DevSecCon Asia 2017 Arun N: Securing chatops

1. Join the conversation #devseccon
Extending and securing
Chat-Ops
Arun N

2. Introduction
• Arun Narayanaswamy
• 14 years in Dev & Ops
• Worked at large enterprises including Fortune 1
• Entrepreneur, Student, Photographer and Traveler…
• Disclaimer:
• “The opinions expressed, software references and any content in this
presentation are solely mine and they do not represent my employer.”

3. How many of you use Chat @ Work?
techcrunch.com

4. ChatOps Architecture – How does it work?
© http://nordicapis.com

5. Chat Apps – Big Players!
• Instant messaging on steroids
• Your ‘whatsapp’ for business!
• Collaboration
• Integrated workspace - Text, audio, video
• All alerting and messaging in one place
• Share, Search & Integrate
• Chat-ops!
• Fun

6. Bots– Big Players!
• Hubot

7. Hubot – Why?
• CoffeeScript on Node.js based
• Active development - Github
• Easy integration with third part api’s
• Deployable on Heroku, AWS
• Works with Slack and HipChat (and more)
• What’s chat without Hubot?

8. Typical CD Workflow
• Revolves around the orchestrator
• Data need to be consolidated into Splunk/ELK/Jenkins etc.
• Now better with
• Containers
• New-gen monitoring

9. CI-CD – Data Flow Bot Interactions
Chat Notifications
HipChat / Hubot - Workflow

10. Risk
Potential Loopholes (With and without ChatOps)

11. Potential Loopholes : Focus today!

12. Plugging in the loopholes
2FA
Hardware
Tokens
Software
Tokens
Roles
•Custom
Code
•Hubot Auth
2FA
Multiple
Rooms
AWS IAM
Policies

13. Plugging in the loopholes : Hardware keys
2FA
Hardware
Tokens
Software
Tokens
Roles
•Custom
Code
•Hubot Auth
2FA
Multiple
Rooms
AWS IAM
Policies

14. Plugging in the loopholes : Hardware keys
• Demo
[ https://devseccon.hipchat.com/chat ]
[ https://id.heroku.com/login ]
[ https://www.yubico.com ]

15. Plugging in the loopholes : Soft keys
2FA
Hardware
Tokens
Software
Tokens
Roles
•Custom
Code
•Hubot Auth
2FA
Multiple
Rooms
AWS IAM
Policies

16. Plugging in the loopholes : Roles
2FA
Hardware
Tokens
Software
Tokens
Roles
•Custom
Code
•Hubot Auth
2FA
Multiple
Rooms
AWS IAM
Policies

17. Plugging in the loopholes : Rooms
2FA
Multiple
Rooms
AWS IAM
Policies
• Restricted Channels
• Private Channels
• Different Instance of Chat
System
• 2FA on Chat system itself

18. Plugging in the loopholes : IAM (AWS)
2FA
Multiple
Rooms
AWS IAM
Policies
• Policies on what each system can run
• Better control on AWS/Heroku where the bots run

19. Summary
© http://nordicapis.com

20. Join the conversation #devseccon
Thank you!
linkedin.com/in/arun-n