The document discusses the formation of the OpenStack Security Group (OSSG) to help build security into the OpenStack platform. The OSSG plans to place security engineers on each core project to conduct code reviews, implement and design security blueprints, and work across projects. They will also create documentation and help integrate security into continuous integration processes. The OSSG is seeking community involvement from security engineers, technical writers, and those with OpenStack deployment expertise.

1. Building
an
OpenStack
Security
Group
Bryan
D.
Payne,
Nebula
Robert
Clark,
HP

2. 2
10/17/12

3. 3
10/17/12

4. • Alarm
system?
• Bars
on
the
windows?
• Dog?
• Security
Cameras?
• Move?
4
10/17/12

5. • Alarm
system?
• Bars
on
the
windows?
• Dog?
• Security
Cameras?
• Move?
5
10/17/12

6. • Alarm
system?
• Bars
on
the
windows?
• Dog?
• Security
Cameras?
• Move?
6
10/17/12

7. • Alarm
system?
• Bars
on
the
windows?
• Dog?
• Security
Cameras?
• Move?
7
10/17/12

8. • Alarm
system?
• Bars
on
the
windows?
• Dog?
• Security
Cameras?
• Move?
8
10/17/12

9. This
Is
Hard
9
10/17/12

10. SoSware
Must
Be
Easier,
Right?
10
10/17/12

11. But
Who
Wants
to
Hack
OpenStack?
11
10/17/12

12. 12
10/17/12

13. Computer
Security:
What
We
Know
Be#er
Worse
Design
for
security
from
the
start
Retrofit
security
when
it’s
important
Understand
your
threats
Just
make
it
secure
Understand
your
goals
Seriously,
just
add
some
security
Pervasive
security
culture
That
paranoid
guy
has
it
under
control
13
10/17/12

14. Current
Approach
• Vulnerability
Management
Team
• People
star_ng
to
think
about
security
14
10/17/12

15. OpenStack
Security
Challenges
• Security
as
an
aSerthought
• Security
as
silos
• Security
by
non-­‐experts
15
10/17/12

16. OpenStack
Security
Group
(OSSG)
• Security
expert
resource
for
OS
• Build
security
culture
within
OS
community
16
10/17/12

17. OSSG
Game
Plan
17
10/17/12

18. OSSG
Details
• Place
at
least
one
security
engineer
on
each
core
project
– Code
review
– Implement
blueprints
– Design
blueprints
• Have
at
least
one
person
working
cross
project
– Write
technical
documenta_on
– Integra_ng
security
into
con_nuous
integra_on
– Iden_fy
cross
project
security
concerns
• Mailing
list
to
have
security
discussions
18
10/17/12

19. Case
Study:
HTTPS
Support
19
10/17/12

20. Observations from Summit
2012
© Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.

21. Crypt
Enthusiastic Developer + Hash Algorithm + Async Crypt != Secure Design

22. Common Mistakes
Let us help

23. OSSG
Next
Steps
• Will
require
community-­‐level
involvement
• Now
“hiring”
for
OSSG!!
– Security
Engineers
– Technical
Writers
– OpenStack
Deployment
Exper_se
23
10/17/12

24. Please
Join
Us!
hhps://launchpad.net/~openstack-­‐ossg
Bryan
D.
Payne
Robert
Clark
bryan.payne@nebula.com
robert.clark@hp.com
24
10/17/12