This document discusses how to integrate security into DevOps practices through automation. It recommends implementing best security practices like multi-factor authentication and access key rotation. The document outlines a DevSecOps approach with three parts: 1) implement preventative security controls through infrastructure as code; 2) enable continuous security monitoring through detective controls; and 3) incorporate responsive controls like auto-remediation to self-heal any issues found. The overall approach is to seamlessly integrate security practices through cultural changes and automation in order to manage security at scale without slowing development velocity.

1. DevSecOps : How to seamlessly
integrate security into DevOps
Mike Rahmati

2. learnings to expect:
Automate security
& security at scale
Infrastructure
auto-remediation /
self-healing guides
Upskill your AWS
knowledge with actionable
step by step guides
Agenda

3. Questions:
People are constantly making changes,
how do we manage Security?
How do we up-skill engineers knowledge of AWS?
How are others managing security at scale,
without compromising velocity/agility?
Can It Be Done?

4. MFA everywhere
AWS Multiple Account Security/Billing
Strategy
Multiple layers of defence, proper
networking design
CloudTrail enabled
Access Key rotation
CloudWatch alarms that are triggered
when XYZ happens
and 350+ more (https://www.
cloudconformity.com/conformity-rules/)
1. Implement Best Practice

5. Implement DevOps culture
Embrace Freedom
Responsibility Culture
2. Cultural Change

6. 3. Automation
Sources
Developers
commit
changes
Production
Code is deployed
to public
servers
Staging
Code is depolyed
and tested Manual
approval
Build
Changes
are built
Ideas,
Requests,
Bugs
Changes,
Updates,
Fixes
Infrastructure
as code
Developers Customers

7. Next Chapter

8. Preventive
Detective
Responsive
Types of Security Controls

9. 1. Preventive
AWSTemplateFormatVersion:‘2010-09-09’
Resources:
S3Bucket:
Type:AWS::S3::Bucket

10. 1. Preventive

11. 1. Preventive
AWSTemplateFormatVersion:‘2010-09-09’
Resources:
S3Bucket:
Type:AWS::S3::Bucket
Properties:
AccessControl: PublicReadWrite

12. Security Controls - Preventive

13. Security Controls - Detective (Continuous Security)
Kinesis
SNSEvent Handler Lambda Event Ingestor Lambda
AWS Account 1 Consolidated Security Management
API Gateway
trigger
CloudWatch Event Rule
routes ingest
stream
consume
publish
Event Handler
Lambda

14. 3 Publish message to SNS
Cloud
Conformity
1 Make changes
SNS
2 APIS
4trigger
Orchestrator
Auto Remediate Lambda Functions
Security Controls - Responsive (aka Auto Remediation)
https://github.com/cloudconformity/auto-remediate
Your AWS Account
5

15. Summary
www.cloudconformity.com/conformity-rules/
Automate security
security at scale
Infrastructure
auto-remediation
(self-healing)
Upskill your AWS
knowledge with actionable
step by step guides

16. Questions?
Register for a free trial at
cloudconformity.com