Automated System Compliance From the Inside Out

Start Compliant. Stay Compliant. Trevor Vaughan, Onyx Point
Trevor Vaughan
VP Engineering - Onyx Point, Inc.
Product Lead
B.S. Computer Engineering,
M. S. Information Assurance
RHCE, PCP, PCD
Automated System Compliance
From the Inside Out
All trademarks are property of their respective owners. All company, product and service names used in this presentation are for
identification purposes only. Use of these names, logos, and brands does not imply endorsement.

● Automation, Security, and Compliance
− Consulting and Contracting since 2009
Puppet Gold Partners
GitLab Partners
RHEL, CentOS, and SuSE
Cloud Infrastructure
Distributed Data Flow Architectures
DevOps Workflow
Test Automation
● Maintainers of

Source: Gears of War

PROVABLE DISPROVABLE
SECURITY X ✔
COMPLIANCE ✔ ✔

Systems Engineering Body of Knowledge - System Realization

NIST 800-171
§3.3.1: Create, protect, and retain information system audit records to
the extent needed to enable the monitoring, analysis, investigation, and
reporting of unlawful, unauthorized, or inappropriate information system
activity.
Requirement Enable the auditd service
Specification
1. Install auditd
2. Enable auditd
3. Ensure auditd started at boot time

class auditd (
Boolean $enable = false,
Boolean $at_boot = true
) {
package { 'audit': ensure => 'installed' }
service { 'auditd': enable => $enable }
$kernel_enable = $enable ? { true => '1', default => '0' }
kernel_parameter { 'audit': value => $kernel_enable }
}
1. Install auditd
2. Enable auditd
3. Ensure auditd started at boot time

COMPLIANCE MODULE

---
compliance_markup::compliance_map:
version : '1.0.1'
nist_800_171:
auditd_demo::enable:
identifiers :
- '3.3.1'
value : true
auditd_demo::at_boot:
identifiers :
- '3.3.1'
value : true
~ 750
Parameters Mapped

# /opt/puppetlabs/server/data/puppetserver/simp/compliance_reports
{ "version": "1.0.1",
"fqdn": "el7.int.localdomain",
"puppetserver_info": "local_compile",
"compliance_profiles": {
"nist_800_171": {
"non_compliant": {
"Class[Auditd]": {
"parameters": {
"enable": {
"identifiers": [ "3.3.1" ],
"compliant_value": true,
"system_value": false } } } } } } } } } } }

control 'V-72079' do
title 'Enable the audit daemon'
desc 'The audit daemon must be running to collect audit logs'
impact 0.7
tag 'nist_800-171', ['3.3.1’]
tag 'subsystems', '[“audit”, “auditd”]'
describe service('auditd') do
it { should be_running }
end
end

auditd_demo/spec/acceptance/suites/default
├── 00_default_spec.rb
├── 10_inspec_failing_spec.rb
├── 20_enforce_spec.rb
└── 30_inspec_passing_spec.rb
Default System
Config
Compliance Fail
Enforce From
Hiera
Compliance Pass

Default System
Config
Compliance Fail

Profile: Auditd demo checks for EL 7 (auditd_demo)
Version: 0.0.1
Target: local://
✔ audit at boot: Auditing should be enabled at system boot time
✔ Command cat /proc/cmdline stdout should match /(S+s+)audit=1/
Profile: InSpec Profile (disa_stig-el7)
Version: 0.1.0
Target: local://
× V-72079: Enable the audit daemon (expected that `Service auditd` is running)
× Service auditd should be running
expected that `Service auditd` is running
Profile Summary: 1 successful, 1 failures, 0 skipped
Test Summary: 1 successful, 1 failures, 0 skipped
INHERITANCE!

COMPLIANCE
PARAMETER
ENFORCEMENT

Default System
Config
Compliance Fail
Enforce From
Hiera
Compliance Pass
---
version : '1.0.1'
nist_800_171:
identifiers :
- '3.3.1'
value : true
identifiers :
- '3.3.1'
value : true
---
# Enforcement Selection Hieradata
compliance_markup::enforcement:
- nist_800_171

Default System
Config
Compliance Fail
Enforce From
Hiera
Compliance Pass

Profile: Auditd demo checks for EL 7 (auditd_demo)
Version: 0.0.1
Target: local://
✔ audit at boot: Auditing should be enabled at system boot time
✔ Command cat /proc/cmdline stdout should match /(S+s+)audit=1/
Profile: InSpec Profile (disa_stig-el7)
Version: 0.1.0
Target: local://
✔ V-72079: Enable the audit daemon
✔ Service auditd should be running
Profile Summary: 2 successful, 0 failures, 0 skipped
Test Summary: 2 successful, 0 failures, 0 skipped

---
# Enforcement Selection Hieradata
compliance_markup::enforcement:
- internal_policy_5
- nist_800_171
---
# Compliance Map
version : '1.0.1'
nist_800_171:
identifiers :
- '3.3.1'
value : true
identifiers :
- '3.3.1'
value : true
---
# Compliance Map
version : '1.0.1'
internal_policy_5:
identifiers :
- 'IP-1337.1'
value : false

SEE ALSO
ABOUT ME
Trevor Vaughan
VP Engineering - Onyx Point, Inc.
tvaughan@onyxpoint.com
@peiriannydd OR @onyxpoint
PROJECT WEBSITE
https://simp-project.com
CONSULTING + TRAINING
http://www.onyxpoint.com
Puppet(8), GitLab(8), Automation(7), DevOps(2), Linux(8)
0.0.1
TVAUGHAN(6) Presentation Info TVAUGHAN(6)
2017-01-19 TVAUGHAN(6)

Automated System Compliance From the Inside Out

Recommended

Recommended

More Related Content

Similar to Automated System Compliance From the Inside Out

Similar to Automated System Compliance From the Inside Out (20)

Recently uploaded

Recently uploaded (20)

Automated System Compliance From the Inside Out