Downloaded 30 times
Uploaded bySonatype
Compliance as Code - Using the Open Source InSpec testing Framework
The document discusses the concept of 'Compliance as Code' using InSpec, presented by George Miranda, emphasizing the importance of integrating compliance into the development workflow to enhance security and operational velocity. It covers the historical context of IT compliance, common regulatory requirements, and how InSpec transforms compliance and security requirements into code for efficient testing and validation. Additionally, it highlights the evolving role of the compliance officer and the collaborative nature of security within development teams.
More Related Content
Similar to Compliance as Code - Using the Open Source InSpec testing Framework
Compliance as Code - Using the Open Source InSpec testing Framework
- 1. November 15, 2016 Complianceas Code - using InSpec George Miranda, Product Marketing Director, Chef Software Inc.
- 2. Introductions George Miranda Director ofProduct Marketing @gmiranda23 • Distributed Systems Engineer • I play a developer on TV • At Chef for 4+ years Technical Evangelist Consultant BizDev Product Marketing • Spent a majority of my career in "the Enterprise" • I've had to go through MANY security audits in my career
- 3. Agenda • Constraints &myths • The role of InfoSec at velocity • Compliance as Code • An introduction to InSpec • Q&A @gmiranda23
- 4. Time, Cost, andQuality “Speed is the only dimension that matters” – Veresh Sita, CIO, Alaska Airlines @gmiranda23
- 5.
- 6. The rise ofIT Compliance • Continued security vulnerabilities created a need for IT compliance 1988 Morris Worm, National Bank Chicago $70M theft 1994 AOHell, Citibank $10M hack 1996 Brotherhood hacks, Canadian Broadcast Corp. 1998 Free Mitnick Logic Bomb Security incidents at 75% of IT organizations @gmiranda23
- 7. The State ofSecurity in XXXX • In 60% of cases, attackers can compromise an organization within minutes • 99.9% of compromises exploited vulnerabilities more than a year after the vulnerability was published • Ten vulnerabilities account for 97% of the exploits observed Source: Verizon Data Breach Report@gmiranda23
- 8. The State ofSecurity in 2014 • In 60% of cases, attackers can compromise an organization within minutes • 99.9% of compromises exploited vulnerabilities more than a year after the vulnerability was published • Ten vulnerabilities account for 97% of the exploits observed Source: Verizon Data Breach Report@gmiranda23
- 9. The cycle ofregulation Loophole Exploitation Scandal Regulation @gmiranda23
- 10.
- 11. Offer baseline securityand isolation layers @gmiranda23
- 12. Regulatory Compliance • PCI-DSS •Gramm-Leach-Bliley Act • HIPAA • Dodd-Frank • ISO • Sarbanes-Oxley • HITECH • Grundschutz European • Central Bank Regulations @gmiranda23
- 13. How most orgshandle these requirements
- 15. The promise ofthe coded business @gmiranda23
- 16. The conflict betweencompliance and velocity @gmiranda23
- 17.
- 18.
- 19.
- 20. InSpec turns infrastructuretesting, compliance, and security requirements into code Stats: 86 Releases, 59 Contributors, 2.900 Commits @gmiranda23
- 21. The changing roleof the compliance officer @gmiranda23
- 22. Differences in verifyingcompliance policy Documentation SSH supports two different protocol versions. The original version, SSHv1, was subject to a number of security issues. Please use SSHv2 instead to avoid these. @gmiranda23
- 23. Differences in verifyingcompliance policy Scripting Tools > grep "^Protocol" /etc/ssh/sshd_config | sed 's/Protocol //' 2 @gmiranda23
- 24. Differences in verifyingcompliance policy Compliance Language describe sshd_config do its('Protocol') { should eq 2 } end @gmiranda23
- 25. Differences in verifyingcompliance policy Compliance Language control 'ssh-1234' do impact 1.0 title 'Server: Set protocol version to SSHv2' desc " Set the SSH protocol version to 2. Don't use legacy insecure SSHv1 connections anymore... " describe sshd_config do its('Protocol') { should eq 2 } end end @gmiranda23
- 26. InSpec for Windows control'windows-base-201' do impact 1.0 title 'Strong Windows NTLMv2 Authentication Enabled; Weak LM Disabled' desc ' @link: http://support.microsoft.com/en-us/kb/823659 ' describe registry_key('HKLMSystemCurrentControlSetControlLsa') do it { should exist } its('LmCompatibilityLevel') { should eq 4 } end end @gmiranda23
- 27. Different ways torun InSpec Test your machine locally > inspec exec test.rb Test a machine remotely via SSH > inspec exec test.rb -i identity.key -t ssh://root@172.17.0.1 No ruby/agent on the node @gmiranda23
- 28. Different ways torun InSpec Test a machine remotely via WinRM > inspec exec test.rb -t winrm://Admin@192.168.1.2 --password super Test Docker Container > inspec exec test.rb -t docker://5cc8837bb6a8 no SSH/agent in the container No ruby/agent on the node @gmiranda23
- 29. Different ways torun InSpec Database testing describe mysql_session.query("SELECT user,host FROM mysql.user WHERE host = '%'") do its(:stdout) { should be empty } end Cloud Provider testing security_groups.each do |security_group| describe security_group do it { should_not have_inbound_rule().with_source('0.0.0.0/0') } end end @gmiranda23
- 30. Mapping of ComplianceDocument to InSpec @gmiranda23
- 31. InSpec Profiles Windows Patch Profile OSHardening Profile SSH Hardening Profile Linux Patch Profile https://github.com/dev-sec@gmiranda23
- 32. InSpec Profiles Windows Patch Profile OSHardening Profile SSH Hardening Profile Linux Patch Profile https://github.com/dev-sec@gmiranda23
- 33.
- 34.
- 35. Each team usesseparate tools @gmiranda23
- 36.
- 37.
- 38.
- 40.
- 41.
- 42. Works with allDevOps tools e.g. @gmiranda23
- 43. Shifting InfoSec tothe left Source: Sciencing the Crap Out of DevOps – Dr. Nicole Forsgren @gmiranda23
- 44. Further Resources inspec.io • Handson tutorials • Extensive documentation • Code examples learn.chef.io • More tutorials about Compliance and Inspec
- 45. Further Resources Save YourCrash Dummies! A Test-driven Infrastructure Solution http://bit.ly/crash_dummies @gmiranda23
- 46. Q&A Save Your CrashDummies A Test-driven Infrastructure Solution Video: http://bit.ly/crash_dummies @gmiranda23 http://inspec.io http://learn.chef.io $ inspec exec <url> https://github.com/dev-sec/tests-ssh-hardening https://github.com/dev-sec/windows-patch- benchmark https://github.com/dev-sec/linux-patch- benchmark
- 47.
- 48.