Recommended
More Related Content
What's hot
What's hot (20)
Similar to Automate Cloud and Application Security Deployments with Barracuda and Puppet 03.21.2018
Similar to Automate Cloud and Application Security Deployments with Barracuda and Puppet 03.21.2018 (20)
More from Claire Priester Papas
More from Claire Priester Papas (9)
Recently uploaded
Recently uploaded (20)
Automate Cloud and Application Security Deployments with Barracuda and Puppet 03.21.2018
- 1. 21 March 2018 Automate Cloud and Application Security Deployments with Barracuda and Puppet Talking Tech Webinar Series
- 2. Talking Tech Webinar Series Tim Jefferson Vice President Public Cloud Barracuda Presenters 2 Matt Girdharry Director TAPP & Security Puppet
- 3. Talking Tech Webinar Series ● What do we do and why? ● The anti-pattern ● New ways to deploy application security ● Intro to DevSecOps ● Why automation matters ● Q&A Agenda 3
- 4. Talking Tech Webinar Series Puppet and Barracuda 4 Automate how you build and deploy applications and provision, configure and manage the infrastructure they run on. Secure all of your threat vectors, including email, websites, web applications, mobile devices, and network performance - whether on-site or in the cloud.
- 5. Puppet Product Portfolio Puppet Enterprise Puppet PipelinesPuppet Discovery Know what you have. Know where to start. Discover Bridge development and operations. Deliver Manage at scale. Keep it compliant. Control| |
- 6. Talking Tech Webinar Series6 Our thesis: why ‘this plus that’ is so good Manage at scale. Keep it compliant. Control Puppet Enterprise
- 7. Talking Tech Webinar Series ● Data Center architecture refugees ● Traditional licensing model adds friction ● Security Infrastructure is now code: automate! What we’re solving for: the anti-pattern problem 7
- 8. Talking Tech Webinar Series { “infrastructure as code” , 8 Application Source code Interpreter Desired application state Infrastructur e JSON IaaS service API Desired infrastructure state Create Stacks Design Iterate
- 9. Talking Tech Webinar Series 9 Blue / green testing
- 10. Talking Tech Webinar Series ➔ Support for each IaaS providers deployment best practices ➔ Support cloud consumption model ➔ Cover cloud specific security controls Highlights: ● Supports bootstrapping, metered billing, autoscaling, template-based provisioning ● Supports a fully featured REST API framework ● Integrates with other security solutions to automate application security Three things that make a Cloud Generation Firewall 10
- 11. Talking Tech Webinar Series Barracuda WAF module in Puppet Forge 11
- 12. Talking Tech Webinar Series Auto-generated API documentation 12 https://campus.barracuda.com/product/webapplicationfirewall/api/9.1.1
- 13. Talking Tech Webinar Series Puppet module reference architecture 13 ● Enables DevSecOps ● Move fast, stay secure ● AWS, Azure, and GCP ● Hybrid use-cases
- 14. Talking Tech Webinar Series Puppetized workflow 14 Scan is initiated on the VRS VRS identifies problems w/ app VRS patches the app automatically Scan is run in the next schedule WAF Auto scaling stack is launched WAF is launched WAF is connected to BCC Service is configured The last step would be create a Cluster between the instance and the auto scaling WAFs so that the configuration is sync'd after which the DNS entry can be changed.
- 15. ● Deliver better software, faster.
- 16. Talking Tech Webinar Series What next? 16 Need help? Free trials and free security assessment. Contact us. Get free help from a Cloud Security Expert with configuration or PoC Barracuda module on Puppet Forge Download Barracuda WAF Module from the Puppet Forge
- 17. Q&A
Editor's Notes
- 'The Problem Statement' - ideally handled by Tim Jefferson, wherein he lays out the 'anti-pattern problem' a. Speaker: Tim Jefferson, Barracuda b. Using old-school reference architectures on AWS doesn’t work c. Need to set-up security controls in “cloud-y” way to make best use of AWS services, and enable true DevSecOps d. Introduces the concept of “Cloud Generation Firewalls” (specifically calling out: WAF with complete API connections) i. Three things that make a firewall “Cloud Generation”: 1. Support for deployment best practices – well architected, autoscaling, API integrations, APN competency, etc. 2. Frictionless licensing – pay for secured traffic not firewalls 3. Support for cloud use cases – remote connectivity, workload migration, etc. Puppet to talk specifically about the value of infrastructure as code, the module, and the 'collaborative' effort that ideally includes our customers/contributors - via our Partner Eng org. a. Speaker: Matt, Puppet
- “Like chocolate and peanut butter, and not like peanuts and gum”...layer this onto an Azure or AWS or GCP platform, and it’s like a beautiful layer cake or something. Barracuda Notes: Cloud first - firewalls designed for cloud Early adopter - first WAF in Azure Only AWS ISV with 2 security competencies Most successful security ISV in public cloud - more firewalls deployed than any other vendor They offer a CloudGen WAF and a CloudGen Firewall
- And we’ve done this mostly with our flagship product Puppet Enterprise. Puppet Enterprise, which many of you know and love, solves a specific set of problems for automating management of your infrastructure and ensuring it stays compliant. This past October, we rolled out an expanded product portfolio to automate the entire software delivery lifecycle. With Puppet Discovery, you can discover the resources you have and take action on them, whether they’re running on traditional or modern infrastructure. And with Puppet Pipelines you can streamline your application release cycles by bridging development and operations. No matter where you are in your automation journey, we can help you know what you have (LONG PAUSE) bring it under management and keep it compliant, (LONG PAUSE) and automate how you deliver infrastructure and applications.
- You could do your WAF deployment without Puppet...but why would you?
- The rise of DevSecOps TIM NOTES: Data center architectures don’t translate well in cloud (introduce artificial constraints, tightly-coupled centralized policy enforcement points that scale vertically etc. Infrastructure is now code; need to treat as code-support devops model, automate security controls Data Center Licensing model gets in the way: need to support true utility based consumption
- Cloudy with a side of security controls TIM: Enable true devsecops; each app team can manage their own complete stack CI/CD workflows/blue/green deployments that mirror production Ypu can see some data center architecture artifacts don't work: centralized management server, UI based configuration
- Xample: some customers now destroy their entire environments every 7 hours Configuration can be sync'd between green and blue environments periodically Iterations to swap the environments are performed as per change requirements
- Seamless integration into cloud fabric: auto-scaling, cloud watch etc. Licenses Which security controls am instrumenting in? Combine with IaaS services, build work flows
- We made a module with puppet that solves all three: -packages up aws security best practices (what ? elb sando?) -metered AMI or PAYG (licenseless) -fully automated management of infrastructure vis API
- In short, we help you deliver better software, faster.