July 25, 2017 RSA Singapore presentation.

1. SESSION ID:SESSION ID:
#RSAC
Matt Ray
Compliance as Code: Shifting
Compliance Left in Continuous Delivery
Manager/Solutions Architect APJ
Chef Software
@mattray

2. #RSAC

3. #RSAC

4. #RSAC
Continuous Integration
Continuous Integration requires developers to integrate code into
a shared repository several times a day.
Each check-in is then verified by an automated build, allowing
teams to detect problems early.
By integrating regularly, you can detect errors quickly, and locate
them more easily.

5. #RSAC
Continuous Deployment
Continuous Integration is the practice of testing each change done
to your codebase automatically and as early as possible.
Continuous Deployment follows the testing that happens during
Continuous Integration and pushes changes to a staging or
production system.
This makes sure a version of your code is accessible at all times.

6. #RSAC
CI/CD Pipelines

7. #RSAC
Audits and Security Reviews

8. #RSAC

9. #RSAC
SSH Control
“SSH supports two different protocol versions. The original
version, SSHv1, was subject to a number of security issues. Please
use SSHv2 instead to avoid these.”

10. #RSAC
How will I verify this?

11. #RSAC
A one-liner with grep!
grep "^Protocol" /etc/ssh/sshd_config | sed 's/Protocol //'

12. #RSAC

13. #RSAC
More grep and sed!
grep "^ServerTokens" /etc/httpd/conf/httpd.conf | sed 's/ServerTokens //'

14. #RSAC

15. #RSAC

16. #RSAC

17. #RSAC

18. #RSAC

19. #RSAC
C
o
m
p
l
i
a
n
c
e

20. #RSAC

21. #RSAC
“Two-thirds of organizations did not
adequately test the security of all in-
scope systems”

22. #RSAC
While individual rule
compliance is up, testing
of security systems is
down
Sustainability is low.
Fewer than a third of
companies were found to
be still fully compliant
less than a year after
successful validation.
Key Trends

23. #RSAC

24. #RSAC
Shell Scripts
grep "^Protocol" /etc/ssh/sshd_config | sed 's/Protocol //'
grep "^ServerTokens" /etc/httpd/conf/httpd.conf | sed 's/ServerTokens //'

25. #RSAC
Infrastructure Code
package 'httpd' do
action :install
end
service 'httpd' do
action [ :start, :enable ]
end

26. #RSAC
We Have A Communications Problem

27. #RSAC

28. #RSAC
Security != Compliance

29. #RSAC
Secure
Compliant

30. #RSAC

31. #RSAC

32. #RSAC

33. #RSAC

34. #RSAC

35. #RSAC
Role of the Compliance Officer
Compliance at VelocityManual Compliance
Reactive
engagement
Proactive
engagement
Checking
implementations
by hand
Expressing policy
as testable code
Short term
compliance
Long term process
improvement

36. #RSAC
Compliance as Code
• Source control
• Versioned
• Tested
• Shared

37. #RSAC

38. #RSAC
Detect and Correct
Scan for
Compliance
Build & Test
Locally
Build & Test
CI/CD Remediate Verify

39. #RSAC
Accelerated Cycle
INFRASTRUCTURE
AS CODE
POLICY
AS CODE
PRACTICE
AS CODE
Separate
certification
& testing
Common
language for
describing &
applying policy
Compliance at velocity

40. #RSAC
Turns security and compliance into code

41. #RSAC
Compliance Language

42. #RSAC
One Language
• Linux, Windows, BSD, Solaris, AIX, HP-UX, ...

43. #RSAC
Windows

44. #RSAC
One Language
• Linux, Windows, BSD, Solaris, AIX, HP-UX, ...
• Bare-metal, VMs, Containers
• Databases, APIs, Cloud Platforms, ...

45. #RSAC
Databases

46. #RSAC
Cloud Platforms

47. #RSAC
One Language
• Linux, Windows, BSD, Solaris, AIX, HP-UX, ...
• Bare-metal, VMs, Containers
• Databases, APIs, Cloud Platforms, ...

48. #RSAC
Examples of Available Resources
apache_conf
apt
audit_policy
auditd_conf
auditd_rules
command
crontab
directory
etc_group
file
gem
group
host
inetd_conf
interface
iptables
kernel_module
kernel_parameter
limits_conf
mount
mysql_conf
mysql_session
npm
os
os_env
package
parse_config
passwd
pip
port
postgres_conf
postgres_session
powershell
processes
registry_key
security_policy
service
ssh_config
sshd_config
user
windows_feature
yum

49. #RSAC
InSpec
> inspec exec test.rb
Test a machine remotely via SSH
> inspec exec test.rb -i identity.key -t ssh://root@172.17.0.1
Test your machine locally
> inspec exec test.rb -t winrm://Admin@192.168.1.2 --password xyz
Test Docker Container
> inspec exec test.rb -t docker://5cc8837bb6a8
Test a machine remotely via WinRM
AGENTLESS

50. #RSAC
Operating System & Application Coverage
Microsoft Windows
Red Hat Enterprise Linux
Ubuntu Linux
SUSE Linux Enterprise Server
Oracle Enterprise Linux
AIX
HP-UX
Solaris
VMware ESXi
MySQL
Oracle
PostgreSQL
Tomcat
SQL Server
IIS
HTTP request

51. #RSAC
Open Source Community
https://inspec.io
Code
https://github.com/chef/inspec
Profiles
https://supermarket.chef.io
Tutorials
https://learn.chef.io
#inspec in https://chefcommunity.slack.com

52. #RSAC
What is it not?
IDS / IPS
Firewall
Antivirus
Pentesting tool

53. #RSAC
CONTINUOUS COMPLIANCE AUTOMATIONFIREWALL ANTIVIRUS
INTRUSION
DETECTION/
PREVENTION
PENETRATION
TESTING
InSpec - Part of your InfoSec toolchain

54. #RSAC
The New DevSecOps
The Old Way
People working directly on machines
SECURITY
DEVOPS
COMPLIANCE
The New Way
Shared tooling across organizations

55. #RSAC
Thanks!
Matt Ray
Manager/Solutions Architect APJ
matt@chef.io
@mattray

56. #RSAC
Sponsors of DevOps Connect: DevSecOps