSummit 2015 - Security NinjitsuSplunkSummit 2015 - Security Ninjitsu
SplunkSummit 2015 - Security NinjitsuSplunk
 
Detecting Malicious Cloud Account Behavior: A Look at the New Native Platform...
Detecting Malicious Cloud Account Behavior: A Look at the New Native Platform...Detecting Malicious Cloud Account Behavior: A Look at the New Native Platform...
Detecting Malicious Cloud Account Behavior: A Look at the New Native Platform...Priyanka Aash
 

More Related Content

What's hot

Flight East 2018 Presentation–A DevOps State of Mind: Continuous Security wit...
Flight East 2018 Presentation–A DevOps State of Mind: Continuous Security wit...Flight East 2018 Presentation–A DevOps State of Mind: Continuous Security wit...
Flight East 2018 Presentation–A DevOps State of Mind: Continuous Security wit...Synopsys Software Integrity Group
 
Moving Data Efficiently with Real-Time Streaming
Moving Data Efficiently with Real-Time StreamingMoving Data Efficiently with Real-Time Streaming
Moving Data Efficiently with Real-Time StreamingWSO2
 
Driving a PHP Application with MultiValue Data
Driving a PHP Application with MultiValue DataDriving a PHP Application with MultiValue Data
Driving a PHP Application with MultiValue DataRocket Software
 
Red Hat multi-cluster management & what's new in OpenShift
Red Hat multi-cluster management & what's new in OpenShiftRed Hat multi-cluster management & what's new in OpenShift
Red Hat multi-cluster management & what's new in OpenShiftKangaroot
 
Pivotal Cloud Foundry 2.4: A First Look
Pivotal Cloud Foundry 2.4: A First LookPivotal Cloud Foundry 2.4: A First Look
Pivotal Cloud Foundry 2.4: A First LookVMware Tanzu
 
Achieve Full API Lifecycle Management Using NGINX Controller – EMEA
Achieve Full API Lifecycle Management Using NGINX Controller – EMEAAchieve Full API Lifecycle Management Using NGINX Controller – EMEA
Achieve Full API Lifecycle Management Using NGINX Controller – EMEANGINX, Inc.
 
Efficient Security Development and Testing Using Dynamic and Static Code Anal...
Efficient Security Development and Testing Using Dynamic and Static Code Anal...Efficient Security Development and Testing Using Dynamic and Static Code Anal...
Efficient Security Development and Testing Using Dynamic and Static Code Anal...Perforce
 
A Secure DevOps Journey
A Secure DevOps JourneyA Secure DevOps Journey
A Secure DevOps JourneySonatype
 
APIs: Intelligent Routing, Security, & Management
APIs: Intelligent Routing, Security, & ManagementAPIs: Intelligent Routing, Security, & Management
APIs: Intelligent Routing, Security, & ManagementNGINX, Inc.
 
DevOps Spain 2019. Beatriz Martínez-IBM
DevOps Spain 2019. Beatriz Martínez-IBMDevOps Spain 2019. Beatriz Martínez-IBM
DevOps Spain 2019. Beatriz Martínez-IBMatSistemas
 
Monitoring Application Attack Surface to Integrate Security into DevOps Pipel...
Monitoring Application Attack Surface to Integrate Security into DevOps Pipel...Monitoring Application Attack Surface to Integrate Security into DevOps Pipel...
Monitoring Application Attack Surface to Integrate Security into DevOps Pipel...Denim Group
 
Architecting for now & the future with NGINX London April 19
Architecting for now & the future with NGINX London April 19Architecting for now & the future with NGINX London April 19
Architecting for now & the future with NGINX London April 19NGINX, Inc.
 
Modernizing Applications by Replacing F5 with the NGINX Application Delivery ...
Modernizing Applications by Replacing F5 with the NGINX Application Delivery ...Modernizing Applications by Replacing F5 with the NGINX Application Delivery ...
Modernizing Applications by Replacing F5 with the NGINX Application Delivery ...NGINX, Inc.
 
Dev secops security and compliance at the speed of continuous delivery - owasp
Dev secops security and compliance at the speed of continuous delivery - owaspDev secops security and compliance at the speed of continuous delivery - owasp
Dev secops security and compliance at the speed of continuous delivery - owaspDag Rowe
 
Do You Need A Service Mesh?
Do You Need A Service Mesh?Do You Need A Service Mesh?
Do You Need A Service Mesh?NGINX, Inc.
 
Barbican 1.0 - Open Source Key Management for OpenStack
Barbican 1.0 - Open Source Key Management for OpenStackBarbican 1.0 - Open Source Key Management for OpenStack
Barbican 1.0 - Open Source Key Management for OpenStackjarito030506
 
Perforce Innovations Showcase 
Perforce Innovations Showcase Perforce Innovations Showcase 
Perforce Innovations Showcase Perforce
 
Implementing Microservices Security Patterns & Protocols with Spring
Implementing Microservices Security Patterns & Protocols with SpringImplementing Microservices Security Patterns & Protocols with Spring
Implementing Microservices Security Patterns & Protocols with SpringVMware Tanzu
 

What's hot (20)

Flight East 2018 Presentation–A DevOps State of Mind: Continuous Security wit...
Flight East 2018 Presentation–A DevOps State of Mind: Continuous Security wit...Flight East 2018 Presentation–A DevOps State of Mind: Continuous Security wit...
Flight East 2018 Presentation–A DevOps State of Mind: Continuous Security wit...
 
Moving Data Efficiently with Real-Time Streaming
Moving Data Efficiently with Real-Time StreamingMoving Data Efficiently with Real-Time Streaming
Moving Data Efficiently with Real-Time Streaming
 
Driving a PHP Application with MultiValue Data
Driving a PHP Application with MultiValue DataDriving a PHP Application with MultiValue Data
Driving a PHP Application with MultiValue Data
 
Red Hat multi-cluster management & what's new in OpenShift
Red Hat multi-cluster management & what's new in OpenShiftRed Hat multi-cluster management & what's new in OpenShift
Red Hat multi-cluster management & what's new in OpenShift
 
Pivotal Cloud Foundry 2.4: A First Look
Pivotal Cloud Foundry 2.4: A First LookPivotal Cloud Foundry 2.4: A First Look
Pivotal Cloud Foundry 2.4: A First Look
 
Achieve Full API Lifecycle Management Using NGINX Controller – EMEA
Achieve Full API Lifecycle Management Using NGINX Controller – EMEAAchieve Full API Lifecycle Management Using NGINX Controller – EMEA
Achieve Full API Lifecycle Management Using NGINX Controller – EMEA
 
12-Factor Apps
12-Factor Apps12-Factor Apps
12-Factor Apps
 
Efficient Security Development and Testing Using Dynamic and Static Code Anal...
Efficient Security Development and Testing Using Dynamic and Static Code Anal...Efficient Security Development and Testing Using Dynamic and Static Code Anal...
Efficient Security Development and Testing Using Dynamic and Static Code Anal...
 
A Secure DevOps Journey
A Secure DevOps JourneyA Secure DevOps Journey
A Secure DevOps Journey
 
APIs: Intelligent Routing, Security, & Management
APIs: Intelligent Routing, Security, & ManagementAPIs: Intelligent Routing, Security, & Management
APIs: Intelligent Routing, Security, & Management
 
DevOps Spain 2019. Beatriz Martínez-IBM
DevOps Spain 2019. Beatriz Martínez-IBMDevOps Spain 2019. Beatriz Martínez-IBM
DevOps Spain 2019. Beatriz Martínez-IBM
 
Monitoring Application Attack Surface to Integrate Security into DevOps Pipel...
Monitoring Application Attack Surface to Integrate Security into DevOps Pipel...Monitoring Application Attack Surface to Integrate Security into DevOps Pipel...
Monitoring Application Attack Surface to Integrate Security into DevOps Pipel...
 
Architecting for now & the future with NGINX London April 19
Architecting for now & the future with NGINX London April 19Architecting for now & the future with NGINX London April 19
Architecting for now & the future with NGINX London April 19
 
Modernizing Applications by Replacing F5 with the NGINX Application Delivery ...
Modernizing Applications by Replacing F5 with the NGINX Application Delivery ...Modernizing Applications by Replacing F5 with the NGINX Application Delivery ...
Modernizing Applications by Replacing F5 with the NGINX Application Delivery ...
 
Dev secops security and compliance at the speed of continuous delivery - owasp
Dev secops security and compliance at the speed of continuous delivery - owaspDev secops security and compliance at the speed of continuous delivery - owasp
Dev secops security and compliance at the speed of continuous delivery - owasp
 
DevOps Presentation
DevOps PresentationDevOps Presentation
DevOps Presentation
 
Do You Need A Service Mesh?
Do You Need A Service Mesh?Do You Need A Service Mesh?
Do You Need A Service Mesh?
 
Barbican 1.0 - Open Source Key Management for OpenStack
Barbican 1.0 - Open Source Key Management for OpenStackBarbican 1.0 - Open Source Key Management for OpenStack
Barbican 1.0 - Open Source Key Management for OpenStack
 
Perforce Innovations Showcase 
Perforce Innovations Showcase Perforce Innovations Showcase 
Perforce Innovations Showcase 
 
Implementing Microservices Security Patterns & Protocols with Spring
Implementing Microservices Security Patterns & Protocols with SpringImplementing Microservices Security Patterns & Protocols with Spring
Implementing Microservices Security Patterns & Protocols with Spring
 

Similar to Compliance As Code

SplunkSummit 2015 - Security Ninjitsu
SplunkSummit 2015 - Security NinjitsuSplunkSummit 2015 - Security Ninjitsu
SplunkSummit 2015 - Security NinjitsuSplunk
 
Detecting Malicious Cloud Account Behavior: A Look at the New Native Platform...
Detecting Malicious Cloud Account Behavior: A Look at the New Native Platform...Detecting Malicious Cloud Account Behavior: A Look at the New Native Platform...
Detecting Malicious Cloud Account Behavior: A Look at the New Native Platform...Priyanka Aash
 
.conf Go Zurich 2022 - Security Session
.conf Go Zurich 2022 - Security Session.conf Go Zurich 2022 - Security Session
.conf Go Zurich 2022 - Security SessionSplunk
 
Kubernetes from the Ground Up
Kubernetes from the Ground UpKubernetes from the Ground Up
Kubernetes from the Ground UpDustin Humphries
 
Splunk Data Onboarding Overview - Splunk Data Collection Architecture
Splunk Data Onboarding Overview - Splunk Data Collection ArchitectureSplunk Data Onboarding Overview - Splunk Data Collection Architecture
Splunk Data Onboarding Overview - Splunk Data Collection ArchitectureSplunk
 
The Sysdig Secure DevOps Platform
The Sysdig Secure DevOps PlatformThe Sysdig Secure DevOps Platform
The Sysdig Secure DevOps PlatformAshnikbiz
 
Live Coding 12 Factor App
Live Coding 12 Factor AppLive Coding 12 Factor App
Live Coding 12 Factor AppEmily Jiang
 
Getting Started with Runtime Security on Azure Kubernetes Service (AKS)
Getting Started with Runtime Security on Azure Kubernetes Service (AKS)Getting Started with Runtime Security on Azure Kubernetes Service (AKS)
Getting Started with Runtime Security on Azure Kubernetes Service (AKS)DevOps.com
 
Machine Data 101: Turning Data Into Insight
Machine Data 101: Turning Data Into InsightMachine Data 101: Turning Data Into Insight
Machine Data 101: Turning Data Into InsightSplunk
 
DevOps Powered by Splunk
DevOps Powered by SplunkDevOps Powered by Splunk
DevOps Powered by SplunkSplunk
 
batbern43 Events - Lessons learnt building an Enterprise Data Bus
batbern43 Events - Lessons learnt building an Enterprise Data Busbatbern43 Events - Lessons learnt building an Enterprise Data Bus
batbern43 Events - Lessons learnt building an Enterprise Data BusBATbern
 
Machine Data 101
Machine Data 101Machine Data 101
Machine Data 101Splunk
 
Faster, more Secure Application Modernization and Replatforming with PKS - Ku...
Faster, more Secure Application Modernization and Replatforming with PKS - Ku...Faster, more Secure Application Modernization and Replatforming with PKS - Ku...
Faster, more Secure Application Modernization and Replatforming with PKS - Ku...VMware Tanzu
 
DevSecCon singapore 2019 Kunal Relan
DevSecCon singapore 2019 Kunal RelanDevSecCon singapore 2019 Kunal Relan
DevSecCon singapore 2019 Kunal RelanKunal Relan
 
Reactive to Proactive: Intelligent Troubleshooting and Monitoring with Splunk
Reactive to Proactive: Intelligent Troubleshooting and Monitoring with SplunkReactive to Proactive: Intelligent Troubleshooting and Monitoring with Splunk
Reactive to Proactive: Intelligent Troubleshooting and Monitoring with SplunkSplunk
 
Splunk und Multi-Cloud
Splunk und Multi-CloudSplunk und Multi-Cloud
Splunk und Multi-CloudSplunk
 
Security crawl walk run presentation mckay v1 2017
Security crawl walk run presentation mckay v1 2017Security crawl walk run presentation mckay v1 2017
Security crawl walk run presentation mckay v1 2017Adam Tice
 
Building 12-factor Cloud Native Microservices
Building 12-factor Cloud Native MicroservicesBuilding 12-factor Cloud Native Microservices
Building 12-factor Cloud Native MicroservicesJakarta_EE
 
(Micro?)services architecture in practice
(Micro?)services architecture in practice(Micro?)services architecture in practice
(Micro?)services architecture in practiceThe Software House
 

Similar to Compliance As Code (20)

SplunkSummit 2015 - Security Ninjitsu
SplunkSummit 2015 - Security NinjitsuSplunkSummit 2015 - Security Ninjitsu
SplunkSummit 2015 - Security Ninjitsu
 
Detecting Malicious Cloud Account Behavior: A Look at the New Native Platform...
Detecting Malicious Cloud Account Behavior: A Look at the New Native Platform...Detecting Malicious Cloud Account Behavior: A Look at the New Native Platform...
Detecting Malicious Cloud Account Behavior: A Look at the New Native Platform...
 
.conf Go Zurich 2022 - Security Session
.conf Go Zurich 2022 - Security Session.conf Go Zurich 2022 - Security Session
.conf Go Zurich 2022 - Security Session
 
Kubernetes from the Ground Up
Kubernetes from the Ground UpKubernetes from the Ground Up
Kubernetes from the Ground Up
 
Splunk Data Onboarding Overview - Splunk Data Collection Architecture
Splunk Data Onboarding Overview - Splunk Data Collection ArchitectureSplunk Data Onboarding Overview - Splunk Data Collection Architecture
Splunk Data Onboarding Overview - Splunk Data Collection Architecture
 
The Sysdig Secure DevOps Platform
The Sysdig Secure DevOps PlatformThe Sysdig Secure DevOps Platform
The Sysdig Secure DevOps Platform
 
Live Coding 12 Factor App
Live Coding 12 Factor AppLive Coding 12 Factor App
Live Coding 12 Factor App
 
Getting Started with Runtime Security on Azure Kubernetes Service (AKS)
Getting Started with Runtime Security on Azure Kubernetes Service (AKS)Getting Started with Runtime Security on Azure Kubernetes Service (AKS)
Getting Started with Runtime Security on Azure Kubernetes Service (AKS)
 
Machine Data 101: Turning Data Into Insight
Machine Data 101: Turning Data Into InsightMachine Data 101: Turning Data Into Insight
Machine Data 101: Turning Data Into Insight
 
DevOps Powered by Splunk
DevOps Powered by SplunkDevOps Powered by Splunk
DevOps Powered by Splunk
 
Flight East 2018 Presentation–Black Duck at Docusign
Flight East 2018 Presentation–Black Duck at DocusignFlight East 2018 Presentation–Black Duck at Docusign
Flight East 2018 Presentation–Black Duck at Docusign
 
batbern43 Events - Lessons learnt building an Enterprise Data Bus
batbern43 Events - Lessons learnt building an Enterprise Data Busbatbern43 Events - Lessons learnt building an Enterprise Data Bus
batbern43 Events - Lessons learnt building an Enterprise Data Bus
 
Machine Data 101
Machine Data 101Machine Data 101
Machine Data 101
 
Faster, more Secure Application Modernization and Replatforming with PKS - Ku...
Faster, more Secure Application Modernization and Replatforming with PKS - Ku...Faster, more Secure Application Modernization and Replatforming with PKS - Ku...
Faster, more Secure Application Modernization and Replatforming with PKS - Ku...
 
DevSecCon singapore 2019 Kunal Relan
DevSecCon singapore 2019 Kunal RelanDevSecCon singapore 2019 Kunal Relan
DevSecCon singapore 2019 Kunal Relan
 
Reactive to Proactive: Intelligent Troubleshooting and Monitoring with Splunk
Reactive to Proactive: Intelligent Troubleshooting and Monitoring with SplunkReactive to Proactive: Intelligent Troubleshooting and Monitoring with Splunk
Reactive to Proactive: Intelligent Troubleshooting and Monitoring with Splunk
 
Splunk und Multi-Cloud
Splunk und Multi-CloudSplunk und Multi-Cloud
Splunk und Multi-Cloud
 
Security crawl walk run presentation mckay v1 2017
Security crawl walk run presentation mckay v1 2017Security crawl walk run presentation mckay v1 2017
Security crawl walk run presentation mckay v1 2017
 
Building 12-factor Cloud Native Microservices
Building 12-factor Cloud Native MicroservicesBuilding 12-factor Cloud Native Microservices
Building 12-factor Cloud Native Microservices
 
(Micro?)services architecture in practice
(Micro?)services architecture in practice(Micro?)services architecture in practice
(Micro?)services architecture in practice
 

More from Ebru Cucen Çüçen

Evolution of Graph Algorithms – Benefits and Challenges
Evolution of Graph Algorithms – Benefits and ChallengesEvolution of Graph Algorithms – Benefits and Challenges
Evolution of Graph Algorithms – Benefits and ChallengesEbru Cucen Çüçen
 
How to Decentralise Controls (Hint: BDD on Policies)
How to Decentralise Controls (Hint: BDD on Policies)How to Decentralise Controls (Hint: BDD on Policies)
How to Decentralise Controls (Hint: BDD on Policies)Ebru Cucen Çüçen
 
Ebru cucen cloudnativeconference_20190925
Ebru cucen cloudnativeconference_20190925Ebru cucen cloudnativeconference_20190925
Ebru cucen cloudnativeconference_20190925Ebru Cucen Çüçen
 
Automating AWS And Azure Resources with Octopus Deploy
Automating AWS And Azure Resources with Octopus DeployAutomating AWS And Azure Resources with Octopus Deploy
Automating AWS And Azure Resources with Octopus DeployEbru Cucen Çüçen
 
CI/CD Pipeline with Octopus Deploy
CI/CD Pipeline with Octopus DeployCI/CD Pipeline with Octopus Deploy
CI/CD Pipeline with Octopus DeployEbru Cucen Çüçen
 

More from Ebru Cucen Çüçen (10)

Evolution of Graph Algorithms – Benefits and Challenges
Evolution of Graph Algorithms – Benefits and ChallengesEvolution of Graph Algorithms – Benefits and Challenges
Evolution of Graph Algorithms – Benefits and Challenges
 
How to Decentralise Controls (Hint: BDD on Policies)
How to Decentralise Controls (Hint: BDD on Policies)How to Decentralise Controls (Hint: BDD on Policies)
How to Decentralise Controls (Hint: BDD on Policies)
 
Observability
ObservabilityObservability
Observability
 
Observability
ObservabilityObservability
Observability
 
Ebru cucen cloudnativeconference_20190925
Ebru cucen cloudnativeconference_20190925Ebru cucen cloudnativeconference_20190925
Ebru cucen cloudnativeconference_20190925
 
GCP - 101
GCP - 101GCP - 101
GCP - 101
 
DevOps
DevOpsDevOps
DevOps
 
Automating AWS And Azure Resources with Octopus Deploy
Automating AWS And Azure Resources with Octopus DeployAutomating AWS And Azure Resources with Octopus Deploy
Automating AWS And Azure Resources with Octopus Deploy
 
CI/CD Pipeline with Octopus Deploy
CI/CD Pipeline with Octopus DeployCI/CD Pipeline with Octopus Deploy
CI/CD Pipeline with Octopus Deploy
 
Azure WebApp Deployment Slots
Azure WebApp Deployment Slots Azure WebApp Deployment Slots
Azure WebApp Deployment Slots
 

Recently uploaded

SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024Scott Keck-Warren
 
Key Features Of Token Development (1).pptx
Key Features Of Token Development (1).pptxKey Features Of Token Development (1).pptx
Key Features Of Token Development (1).pptxLBM Solutions
 
SIEMENS: RAPUNZEL – A Tale About Knowledge Graph
SIEMENS: RAPUNZEL – A Tale About Knowledge GraphSIEMENS: RAPUNZEL – A Tale About Knowledge Graph
SIEMENS: RAPUNZEL – A Tale About Knowledge GraphNeo4j
 
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024BookNet Canada
 
Beyond Boundaries: Leveraging No-Code Solutions for Industry Innovation
Beyond Boundaries: Leveraging No-Code Solutions for Industry InnovationBeyond Boundaries: Leveraging No-Code Solutions for Industry Innovation
Beyond Boundaries: Leveraging No-Code Solutions for Industry InnovationSafe Software
 
Understanding the Laravel MVC Architecture
Understanding the Laravel MVC ArchitectureUnderstanding the Laravel MVC Architecture
Understanding the Laravel MVC ArchitecturePixlogix Infotech
 
Pigging Solutions Piggable Sweeping Elbows
Pigging Solutions Piggable Sweeping ElbowsPigging Solutions Piggable Sweeping Elbows
Pigging Solutions Piggable Sweeping ElbowsPigging Solutions
 
Connect Wave/ connectwave Pitch Deck Presentation
Connect Wave/ connectwave Pitch Deck PresentationConnect Wave/ connectwave Pitch Deck Presentation
Connect Wave/ connectwave Pitch Deck PresentationSlibray Presentation
 
Bun (KitWorks Team Study 노별마루 발표 2024.4.22)
Bun (KitWorks Team Study 노별마루 발표 2024.4.22)Bun (KitWorks Team Study 노별마루 발표 2024.4.22)
Bun (KitWorks Team Study 노별마루 발표 2024.4.22)Wonjun Hwang
 
Bluetooth Controlled Car with Arduino.pdf
Bluetooth Controlled Car with Arduino.pdfBluetooth Controlled Car with Arduino.pdf
Bluetooth Controlled Car with Arduino.pdfngoud9212
 
Are Multi-Cloud and Serverless Good or Bad?
Are Multi-Cloud and Serverless Good or Bad?Are Multi-Cloud and Serverless Good or Bad?
Are Multi-Cloud and Serverless Good or Bad?Mattias Andersson
 
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...Patryk Bandurski
 
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmaticsKotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmaticscarlostorres15106
 
Transcript: New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024Transcript: New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024BookNet Canada
 
Artificial intelligence in the post-deep learning era
Artificial intelligence in the post-deep learning eraArtificial intelligence in the post-deep learning era
Artificial intelligence in the post-deep learning eraDeakin University
 
Benefits Of Flutter Compared To Other Frameworks
Benefits Of Flutter Compared To Other FrameworksBenefits Of Flutter Compared To Other Frameworks
Benefits Of Flutter Compared To Other FrameworksSoftradix Technologies
 
Human Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR SystemsHuman Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR SystemsMark Billinghurst
 
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...shyamraj55
 

Recently uploaded (20)

SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024
 
Key Features Of Token Development (1).pptx
Key Features Of Token Development (1).pptxKey Features Of Token Development (1).pptx
Key Features Of Token Development (1).pptx
 
SIEMENS: RAPUNZEL – A Tale About Knowledge Graph
SIEMENS: RAPUNZEL – A Tale About Knowledge GraphSIEMENS: RAPUNZEL – A Tale About Knowledge Graph
SIEMENS: RAPUNZEL – A Tale About Knowledge Graph
 
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
#StandardsGoals for 2024: What’s new for BISAC - Tech Forum 2024
 
Beyond Boundaries: Leveraging No-Code Solutions for Industry Innovation
Beyond Boundaries: Leveraging No-Code Solutions for Industry InnovationBeyond Boundaries: Leveraging No-Code Solutions for Industry Innovation
Beyond Boundaries: Leveraging No-Code Solutions for Industry Innovation
 
Understanding the Laravel MVC Architecture
Understanding the Laravel MVC ArchitectureUnderstanding the Laravel MVC Architecture
Understanding the Laravel MVC Architecture
 
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptxE-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
E-Vehicle_Hacking_by_Parul Sharma_null_owasp.pptx
 
Pigging Solutions Piggable Sweeping Elbows
Pigging Solutions Piggable Sweeping ElbowsPigging Solutions Piggable Sweeping Elbows
Pigging Solutions Piggable Sweeping Elbows
 
Connect Wave/ connectwave Pitch Deck Presentation
Connect Wave/ connectwave Pitch Deck PresentationConnect Wave/ connectwave Pitch Deck Presentation
Connect Wave/ connectwave Pitch Deck Presentation
 
Bun (KitWorks Team Study 노별마루 발표 2024.4.22)
Bun (KitWorks Team Study 노별마루 발표 2024.4.22)Bun (KitWorks Team Study 노별마루 발표 2024.4.22)
Bun (KitWorks Team Study 노별마루 발표 2024.4.22)
 
Bluetooth Controlled Car with Arduino.pdf
Bluetooth Controlled Car with Arduino.pdfBluetooth Controlled Car with Arduino.pdf
Bluetooth Controlled Car with Arduino.pdf
 
Are Multi-Cloud and Serverless Good or Bad?
Are Multi-Cloud and Serverless Good or Bad?Are Multi-Cloud and Serverless Good or Bad?
Are Multi-Cloud and Serverless Good or Bad?
 
DMCC Future of Trade Web3 - Special Edition
DMCC Future of Trade Web3 - Special EditionDMCC Future of Trade Web3 - Special Edition
DMCC Future of Trade Web3 - Special Edition
 
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
Integration and Automation in Practice: CI/CD in Mule Integration and Automat...
 
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmaticsKotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
 
Transcript: New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024Transcript: New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
 
Artificial intelligence in the post-deep learning era
Artificial intelligence in the post-deep learning eraArtificial intelligence in the post-deep learning era
Artificial intelligence in the post-deep learning era
 
Benefits Of Flutter Compared To Other Frameworks
Benefits Of Flutter Compared To Other FrameworksBenefits Of Flutter Compared To Other Frameworks
Benefits Of Flutter Compared To Other Frameworks
 
Human Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR SystemsHuman Factors of XR: Using Human Factors to Design XR Systems
Human Factors of XR: Using Human Factors to Design XR Systems
 
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
 

Compliance As Code

  • 2. @ebrucucen 2019/02/11 WHO AM I? ▸ DevOps Consultant at Contino, spent 11 years of 16 years of career in consulting financial institutions delivering applications/platforms
 Banksoft, AXA, BUPA, Investec, VanquisBank, LloydsBank ▸ Life time student, with more questions than answers, developer in heart, loves APIs, automation, cloud/hybrid solutions, vegan, mum… @ebrucucen 2019/02/11
  • 3. @ebrucucen 2019/02/11 AGENDA PART I 1. Compliance 2. Compliance On Azure ‣ Data Sources ‣ Metrics/Logs ‣ Monitoring ‣ Log Analytics PART II 3. Governance on Azure ‣ Security Center ‣ BluePrints 4. AzSK ‣ CI/CD ‣ Customize
  • 4. @ebrucucen 2019/02/11 THIS TALK IS NOT ▸ By a security expert ▸ a personal experience/battles with the Operations/ Security/Risk teams ▸ About saving money ▸ almost every solution will incur cost
  • 5. @ebrucucen 2019/02/11 I. COMPLIANCE CONFORMING TO A RULE, SUCH AS A SPECIFICATION, POLICY, STANDARD OR LAW
  • 6. @ebrucucen 2019/02/11 COMPLIANCE CHALLENGES ▸ Data Protection Compliance ▸ Risk assessment, auditing, operations, technology ▸ Industrial regulations and standards <> tech knowledge ▸ Multi-device/cloud/ ▸ Cost: ▸ >200 updates from 750 regulatory bodies ▸ 32% of companies spend >4h/w to create/amend reports
 
 
 
 
 
 Human effort required for organisational compliance
  • 7. @ebrucucen 2019/02/11 COMPLIANCE ON CLOUD? ▸ Azure Complied with Shared Responsibility Model ▸ Azure “MORE CERTIFICATIONS THAN ANY OTHER CLOUD PROVIDER”
  • 8. @ebrucucen 2019/02/11 AZURE SUPPORT ▸ Documents ▸ Audit Reports ▸ Data Protection Guides ▸ Azure Security and Compliance BluePrints https://servicetrust.microsoft.com/ViewPage/BlueprintOverview
 http://aka.ms/pciblueprint
 https://docs.microsoft.com/en-us/azure/security/blueprints/pcidss-paaswa-overview#compliance-documentation Government Blueprints
 FedRAMP Blueprint
 UK OFFICIAL Blueprint
 NIST SP 800-171 Blueprint
 AU-PROTECTED
 Additional Frameworks Finance Blueprints
 
 FFIEC Blueprint
 PCI-DSS Blueprint Healthcare Blueprints
 
 HIPAA / HITRUST Blueprint
 UK NHS Blueprint Retail Blueprints
 
 PCI-DSS Blueprint Customer Responsibility Matrix
 Reference Architecture
 Implementation Matrix
 Overview
 Threat Model Data Analytics/Data Warehouse/IAAS/PAAS
  • 9. @ebrucucen 2019/02/11 QUICK INSIGHT ▸ What does PCI-DSS BluePrint look like? http://aka.ms/pciblueprint
  • 10. @ebrucucen 2019/02/11 II. AZURE BASICS FOR COMPLIANCE DATA
  • 12. @ebrucucen 2019/02/11 ▸ Are collected at regular intervals ▸ One minute by default ▸ Unique: Category = Metric + Namespace ▸ Stored for 93 days ▸ Multi-dimensional ▸ Properties [up to 10] ▸ Resource ▸ Type of Measurement ▸ Value ▸ Time DATA SOURCES - METRICS
  • 13. @ebrucucen 2019/02/11 ▸ Properties ▸ Irregular ▸ Stored for x days ▸ Metrics -> Logs ▸ Types ▸ Control/Management Plane ▸ Data Plane ▸ Processed Events DATA SOURCES - LOGS
  • 14. @ebrucucen 2019/02/11 ▸ Properties ▸ Irregular ▸ Stored for x days ▸ Metrics -> Logs ▸ Types ▸ Control/Management Plane ▸ Data Plane ▸ Processed Events DATA SOURCES - LOGS Audit Logs Azure Tenant Metrics Application Azure Subscription Service Health Activity Logs Azure Resources Diagnostic Logs Monitoring Solutions Guest OS Application Insights Dependency Agent Log Analytics Agent Diagnostics Extension Azure Custom API Data Collector API Non-Azure Service Configuration
  • 15. @ebrucucen 2019/02/11 AZURE AD LOGS ▸ Editions: Basic, Free, Premium P1, Premium P2 ▸ Diagnostics Settings ▸ Audit Logs ▸ Sign-in Logs (PP2) ▸ Security Signals (opt-in IPC) ▸ Users at risk ▸ Risky sign-ins ▸ Activity Data is available 2 hours after turning on reporting ▸ 30 days of retention reports (PP1/PP2) ▸ 30/90 days of retention of security signals (PP1/PP2)
  • 22. @ebrucucen 2019/02/11 ▸ Low Latency (min 1 min interval) ▸ Control over metric condition ▸ Combined monitoring of multiple metrics ▸ Modular notification system ▸ Tip: Unify your alerts/sampling intervals for sanity ALERTS (NEW)
  • 23. @ebrucucen 2019/02/11 DEMO ▸ WebApp & VM ▸ Metrics/Logs ▸ Query ▸ Alert
  • 27. @ebrucucen 2019/02/11 SECURE? ✓ Data Protection ✓ Identity and Access Management ✓ Network Security ✓ Threat Protection ✓ Security Management https://www.cisecurity.org/benchmark/azure/
  • 30. @ebrucucen 2019/02/11 AZURE SECURITY CENTRE https://www.gartner.com/reviews/market/cloud-workload-protection-platforms/vendors
  • 33. @ebrucucen 2019/02/11 SECURITY CENTRE ▸ One Step Closer to Automation
  • 34. @ebrucucen 2019/02/11 DEMO ▸ Security Dashboard ▸ Issues ▸ Recommendations
  • 35. @ebrucucen 2019/02/11 AZURE MANAGEMENT/GOVERNANCE ▸ How to do Compliance As Code with Azure
  • 37. @ebrucucen 2019/02/11 RESOURCE GRAPH where type =~ 'Microsoft.Compute/virtualMachines' | project name, properties.storageProfile.osDisk.osType | top 5 by name desc Search-AzGraph -Query "project tags | summarize buildschema(tags)” # Use Resource Graph to get all NICs and store in the 'nic' variable az graph query -q "where type =~ 'Microsoft.Compute/virtualMachines' | project nic = tostring(properties['networkProfile']['networkInterfaces'][0]['id']) | where isnotempty(nic) | distinct nic | limit 20" --output table | tail -n +3 > nics.txt # Review the output of the query stored in 'nics.txt' cat nics.txt # Use Resource Graph with the 'nics.txt' file to get all related public IP addresses and store in 'publicIp.txt' file az graph query -q="where type =~ 'Microsoft.Network/networkInterfaces' | where id in ('$(awk -vORS="','" '{print $0}' nics.txt | sed 's/,$//')') | project publicIp = tostring(properties['ipConfigurations'][0]['properties'] ['publicIPAddress']['id']) | where isnotempty(publicIp) | distinct publicIp" --output table | tail -n +3 > ips.txt # Review the output of the query stored in 'ips.txt' cat ips.txt # Use Resource Graph with the 'ips.txt' file to get the IP address of the public IP address resources az graph query -q="where type =~ 'Microsoft.Network/publicIPAddresses' | where id in ('$(awk -vORS="','" '{print $0}' ips.txt | sed 's/,$//')') | project ip = tostring(properties['ipAddress']) | where isnotempty(ip) | distinct ip" --output table ALL VM PUBLIC IPS: (AZ CLI) ALL TAG NAMES: (POWERSHELL) FIRST 5 VM OS TYPES: (KUSTO QUERY*) https://docs.microsoft.com/en-us/azure/kusto/query/index
  • 38. @ebrucucen 2019/02/11 ▸ Enforce ▸ ASC on? ▸ Level of compliance? ▸ Threat detection/protection? ▸ Monitoring and auditing on? ▸ Network Security ▸ JIT and NSG for everything ▸ Adaptive Application Controls ▸ SIEM? ▸ WAF (Tested)? ▸ Integrate other sec tools (IPS/IDS/HIPS/Other) POLICY (SET) WHAT? PAAS? IAAS? NETWORK? HOW? IDENTITY & ACCESS MANAGEMENT? DATA & ENCRYPTION? AUDIT DEPLOY APPENDDENY
  • 42. @ebrucucen 2019/02/11 SECURE PIPELINE? APPLICATION CI/CD NIGHTLY TEST RUNS Static code analysis Code Review WI Linking Static Code Analysis OSS Vulnerability Scan Unit Tests Code Metrics Passive Pen Test SSL Scanner
 Infrastructure Scan Infrastructure Scan Load and Performance Testing Automated Regression Testing Infrastructure Scan Active Pen Test Infrastructure Scan LOCAL/
 PR CI DEV TEST FEEDBACK Code Review Comments
 Static Code Rules Warnings OSS Library Vulnerabilities
 OSS Licence Violations
 Failed Unit Testing
 Static Code Rule Warnings Pen Test Issues
 SSL Issues
 Performance Issues
 Regression Issues Pen Test Issues
 Infrastructure Issues
  • 43. @ebrucucen 2019/02/11 SECURE PIPELINE? APPLICATION CI/CD NIGHTLY TEST RUNS Static code analysis Code Review WI Linking Static Code Analysis OSS Vulnerability Scan Unit Tests Code Metrics Passive Pen Test SSL Scanner
 Infrastructure Scan Infrastructure Scan Load and Performance Testing Automated Regression Testing Infrastructure Scan Active Pen Test Infrastructure Scan LOCAL/
 PR CI DEV TEST FEEDBACK Code Review Comments
 Static Code Rules Warnings OSS Library Vulnerabilities
 OSS Licence Violations
 Failed Unit Testing
 Static Code Rule Warnings Pen Test Issues
 SSL Issues
 Performance Issues
 Regression Issues Pen Test Issues
 Infrastructure Issues POLICY
  • 46. @ebrucucen 2019/02/11 AZSK - OVERVIEW ▸ Requires SPN / OMS ▸ Runs Default policies ▸ Creates a Log/PDF Report for each execution ▸ Generates Manual/AutoFix scripts
  • 47. @ebrucucen 2019/02/11 DEMO: AZSK ▸ Set up Policy Configuration ▸ CI/CD ▸ Check ARM Template ▸ Security Verification Test
  • 50. @ebrucucen 2019/02/11 PLAN B -DEMO FAILS ▸ GSS
  • 54. @ebrucucen 2019/02/11 PLAN B: DEMO FAILS CI/CD
  • 55. @ebrucucen 2019/02/11 EXTRAS: WEB APP - BEST PRACTICES ▸ Use Certs ▸ Authenticate users (with) ▸ Advanced auth ▸ Configure TLS mutual auth ▸ Managed Identity ▸ Reference secrets from Key Vault ▸ Restrict IPs ▸ Turn on Web Server/Application Logging ▸ Automate Backups https://docs.microsoft.com/en-us/azure/app-service/web-sites-purchase-ssl-web-site
  • 56. @ebrucucen 2019/02/11 EXTRAS: HARDENING VM ▸ Control VM access ▸ Reduce variability in your setup and deployment of VMs ▸ Secure privileged access ▸ Use multiple VMs for better availability ▸ Protect against malware ▸ Keep VMs current ▸ Deploy and test a backup solution ▸ Encrypt your virtual hard disk files https://docs.microsoft.com/en-us/azure/security/azure-security-iaas
  • 57. @ebrucucen 2019/02/11 EXTRAS: HARDENING IDENTITY MANAGEMENT 
 Protect privileged accounts with MFA 1. Strengthen your credentials. 2. Reduce your attack surface area. 3. Automate threat response. 4. Increase your awareness of auditing and monitoring. 5. Enable more predictable and complete end-user security with self-help https://docs.microsoft.com/en-us/azure/security/azure-ad-secure-steps
  • 58. @ebrucucen 2019/02/11 EXTRAS: IDENTITY MANAGEMENT BEST PRACTICES 1. Treat Identity as the primary security perimeter 2. Centralise Identity Management 3. Enable SSO 4. Turn on Conditional Access 5. Enforce MFA 6. Use RBAC 7. Lower exposure of privileged accounts (JIT, 2 EmergencyAccess) 8. Actively monitor for suspicious activities
  • 59. @ebrucucen 2019/02/11 EXTRAS: NETWORK SECURITY BEST PRACTICES 1. Logically segment subnets 2. Control routing behaviour 3. Enable forced tunnelling 4. Use virtual network appliances 5. Deploy perimeter network for security zones 6. Avoid exposure to Internet with dedicated WAN links 7. Optimise uptime and performance 8. Disable RDP/SSH to VMs
  • 60. @ebrucucen 2019/02/11 EXTRAS: THREAT MODELLING Threat Security property Potential Azure platform mitigation Spoofing Authentication Require HTTPS connections. Tampering Integrity Validate SSL/TLS certificates.Applications that use SSL/TLS must fully verify the X.509 certificates of the entities they connect to. Use Azure Key Vault certificates to manage your x509 certificates. Repudiation Non-repudiation Enable Azure monitoring and diagnostics. Information Disclosure Confidentiality Encrypt sensitive data at rest and in transit. Denial of Service Availability Monitor performance metrics for potential denial of service conditions. Implement connection filters. Azure DDoS protection combined with application design best practices provides defense against DDoS attacks. Elevation of Privilege Authorization Use Azure Active Directory Privileged Identity Management.
  • 61. @ebrucucen 2019/02/11 REFERENCES - BOOKS ▸ Microsoft Security Center
 https://www.amazon.co.uk/Microsoft-Azure-Security-Center-Practices-ebook/ dp/B07D5J97JV ▸ Pentesting Azure Applications
 https://www.amazon.co.uk/Pentesting-Azure-Definitive-Attack-Defense/dp/ 1593278632 ▸ Deep dive Presentation:
 https://www.sans.org/cyber-security-summit/archives/file/summit- archive-1540308627.pdf ▸ AZSK: 
 https://github.com/azsk/DevOpsKit-docs ▸ Security White Papers
 https://docs.microsoft.com/en-us/azure/security/security-white-papers
  • 62. @ebrucucen 2019/02/11 BRK3062 - Architecting Security and Governance Across your Azure Subscriptions THR2291 - Secure architecting for Azure BRK2368 - Practical guide for using Azure Security Center to protect hybrid cloud environment BRK3384 - Best practices for protecting modern cloud application architectures BRK2021 - Azure security & management THR3085 - The wizarding world of Microsoft CloudApp Security GS008 - Microsoft security: How the cloud helps us all be more secure REFERENCES - VIDEOS IGNITE/2018
  • 63. @ebrucucen 2019/02/11 SO AS A SUMMARY ▸ Enable Security Center ▸ Enable all the logs you can ▸ Automate your policy management: Think AZSK! ▸ Give AppDevs freedom on the ring fenced cloud!