Javier Hijas & Ori Kuyumgiski - Security at the speed of DevOps [rooted2018]
•Download as PPTX, PDF•
0 likes•161 views
New architectures and procedures to make security software development more secure at Check Point
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Javier Hijas & Ori Kuyumgiski - Security at the speed of DevOps [rooted2018]
Similar to Javier Hijas & Ori Kuyumgiski - Security at the speed of DevOps [rooted2018] (20)
More from RootedCON
More from RootedCON (20)
Recently uploaded
Recently uploaded (20)
Javier Hijas & Ori Kuyumgiski - Security at the speed of DevOps [rooted2018]
- 1. 1©2018 Check Point Software Technologies Ltd. SECURITY AT THE SPEED OF DEVOPS • Ori Kuyumgiski | DevOps Team Leader • Javier Hijas | Cloud Security Engineer
- 2. 2©2018 Check Point Software Technologies Ltd. ONE COMPANY HAS THE VISION AND THE EXECUTION TO DELIVER CHECK POINT
- 3. 3©2018 Check Point Software Technologies Ltd. 3©2018 Check Point Software Technologies Ltd. CHECK POINT SOLUTIONS
- 4. 4©2018 Check Point Software Technologies Ltd. WE SECURE THE MOST COMPLEX AND SENSITIVE ENVIRONMENTS WE HAVE THE EXPERIENCE DEEP SECURITY EXPERIENCE GLOBAL PRESENCE THE MOST DEMANDING ENVIRONMENTS 88 Offices100,000 Customers 22 Years
- 5. 5©2018 Check Point Software Technologies Ltd. WE HAVE THE EXPERTISE THE WORLD’S LARGEST DEDICATED SECURITY VENDOR 3000SECURITY EXPERTS THREAT INTELLIGENCE ANALYSTS MOBILE SECURITY RESEARCHERS THREAT PREVENTION RESEARCHERS SECURITY ARCHITECTS CYBERSECURITY INVESTIGATORS REVERSE ENGINEERS COMPUTER INCIDENT RESPONSE TEAM (CIRT)
- 6. 6©2018 Check Point Software Technologies Ltd. THE ERA OF DIGITAL TRANSFORMATION CONNECTING TO THE CLOUD AND MOBILE
- 7. 7©2018 Check Point Software Technologies Ltd.
- 10. 11©2018 Check Point Software Technologies Ltd. • AWS Classic (No VPC) 2012 • AWS security groups – allow any (sg cannot be replaced on running instance) • IPTABLES – dynamically configure from puppet. • Suricata in detect mode • Fail2ban • PSAD – log based IPS • Developers directly access machines (Alcatraz) • Deployments using puppet (static versioning) Startup emerge
- 11. 12©2018 Check Point Software Technologies Ltd. • Flat one AZ • One NGINX handles the traffic • One application server one DB instance one detection server • Tight budget • A few POCs Startup emerge
- 12. 13©2018 Check Point Software Technologies Ltd. Startup emerge
- 13. 14©2018 Check Point Software Technologies Ltd. • AWS VPC (2013) • AWS security groups – allow any (it was better managing it in puppet) • IPTABLES – dynamically configure from puppet. • Suricata – didn’t have any added value without SOC • Still using Fail2ban, PSAD – log based IPS • Started collecting logs to ELK stack • Deployments enhanced ̶ puppet delivered(static versions) ̶ centralized execution via mcollective Startup evolve
- 14. 15©2018 Check Point Software Technologies Ltd. • VPC, one region. • Two AZ, one segment each • TWO NGINX upfront • TWO application servers • DB Active/standby • A few detection servers Startup evolve
- 15. 16©2018 Check Point Software Technologies Ltd. Startup evolve
- 16. 17©2018 Check Point Software Technologies Ltd. • Getting ready for larger scale • Dockerizing apps to allow monolithic image from testing to production • Self provisioning tool development • Integrating with checkpoint products • Justifying cloud infrastructure VS on premise DC Startup acquired by Check Point 2015
- 17. 18©2018 Check Point Software Technologies Ltd. • Two regions, two NGINX upfront in each region • Three AZ in each region, one subnet per AZ • Multiple application servers, services are divided into smaller services • Multiple DB instances active/standby/24H lag per DB instance • Many detection server manual scale up and down Startup acquired by Check Point
- 18. 19©2018 Check Point Software Technologies Ltd. • Customers/POC dashboards are automatically provisioned • Devices are added daily • Features are being continuously deployed • Mobile Security Detection is constantly being tested • Infrastructure under strict SLA, no downtime policy Challenges DevOpsing large scale SaaS Security
- 19. 20©2018 Check Point Software Technologies Ltd. • What is the best orchestration to run Dockerized (micro) services? • What is the best way to deploy new services? • How do you control/debug dynamic infrastructure that changes a few times a day? • How do you keep it all secured? Where do we go from here?
- 20. 21©2018 Check Point Software Technologies Ltd. • Cross platform • Vast community • Industry standard • Big sponsor Infrastructure using Kubernetes why?
- 21. 22©2018 Check Point Software Technologies Ltd. • CloudGuard – Access control, NAT gateway, IPS, AntiBOT, AV • Kubernetes infrastructure • Deployments from CI (Jenkins pipeline) Matured SaaS
- 22. 23©2018 Check Point Software Technologies Ltd. • Two regions, Three AZ each, Three NGINX upfront • Two Kubernetes clusters fully redundant each on three AZ • Auto scaled worker nodes, auto scaled pods. Matured SaaS
- 23. 24©2018 Check Point Software Technologies Ltd. Startup acquired by Check Point
- 24. 25©2018 Check Point Software Technologies Ltd. inspection
- 25. 26©2018 Check Point Software Technologies Ltd.
- 26. 27©2018 Check Point Software Technologies Ltd. K8s
- 27. 28©2018 Check Point Software Technologies Ltd. • Moving all cloud product to kubernetes • Orchestrating new service deploy so developers can do it Challenges looking forward
- 28. 29©2018 Check Point Software Technologies Ltd. LESSONS LEARNED 4. DEVOPS FOR SECURITY Automating and integrating devops culture into security creates better security 2. DEVOPS TOOLS SOLVE PROBLEMS There is usually an initial identified driver for implmenting them 3. SECURITY FOR DEVOPS Agile and automated architectures still require the highest security level 1. DEVOPS IS NOT ONLY FOR STARTUPS The new IT culture can be enjoyed by enterprises of any size
Editor's Notes
- We live in the era of digital transformation. In addition to end-point computers and networks, we now have our mobile devices and the cloud computing as part of our daily connected lives.
- Lets talk about mobile. Most of you have a smartphone. If you receive work emails or connect to your company's intranet, your smartphone is mixing your private data and business data. Your smartphone goes everywhere with you and has a GPS that knows where you are. It has microphone that can listen to your conversations. The company and personal information on your smartphone and the connections to your business network are available to you and anyone else who can take control of your phone. Your smartphone must be secure. Check Point offers very innovative protection for smartphones and tablets. We do this by sending your metadata, applications and networking behavior to the cloud. We analyze your mobile device's activity in the cloud and give you an immediate alert for any malware or breach. Suggested anecdote: Want to be a hacker? Here’s how to conduct a man-in-the-middle attack. Simply connect to free airport Wi-Fi and change your phone settings to broadcast “free airport Wi-Fi.” In a instant, you’ll have a hundred users connected to your phone. You can harvest every password or login on their phones: corporate and personal.
- Lacoon was founded in 2011, POCs started at 2012
- Lean infrastructure, no real need for redundancy
- Puppet story, if we started with puppet at 2012 what would have been the major event we have experienced a few month ago? A bit about mcollective, transport based on message queue, identity based on client certificate, very granular control over who can run what, allows for parallel execution on many servers
- Big moment, you have done an exit…after the excitement fades away….