June 26, 2017 presentation. With the move to infrastructure as code and continuous integration/continuous delivery pipelines, it looked like releases would become more frequent and less problematic. Then the auditors showed up and made everyone stop what they were doing. How could this have been prevented? What if the audits were part of the process instead of a roadblock? What sort of visibility do we have into the state of our Azure infrastructure compliance? This talk will provide an overview of Chef's open-source InSpec project (https://inspec.io) and how you can build "Compliance as Code" into your Azure-based infrastructure.

1. Automating Azure Compliance with InSpec
Chef Melbourne
June 26, 2017

2. Matt Ray
Manager, Solutions Architect – APJ
Chef Software
matt@chef.io
@mattray

4. Chef Workflow

7. SSH Control
"SSH supports two different protocol
versions.The original version, SSHv1, was
subject to a number of security issues.
Please use SSHv2 instead to avoid
these."

8. How will I verify this?

9. Whip up a one-liner!
grep "^Protocol" /etc/ssh/sshd_config | sed 's/Protocol //'

10. Apache Server Information Leakage
• Description
This Directive Controls wheather Server response field is sent back to clients includes a description of Generic OSType of the
Server.
This allows attackers to identify web servers details greatly and increases the efficiency of any attack,as security vulnerabilities are
dependent upon specific software versions.
• How toTest
In order to test for ServerToken configuration, one should check the Apache configuration file.
• Misconfiguration
ServerTokens Full
• Remediation
Configure the ServerTokens directive in the Apache configuration to value of Prod or ProductOnly.This tells Apache to only
return "Apache" in the Server header, returned on every page request.
ServerTokens Prod
or
ServerTokens ProductOnly
https://www.owasp.org/index.php/SCG_WS_Apache

11. More grep and sed!
grep "^ServerTokens" /etc/httpd/conf/httpd.conf | sed 's/ServerTokens //'

17. C
o
m
p
l
i
a
n
c
e

19. Two-thirds of organizations did
not adequately test the security
of all in-scope systems

20. Key Trends
• While individual rule compliance
is up, testing of security systems
is down
• Sustainability is low. Fewer than
a third of companies were found
to be still fully compliant less
than a year after successful
validation.

22. Shell Scripts
grep "^Protocol" /etc/ssh/sshd_config | sed 's/Protocol //'
grep "^ServerTokens" /etc/httpd/conf/httpd.conf | sed 's/ServerTokens //'

23. Infrastructure Code
package 'httpd' do
action :install
end
service 'httpd' do
action [ :start, :enable ]
end

24. We Have A Communications Problem

26. Security != Compliance

27. Secure
Compliant

34. Compliance Language

35. One Language
Linux

36. One Language
Linux,Windows

37. Windows

38. One Language
Linux,Windows, BSD, Solaris,AIX, HP-UX, ...

39. Examples of Available Resources
apache_conf
apt
audit_policy
auditd_conf
auditd_rules
bond
bridge
command
crontab
directory
etc_group
file
gem
group
host
inetd_conf
interface
iptables
kernel_module
kernel_parameter
limits_conf
login_defs
mount
mysql_conf
mysql_session
npm
ntp_conf
oneget
os
os_env
package
parse_config
parse_config_file
passwd
pip
port
postgres_conf
postgres_session
powershell
processes
registry_key
security_policy
service
ssh_config
sshd_config
user
windows_feature
yum

40. What is it not?
• IDS / IPS
• Firewall
• Antivirus
• Pentesting tool

41. One Language
Linux,Windows, BSD, Solaris,AIX, HP-UX, ...
Bare-metal

42. One Language
Linux,Windows, BSD, Solaris,AIX, HP-UX, ...
Bare-metal,VMs

43. One Language
Linux,Windows, BSD, Solaris,AIX, HP-UX, ...
Bare-metal,VMs, Containers

44. One Language
Linux,Windows, BSD, Solaris,AIX, HP-UX, ...
Bare-metal,VMs, Containers
Nodes

45. One Language
Linux,Windows, BSD, Solaris,AIX, HP-UX, ...
Bare-metal,VMs, Containers
Nodes, Databases

46. DB Testing

47. One Language
Linux,Windows, BSD, Solaris,AIX, HP-UX, ...
Bare-metal,VMs, Containers
Nodes, Databases,APIs

48. Cloud Testing

49. InSpec
> inspec exec test.rb
Test a machine remotely via SSH
> inspec exec test.rb -i identity.key -t ssh://root@172.17.0.1
Test your machine locally
> inspec exec test.rb -t winrm://Admin@192.168.1.2 --password super
Test Docker Container
> inspec exec test.rb -t docker://5cc8837bb6a8
Test a machine remotely via WinRM
AGENTLESS

50. Operating System & Application Coverage
• Microsoft Windows
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux Enterprise Server
• Oracle Enterprise Linux
• AIX
• HP-UX
• Solaris
• VMware ESXi
• MySQL
• Oracle
• PostgreSQL
• Tomcat
• SQL Server
• IIS
• HTTP request

51. One Language
Linux,Windows, BSD, Solaris,AIX, HP-UX, ...
Bare-metal,VMs, Containers
Nodes, Databases,APIs, Cloud Platforms

52. One Language
Linux,Windows, BSD, Solaris,AIX, HP-UX, ...
Bare-metal,VMs, Containers
Nodes, Databases,APIs, Cloud Platforms, ...

53. Open Source Community
•InSpec
•https://inspec.io
•Chef Audit cookbook
•https://github.com/chef-cookbooks/audit
•Kitchen-InSpec
•https://github.com/chef/kitchen-inspec
•Supermarket.chef.io
•#inspec in

54. Scan for
Compliance
Build & Test
Locally
Build & Test
CI/CD Remediate Verify
New Workflow

55. CONTINUOUS COMPLIANCE AUTOMATION
InSpec - Part of your InfoSec toolchain
FIREWALL ANTIVIRUS
INTRUSION
DETECTION/
PREVENTION
PENETRATION
TESTING

56. The Chef Automate Platform
Continuous Automation for High Velocity IT
Workflow • Local development • Integration • Tooling (APIs & SDKs)
COLLABORATE
▪ Package
▪ Test
▪ Approve
BUILD
▪ Provision
▪ Configure
▪ Execute
▪ Update
DEPLOY
▪ Secure
▪ Comply
▪ Audit
▪ Measure
▪ Log
MANAGE
Infrastructure Automation Compliance AutomationApplication Automation
OSS AUTOMATION ENGINES
Increase Speed
▪ Package infrastructure and app
configuration as code
▪ Continuously automate
infrastructure and app updates
Improve Efficiency
▪ Define and execute standard
workflows and automation
▪ Audit and measure effectiveness of
automation
Decrease Risk
▪ Define compliance rules as code
▪ Deliver continuous compliance as
part of standard workflow

58. INSPEC DEMO

59. InSpec Azure
•https://github.com/chef/inspec-azure
•Uses Azure Ruby SDK
•~/.azure/credentials
•http://seththoenen.com/cloud-inspec/getting-started-azure

60. InSpec Azure
azure_resource_group
azure_virtual_machine
azure_virtual_machine_datadisks

61. azure_resource_group
control 'azure-1'
do impact 1.0
title 'Checks that there is only one storage account in the resource
group'
describe azure_resource_group(name: 'MyResourceGroup').where { type
== 'Microsoft.Storage/storageAccounts' }.entries do
its('count') { should eq 1 }
end
end

62. azure_virtual_machine
control 'azure-1' do
impact 1.0
title 'Make sure Ubuntu Servers are built from an Ubuntu template'
describe azure_virtual_machine(name: '[YOUR VM NAME]',
resource_group: '[YOUR RESOURCE GROUP]') do
its('sku') { should eq '16.04.0-LTS' }
its('publisher') { should eq 'Canonical' }
its('offer') { should eq 'UbuntuServer' }
end
end