Download as PDF, PPTX
![Security as a [ ]](https://image.slidesharecdn.com/containerizingyoursoc1-161017203456/75/Containerizing-your-Security-Operations-Center-7-2048.jpg)
More Related Content
Similar to Containerizing your Security Operations Center
Containerizing your Security Operations Center
- 1.
- 2. @jimmesta OWASP Santa BarbaraFounder AppSec California Organizer Works at Invoca Was consulting, now “defensing” I really like containers
- 3. Greetings from Sunny AppSec California! Location:Santa Monica, Ca. Date: January 23-25, 2017 Why: Because Winter 2017.appseccalifornia.org
- 5. Security Confessions: A Timefor Healing
- 6. What are employeessaying about your security program?
- 7.
- 8. Security as aService?
- 9. Security as aMagic Unicorn?
- 10. Security as aBottleneck
- 11. Security as aBlack Hole
- 12. Security as a“No” Machine
- 13. Security as aHot Potato
- 14. Security as aPDF Generator
- 15. We are allunder-staffed
- 16. We are allover budget
- 17. We are alltoo busy
- 18. Can we DevSecOpsour way out of this?
- 21. Step 1: InstallXCode Command Line Tools xcode-select --install Nice! It looks like I get to compile some stuff.
- 22. Step 2: Makesure Java is updated Dang. My Java is out of whack. What did I do? I’ll just update… java --version
- 23.
- 24. Step 3: InstallHomebrew But I use Macports and ZSH.. where’s my .bash_profile? source ~/.bash_profile ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/.../)" brew tap homebrew/versions
- 25. Step 4: Update$PATH and Install Dependencies Wait a minute. I need a local Postgres DB to run this thing? echo PATH=/usr/local/bin:/usr/local/sbin:$PATH >> ~/.bash_profile brew install nmap && brew install postgresql
- 26. Step 5: Initializethe DB What?! Postgres didn’t initialize? Forget this. Hacking is hard. cp /user/local/Cellar/postgresql/9.4.0/.../... initdb /usr/local/var/postgres launchctl load -w ~/Library/LaunchAgents/homebrew.mxcl.postgresql.plist
- 27. You just losta golden opportunity to foster a co-worker's interest in security.
- 28. How can wemake our security tooling more about using the tool and less about maintenance?
- 29.
- 31. Docker is anOpen Source engine to pack, ship, and run any application as a lightweight container.
- 32. Why U NoJust Virtualbox!?
- 33. Traditional Virtual Machines Source:https://www.docker.com/what-docker
- 34.
- 36. Docker provides auser friendly API to create containers.
- 37. Images use layersfor efficiency and speed.
- 38. Build the Dockerimage once and use it all over the place.
- 39. Minimize concerns around compatibilityand dependencies.
- 40. So what aboutour “Securious” Dev who just wanted to run Metasploit?
- 41. Step 1: InstallDocker Nice! That was super easy to point and click.
- 42. Step 2: RunCommand That just..worked? docker run -t -i linuxkonsult/kali-metasploit
- 43.
- 44. FROM linuxkonsult/kali MAINTAINER TomEklöf "tom@linux-konsult.com" ENV DEBIAN_FRONTEND noninteractive ADD ./init.sh /init.sh RUN apt-get -y update ; apt-get -y --force-yes install ruby metasploit-framework CMD /init.sh Dockerfile
- 45.
- 46. What could gowrong with blindly pulling Docker images?
- 48. Always inspect andvet the Dockerfile before blindly using it.
- 49. Tools like Clair,Quay, and Anchore can help identify vulnerabilities in images.
- 51.
- 52. docker run isuseful and all but how do we get these containers out to the world for others to use?
- 54. K8S - AGentle Introduction
- 55. Kubernetes is anopen-source platform built to automate deployment, scaling and orchestration of containers.
- 56. K8S is portable.Clusters can be deployed on a public/private cloud, on prem, and even on your laptop.
- 57. K8S is customizable.It is modular and extensible to fit nearly any use-case.
- 58. K8S is scalable.It provides self-healing, auto scaling, and replication.
- 59.
- 60. - Don’t orchestratefor the sake of orchestration (or because the cool kids are doing it) - Containers first, then orchestration - docker-compose does a fine job for many things
- 61.
- 62.
- 63.
- 64.
- 65. clusternodemaster node node nodenode node node node node node node node node node node node node node node nodemaster master node
- 66.
- 67. podcontainer container container volumeA volume B network interface
- 68. pod.yaml apiVersion: v1 kind: Pod metadata: name:owasp-app spec: containers: - name: owasp-app image: owasp-app - name: nginx-ssl image: nginx ports: - containerPort: 80 - containerPort: 443
- 69.
- 70.
- 71.
- 72. deployment ensure N pods areup and running
- 73. deploy.yaml kind: Deployment apiVersion: extensions/v1beta1 metadata: name:frontend spec: replicas: 4 selector: role: web template: metadata: name: web labels: role: web spec: containers: - name: owasp-app image: owasp-app - name: nginx-ssl image: nginx ports: - containerPort: 80 - containerPort: 443
- 74. deploy.yaml kind: Deployment apiVersion: extensions/v1beta1 metadata: name:frontend spec: replicas: 4 selector: role: web template: metadata: name: web labels: role: web spec: containers: - name: owasp-app image: owasp-app - name: nginx-ssl image: nginx ports: - containerPort: 80 - containerPort: 443
- 75. deploy.yaml kind: Deployment apiVersion: extensions/v1beta1 metadata: name:frontend spec: replicas: 4 selector: role: web template: metadata: name: web labels: role: web spec: containers: - name: owasp-app image: owasp-app - name: nginx-ssl image: nginx ports: - containerPort: 80 - containerPort: 443
- 76. deploy.yaml kind: Deployment apiVersion: extensions/v1beta1 metadata: name:frontend spec: replicas: 4 selector: role: web template: metadata: name: web labels: role: web spec: containers: - name: owasp-app image: owasp-app - name: nginx-ssl image: nginx ports: - containerPort: 80 - containerPort: 443
- 77.
- 78.
- 79. deploy.yamlnodemaster node node 10.0.0.110.0.0.2 10.0.0.3 10.0.0.4
- 80. service abstraction layer that enablespod communication
- 81. servicenodemaster node node 10.0.0.110.0.0.2 10.0.0.3 10.0.0.4
- 82.
- 83.
- 84.
- 85. svc.yaml kind: Service apiVersion: v1 metadata: name:web-frontend spec: ports: - name: http port: 80 targetPort: 80 protocol: TCP selector: role: web type: LoadBalancer
- 86. svc.yaml kind: Service apiVersion: v1 metadata: name:web-frontend spec: ports: - name: http port: 80 targetPort: 80 protocol: TCP selector: role: web type: LoadBalancer
- 87. svc.yaml kind: Service apiVersion: v1 metadata: name:web-frontend spec: ports: - name: http port: 80 targetPort: 80 protocol: TCP selector: role: web type: LoadBalancer
- 88. svc.yaml kind: Service apiVersion: v1 metadata: name:web-frontend spec: ports: - name: http port: 80 targetPort: 80 protocol: TCP selector: role: web type: LoadBalancer
- 89. namespace manage different environments in thesame cluster
- 90.
- 91. kubectl master apiserver HTTPS scheduler Replication controller node node kubelet podpod pod proxy External LB
- 92. Sounds great! Whatabout security?
- 93. apiserver Authentication (Who can access the cluster? kubectl Authorization (Whatcan they access?) Admission Control (Which policies are applied for this user? Access Granted https:// K8S Security Model
- 94. - K8S APItypically serves traffic over TLS - Self-Signed Cert provisioned on operators laptop in $USER/.kube/config Transport Security apiserver Authentication (Who can access the cluster? kubectl Authorization (What can they access?) Admission Control (Which policies are applied for this user? Access Granted https://
- 95. - Supports manyauthentication modules: HTTP Basic, OpenID, Tokens, Client Cert, Keystone - Multiple modules can be specified Authentication apiserver Authentication (Who can access the cluster? kubectl Authorization (What can they access?) Admission Control (Which policies are applied for this user? Access Granted https://
- 96. - Every HTTPrequest is authorized get, list, create, update, etc. - Request attributes are checked against policy Authorization apiserver Authentication (Who can access the cluster? kubectl Authorization (What can they access?) Admission Control (Which policies are applied for this user? Access Granted https://
- 97. Authorization --authorization-mode=AlwaysAllow allows allrequests; use if you don’t need authorization. --authorization-mode=ABAC allows for a simple local-file-based user-configured authorization policy. --authorization-mode=RBAC is an experimental implementation which allows for authorization to be driven by the Kubernetes API.
- 98.
- 99. rb.yaml kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1alpha1 metadata: name: read-pods namespace:sec-tools subjects: - kind: User name: jimmy roleRef: kind: Role namespace: sec-tools name: pod-reader apiVersion: rbac.authorization.k8s.io/v1alpha1
- 100. - Intercept requestsprior to object creation - May mutate incoming request to apply system defaults Admission Controllers apiserver Authentication (Who can access the cluster? kubectl Authorization (What can they access?) Admission Control (Which policies are applied for this user? Access Granted https://
- 101.
- 102.
- 103. K8S Secret Object -Secrets can only be accessed by pods in the same namespace - Secrets are only sent to nodes with pods that require it - Not written to disk - stored on tmpfs - Deleted once dependent pod is removed
- 104. Buyer Beware - Secretsare stored in plaintext on the apiserver (etcd) - Protect etcd with your life - Don’t forget what OWASP taught you! - Secrets in logs, app security, etc. - Anyone with root on any node can read secrets by impersonating kubelet
- 105. Vault - It works!But no official K8S support (yet) - API driven, do what you will - Customize your deployment
- 106. #!/bin/bash PASSWORD="$(vault read -field=valuesecret/password | base64)" # Create YAML object from stdin cat <<EOF | kubectl create -f - apiVersion: v1 kind: Secret metadata: name: mysecret type: Opaque data: password: "${PASSWORD}" EOF ```
- 107. secret.yaml apiVersion: v1 kind: Secret metadata: name:owasp-secrets type: Opaque data: username:d293IHlvdSBkZWNvZGVkIGl0 password: Z29vZCBmb3IgeW91 host:bm90aGluZyBqdWljeSB0aG91Z2g=
- 108. deploy.yaml kind: Deployment apiVersion: extensions/v1beta1 metadata: name:frontend spec: replicas: 4 selector: role: web template: metadata: name: web labels: role: web spec: containers: - name: owasp-app image: owasp-app env: - name: OWASP_PASS valueFrom: secretKeyRef: name: owasp-secrets key: password ports: - containerPort: 443
- 109. Security Hygiene - RestrictSSH access to nodes - Only use trusted images - Regularly apply updates to your K8S environment (including kubectl) - Log all of the things - Apply SecurityContext to deployments runAsNonRoot, readOnlyRootFilesystem
- 110. Demo (sort of) -2 node cluster running on GCE - Kubernetes 1.4
- 125. - Maintain oneK8S cluster - Deploy and scale security tooling - DevSecOps all the things - We are part of this container journey together Security can be an enabler
- 126.
- 127.