Cloud security : Automate or die

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

SESSION ID:SESSION ID:
#RSAC
Dave Shackleford
Cloud Security: Automate or Die
CSV-F02
Sr. Faculty
SANS Institute
@daveshac...

#RSAC
Introduction
Business is moving faster to the cloud, and DevOps is accelerating
scale and pushing automation
Where’s...

#RSAC
This was your data center before…
3

#RSAC
This is your data center soon…
4

#RSAC
What is DevOps?
An open dialogue and collaboration between development and
operations teams
The goal is “continuous ...

#RSAC
DevSecOps Integrates Security
DevSecOps strives to automate core security tasks by embedding
security controls and p...

#RSAC
Cloud Deployment: Internal vs.
External

#RSAC
Cloud Security: Where to Focus
Internal:
-Deployment pipeline
-Data security
External:
-CSP security controls
-Integ...

#RSAC
General: Start with Cloud Threat Modeling
• Most likely threats
• Data types and sensitivity
• System builds and con...

#RSAC
Where does our traditional model fail?
Perimeter focused
Rely on dedicated appliances
Heavy footprints for endpoints...

#RSAC
Security as Code?
With DevOps and “Infrastructure as Code”, we define everything in a
software-defined method:
Serve...

#RSAC
Deployment Pipeline Security
Focus on:
Code security
Code repositories
Automation tools
Orchestration platforms
Gate...

#RSAC
Development/Deployment Integration
• We need to integrate into deployment pipelines
• Continuous Integration vs. Con...

#RSAC
Specific Control Examples
Application-level security through CI/CD integration
SAST (Veracode or Fortify on Demand i...

#RSAC
Ansible Example: RHEL 7 STIG
15

#RSAC
Map to Cloud Risk Considerations
16

#RSAC
“In-Cloud” Security

#RSAC
The key is change detection
For true DevSecOps to take hold, security teams will need to embed
automated tests and v...

#RSAC
DevSecOps and configuration state
• Define configuration items and baselines
• Approve configuration templates and c...

#RSAC
Vulnerability scanning
• Continuous monitoring is critical to DevSecOps success
• Check for scanning products that h...

#RSAC
DevSecOps: Privilege management
• Carefully limit and control the accounts and privileges assigned to
resources
• Al...

#RSAC
Just…no.
22

#RSAC
Security as Code: Define Policies
Define policies for components, networks, and more
This might include:
Configurati...

#RSAC
Security as Code: Define security “stories”
These will be specific use cases and requirements:
Input validation for ...

#RSAC
Security as Code: Internal Build and Deployment
Security
For the internal side of Security as Code, imagine the foll...

#RSAC
Security as Code: Test policies regularly
Using build testing tools like Test Kitchen and Vagrant can simplify
inter...

#RSAC
The Cloud Feedback Loop
“Triggered” Security Automation

#RSAC
Security as Code: Automate Production Feedback
Loops
That whole “continuous monitoring” thing?
Yeah, it’s time.
You ...

#RSAC
Collect and analyze logs and events
• Logs and events generated by services, applications, and operating
systems wit...

#RSAC
Benefits of DevSecOps: Inventory Management
• We need a sound view of what we have!
• An effective, dynamic inventor...

#RSAC
Example 1: Scanning -> Remediation
AWS Lambda Inspector Scan
var AWS = require('aws-sdk');
var inspector = new AWS.I...

#RSAC
Example 2: Template/AMI Integrity+Rollback
The describe-images CLI command can produce AMI information from
AWS
Pars...

#RSAC
Example 3: Log Parsing to Quarantine
Collect and parse all logs in the cloud
In AWS, this would include CloudWatch a...

#RSAC
The Big Picture: Automated Forensics
1. Detect a suspicious behavior on a cloud instance
2. Trigger an automated res...

#RSAC
Sound far-fetched? Not so much.
So many great projects out there now:
AWS_IR: https://aws-ir.readthedocs.io/en/lates...

#RSAC
Security automation in AWS
From: http://www.slideshare.net/AmazonWebServices/introduction-to-devsecops-on-aws
36

#RSAC
Measuring DevSecOps

#RSAC
Metrics
For automation to really take hold in cloud deployments, you need
DATA
And that means metrics+reporting
For ...

#RSAC
Metrics
Metrics in the cloud:
Number of “anomalies” detected in builds and production changes
Number of automated ro...

#RSAC
Wrapping Up

#RSAC
What does this all mean?
We have HUGE gaps in security involvement and knowledge for all of
this
Cloud-oriented thre...

#RSAC
It’s time to shift…
From THIS: To THIS:
Type: "AWS::EC2::SecurityGroupIngress"
Properties:
CidrIp: String
CidrIpv6: ...

#RSAC
Integrate DevSecOps into security operations
• Leverage automation:
• Salt
• Puppet
• Chef
• Embedded agents and Sec...

#RSAC
DevSecOps: A Checklist
Ensure that periodic reviews of the overall risk posture within cloud
environments are perfor...

#RSAC
“Apply” Slide
Next week you should:
Discuss threat models with Dev and Ops teams
In the first three months following...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 45 Ad

View on Slideshare

1 of 45 Ad