Keeping Developers and Auditors Happy in the Cloud
•
0 likes•743 views
Often times, developers and auditors can be at odds. The agile, fast-moving environments that developers enjoy will typically give auditors heartburn. The more controlled and stable environments that auditors prefer to demonstrate and maintain compliance are traditionally not friendly to developers or innovation. In this session, we will look at the intersection where developers and auditors meet by discussing techniques, tools, and concepts that appeal to both. Topics covered will include shared responsibility, using compartmentalization and microservices for scope control, immutable infrastructure, and continuous security testing.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Keeping Developers and Auditors Happy in the Cloud
Similar to Keeping Developers and Auditors Happy in the Cloud (20)
More from Amazon Web Services
More from Amazon Web Services (20)
Recently uploaded
Recently uploaded (20)
Keeping Developers and Auditors Happy in the Cloud
- 1. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Keeping Developers and Auditors Happy in the Cloud Brian Wagner, Solutions Architect, AWS Germany 18 May, Taiwan Summit
- 2. The Cloud from a Developer Perspective
- 3. The Cloud from an Auditor Perspective
- 4. The Problem
- 5. Incentives and Perspectives Developers Incentives Speed Features Want Freedom to innovate New technology Auditors Incentives Compliance with regulatory obligations Verifiable processes Want Well-known technology Predictability and stability
- 6. The Solution
- 7. “You build it, you run it.” -Werner Vogels, Amazon CTO (June 2006)
- 9. developers delivery pipelinesservices releasetestbuild releasetestbuild releasetestbuild releasetestbuild releasetestbuild releasetestbuild You Build It, You Run It
- 11. How Does that Help?
- 12. Four Pillars 1. Undifferentiated heavy lifting and shared responsibility 2. Traceability in development 3. Continuous security visibility 4. Compartmentalization
- 13. Four Pillars 1. Undifferentiated heavy lifting and shared responsibility 2. Traceability in development 3. Continuous security visibility 4. Compartmentalization
- 17. Data Backups
- 18. Traditional Data Backup Server Database Disk Tape storage Corporate data center Backup data center/media storage provider Disk Tape storage
- 19. Data Backup in the Cloud RDBMS Amazon EBS volume Cassandra Amazon S3 bucket Other region S3 bucket Other account S3 bucket Non-AWS cloud storage Cloud backup
- 20. Four Pillars 1. Undifferentiated heavy lifting and shared responsibility 2. Traceability in development 3. Continuous security visibility 4. Compartmentalization
- 21. Common Audit Requirements for Software Development Review changes. Track changes. Test changes. Deploy only approved code. For all actions: Who did it? When?
- 22. AWS Config AWS Config is a fully managed service that provides you with an inventory of your AWS resources, lets you audit the resource configuration history and notifies you of resource configuration changes.
- 23. Continuous ChangeRecordingChanging Resources AWS Config History Stream Snapshot (ex. 2014-11-05) AWS Config
- 24. Audit logs for all operations Store/ Archive Troubleshoot Monitor & Alarm You are making API calls... On a growing set of AWS services around the world.. CloudTrail is continuously recording API calls
- 25. Four Pillars 1. Undifferentiated heavy lifting and shared responsibility 2. Traceability in development 3. Continuous security visibility 4. Compartmentalization
- 26. DevOps
- 27. Infrastructure as Code is a practice by where traditional infrastructure management techniques are supplemented and often replaced by using code based tools and software development techniques.
- 28. Infrastructure-as-code workflow code version control code review integrate “It’s all software”
- 29. Development Lifecycle — DevOps developers customers releasetestbuild plan monitor feedback loop Delivery Pipeline
- 30. DevSecOps
- 31. Where to Start? Page 3 of 433 • Guidelines? • Checklists? • 1-pagers? • 6-pagers? • Full documents? Security as Code
- 32. Security as Code is Easy with AWS AWS provides all the APIs! Programmatically test environments Determine state of environment at a specific point in time Repeatable processes Scalable operations
- 33. Development Lifecycle — DevOps developers customers releasetestbuild plan monitor feedback loop Delivery Pipeline Security as Code
- 34. How Can We Learn DevSecOps? Start Here Security as Code? Security as Ops? Compliance Ops? Science? Experiment: Automate Policy Governance Experiment: Detection via Security Operations Experiment: Compliance via DevSecOps Toolkit Experiment: Science via Profiling DevSecOps DevOps + Security
- 35. Four Pillars 1. Undifferentiated heavy lifting and shared responsibility 2. Traceability in development 3. Continuous security visibility 4. Compartmentalization
- 36. amazon.com 2001
- 38. Service-Oriented Architecture (SOA) Single-purpose Connect only through APIs “Microservices” amazon.com 2009
- 40. amazon.com 2009 Two-pizza teams Full ownership Full accountability Aligned incentives “DevOps”
- 41. developers delivery pipelinesservices releasetestbuild releasetestbuild releasetestbuild releasetestbuild releasetestbuild releasetestbuild You Build It, You Run It
- 42. Keep Developers and Auditors Happy
- 43. Thank You Brian Wagner, Solutions Architect, AWS Germany 18 May, Taiwan Summit