A look at how PaaS can be helpful in dealing with the 'audit paradox' presented by the choice between bolt on and build in for security, along with operational considerations for a serverless environment

1. © 2017 DXC Technology Company. All rights reserved.
May 16, 2018
Ops and Security in a PaaS
and Serverless world
Chris Swan (@cpswan)
Fellow, VP, CTO Global Delivery

2. May 16, 2018
Chris Swan – Why Me?
Combat Systems Engineer - Royal Navy
Security R&D - Credit Suisse
CTO Security - UBS
CTO - Cohesive Networks
CTO Global Infrastructure Services - CSC
CTO Global Delivery - DXC Technology
@cpswan

3. May 16, 2018
“With a monolith it's easy...
you just pile a bunch of
appliances in front of it“
Frank Chen
Andreessen Horowitz podcast
‘All about Microservices’
with Adrian Cockcroft
and Martin Casado
https://a16z.com/2016/09/01/microservices/

4. 4May 16, 2018© 2017 DXC Technology Company. All rights reserved.
The Audit Paradox

5. May 16, 2018
Building Security In
CC photo by WorldSkills

6. May 16, 2018
Looks Like This

7. May 16, 2018
Bolting Security On
CC photo by arbyreed

8. May 16, 2018
Looks Like This

9. May 16, 2018
Unified Threat Management
Firewall
NIDS/NIPS
AV
Anti Spam
VPN
DLP
Load Balancer
UTM

10. May 16, 2018
Application Delivery Controllers
Cache
TLS offload
Compression
WAF
Multiplexing
Load Balancer
ADC
Traffic Shaping

11. May 16, 2018
PaaS Gives Us the Chance to ‘Bolt In’

12. May 16, 2018 12© 2017 DXC Technology Company. All rights reserved.
But Docker Adoption Shows a Movement Against
Opinionated Platforms

13. 13May 16, 2018© 2017 DXC Technology Company. All rights reserved.
FaaS and CaaS

14. May 16, 2018
The NIST Model for Cloud Services
IaaS
PaaS
SaaS
OperationalConsistency
Speed/Stickyness

15. May 16, 2018
More Choices Have Emerged
IaaS
CaaS
PaaS
FaaS
SaaS
OperationalConsistency
Speed/Stickyness

16. May 16, 2018
And ‘Cloud’ Doesn’t Have to Mean ‘Public’
IaaS
CaaS
PaaS
FaaS
SaaS
OperationalConsistency
Speed/Stickyness
IaaS
CaaS
PaaS
FaaS
SaaS
On Premises Off Premises

17. May 16, 2018
Zooming in Around PaaS and Thinking About
Deployment Granularity and Platform ‘Opinion’
CaaS
PaaS
FaaS
Lessopinionated
Finergranularity

18. May 16, 2018
This Isn’t My Container Security Talk…
So Let’s Leave CaaS For Another Time

19. May 16, 2018 19© 2017 DXC Technology Company. All rights reserved.
2015 ToDo: SecDevOps – Are We There Yet?
APIs are necessary but not sufficient:
Need to have them integrated into the overall
system
Control metadata (and its mutability):
Must be visible and understandable
Security events need to be captured:
Then turned into something humans can action

20. May 16, 2018
If a Security Event Happens and It Isn’t Monitored

21. May 16, 2018 21© 2017 DXC Technology Company. All rights reserved.
‘LessOps

22. May 16, 2018
#define Serverless
(aka Functions as a Service – FaaS)

23. May 16, 2018
Want to do CaaS and FaaS Together?
FaaS on Kubernetes
1. Azure Functions Runtime
2. Fission
3. Fn
4. Gestalt
5. IronFunctions
6. Kubeless
7. OpenFaaS
8. OpenWhisk
9. Nuclio
10. Riff
11. VMware Dispatch
https://github.com/cpswan/FaaSonK8s

24. May 16, 2018
#define Operations
Provisioning
Config Management
Monitoring
Logging

25. May 16, 2018
Or as Charity Majors @mipsytipsy Put It
“Operations is the constellation of
your org's technical skills, practices,
and cultural values around designing,
building and maintaining systems,
shipping software, and solving
problems with technology.”

26. May 16, 2018
#define DevOps
The operational practices that have co-evolved with IaaS
or
Flow
Feedback
Continuous Learning by Experimentation

27. May 16, 2018
#define NoOps
Provisioning
Config Management
Monitoring
Logging

28. May 16, 2018 28© 2017 DXC Technology Company. All rights reserved.
No Server != No Ops

29. May 16, 2018
#define LessOps
Provisioning aaS
Config Management < will be ‘code’, won’t go away
Monitoring aaS
Logging aaS

30. May 16, 2018 30© 2017 DXC Technology Company. All rights reserved.
Factories for Continuous Delivery Pipelines

31. May 16, 2018
We’re not there yet
By Alan Manson - Flickr: Yellow Canary (Serinus flaviventris), CC BY-SA 2.0
https://commons.wikimedia.org/w/index.php?curid=17379213

32. May 16, 2018https://speakerdeck.com/garethr/serverless-not-infrastructureless

33. May 16, 2018

34. May 16, 2018

35. May 16, 2018 35© 2017 DXC Technology Company. All rights reserved.
(barely) 3 lines of Javascript
32 lines of config

36. May 16, 2018

37. May 16, 2018

38. May 16, 2018 38© 2017 DXC Technology Company. All rights reserved.
33 lines of Python
100 lines of config

39. May 16, 2018 39© 2017 DXC Technology Company. All rights reserved.
What’s all that config for?
• Identity and Access Management
–Policies
–Roles
• API Gateway
• Monitoring
–Event Targets
–Event Rules

40. May 16, 2018
Hello World with the Serverless Framework

41. May 16, 2018
AWS CodeStar

42. May 16, 2018 42© 2017 DXC Technology Company. All rights reserved.
State management
The twelve-factor methodology can be applied to apps
written in any programming language,
and which use any combination of backing services
(database, queue, memory cache, etc).

43. May 16, 2018 43© 2017 DXC Technology Company. All rights reserved.
“The service will protect itself
(at your expense)”

44. May 16, 2018 44© 2017 DXC Technology Company. All rights reserved.
“Own the critical path
(and keep it short)”

45. May 16, 2018 45© 2017 DXC Technology Company. All rights reserved.
“Understand the tech
and its dependencies”

46. May 16, 2018 46© 2017 DXC Technology Company. All rights reserved.
2015 ToDo: SecDevOps – Let’s review
APIs are necessary but not sufficient:
Need to have them integrated into the overall
system
Control metadata (and its mutability):
Must be visible and understandable
Security events need to be captured:
Then turned into something humans can action

47. May 16, 2018 47© 2017 DXC Technology Company. All rights reserved.
With thanks to:
Charity Majors
@mipsytipsy
Rafal Gancarz
@RafalGancarz
Paul Johnston
@PaulDJohnston
Patrick Debois
@patrickdebois

48. © 2017 DXC Technology Company. All rights reserved.
Questions?
Questions?