Download as PDF, PPTX
![Infrastructure Code
package 'httpd' do
action :install
end
service 'httpd' do
action [ :start, :enable ]
end](https://image.slidesharecdn.com/20170626-chefmelbourne-inspec-170626115528/75/Melbourne-Chef-Meetup-Automating-Azure-Compliance-with-InSpec-23-2048.jpg)
![azure_virtual_machine
control 'azure-1' do
impact 1.0
title 'Make sure Ubuntu Servers are built from an Ubuntu template'
describe azure_virtual_machine(name: '[YOUR VM NAME]',
resource_group: '[YOUR RESOURCE GROUP]') do
its('sku') { should eq '16.04.0-LTS' }
its('publisher') { should eq 'Canonical' }
its('offer') { should eq 'UbuntuServer' }
end
end](https://image.slidesharecdn.com/20170626-chefmelbourne-inspec-170626115528/75/Melbourne-Chef-Meetup-Automating-Azure-Compliance-with-InSpec-62-2048.jpg)
Uploaded byMatt Ray
Melbourne Chef Meetup: Automating Azure Compliance with InSpec
The document discusses automating compliance in Azure using InSpec and Chef, outlining security vulnerabilities and misconfigurations related to SSH and Apache servers. It highlights the importance of continuous testing and compliance and offers methods for verifying configurations via command line and code examples. Additionally, it includes references to various operating systems and tools for ensuring compliance automation within software development workflows.
More Related Content
Similar to Melbourne Chef Meetup: Automating Azure Compliance with InSpec
Melbourne Chef Meetup: Automating Azure Compliance with InSpec
- 1. Automating Azure Compliancewith InSpec Chef Melbourne June 26, 2017
- 2. Matt Ray Manager, SolutionsArchitect – APJ Chef Software matt@chef.io @mattray
- 4.
- 7. SSH Control "SSH supportstwo different protocol versions.The original version, SSHv1, was subject to a number of security issues. Please use SSHv2 instead to avoid these."
- 8. How will Iverify this?
- 9. Whip up aone-liner! grep "^Protocol" /etc/ssh/sshd_config | sed 's/Protocol //'
- 10. Apache Server InformationLeakage • Description This Directive Controls wheather Server response field is sent back to clients includes a description of Generic OSType of the Server. This allows attackers to identify web servers details greatly and increases the efficiency of any attack,as security vulnerabilities are dependent upon specific software versions. • How toTest In order to test for ServerToken configuration, one should check the Apache configuration file. • Misconfiguration ServerTokens Full • Remediation Configure the ServerTokens directive in the Apache configuration to value of Prod or ProductOnly.This tells Apache to only return "Apache" in the Server header, returned on every page request. ServerTokens Prod or ServerTokens ProductOnly https://www.owasp.org/index.php/SCG_WS_Apache
- 11. More grep andsed! grep "^ServerTokens" /etc/httpd/conf/httpd.conf | sed 's/ServerTokens //'
- 17.
- 19. Two-thirds of organizationsdid not adequately test the security of all in-scope systems
- 20. Key Trends • Whileindividual rule compliance is up, testing of security systems is down • Sustainability is low. Fewer than a third of companies were found to be still fully compliant less than a year after successful validation.
- 22. Shell Scripts grep "^Protocol"/etc/ssh/sshd_config | sed 's/Protocol //' grep "^ServerTokens" /etc/httpd/conf/httpd.conf | sed 's/ServerTokens //'
- 23. Infrastructure Code package 'httpd'do action :install end service 'httpd' do action [ :start, :enable ] end
- 24. We Have ACommunications Problem
- 26.
- 27.
- 34.
- 35.
- 36.
- 37.
- 38. One Language Linux,Windows, BSD,Solaris,AIX, HP-UX, ...
- 39. Examples of AvailableResources apache_conf apt audit_policy auditd_conf auditd_rules bond bridge command crontab directory etc_group file gem group host inetd_conf interface iptables kernel_module kernel_parameter limits_conf login_defs mount mysql_conf mysql_session npm ntp_conf oneget os os_env package parse_config parse_config_file passwd pip port postgres_conf postgres_session powershell processes registry_key security_policy service ssh_config sshd_config user windows_feature yum
- 40. What is itnot? • IDS / IPS • Firewall • Antivirus • Pentesting tool
- 41. One Language Linux,Windows, BSD,Solaris,AIX, HP-UX, ... Bare-metal
- 42. One Language Linux,Windows, BSD,Solaris,AIX, HP-UX, ... Bare-metal,VMs
- 43. One Language Linux,Windows, BSD,Solaris,AIX, HP-UX, ... Bare-metal,VMs, Containers
- 44. One Language Linux,Windows, BSD,Solaris,AIX, HP-UX, ... Bare-metal,VMs, Containers Nodes
- 45. One Language Linux,Windows, BSD,Solaris,AIX, HP-UX, ... Bare-metal,VMs, Containers Nodes, Databases
- 46.
- 47. One Language Linux,Windows, BSD,Solaris,AIX, HP-UX, ... Bare-metal,VMs, Containers Nodes, Databases,APIs
- 48.
- 49. InSpec > inspec exectest.rb Test a machine remotely via SSH > inspec exec test.rb -i identity.key -t ssh://root@172.17.0.1 Test your machine locally > inspec exec test.rb -t winrm://Admin@192.168.1.2 --password super Test Docker Container > inspec exec test.rb -t docker://5cc8837bb6a8 Test a machine remotely via WinRM AGENTLESS
- 50. Operating System &Application Coverage • Microsoft Windows • Red Hat Enterprise Linux • Ubuntu Linux • SUSE Linux Enterprise Server • Oracle Enterprise Linux • AIX • HP-UX • Solaris • VMware ESXi • MySQL • Oracle • PostgreSQL • Tomcat • SQL Server • IIS • HTTP request
- 51. One Language Linux,Windows, BSD,Solaris,AIX, HP-UX, ... Bare-metal,VMs, Containers Nodes, Databases,APIs, Cloud Platforms
- 52. One Language Linux,Windows, BSD,Solaris,AIX, HP-UX, ... Bare-metal,VMs, Containers Nodes, Databases,APIs, Cloud Platforms, ...
- 53. Open Source Community •InSpec •https://inspec.io •ChefAudit cookbook •https://github.com/chef-cookbooks/audit •Kitchen-InSpec •https://github.com/chef/kitchen-inspec •Supermarket.chef.io •#inspec in
- 54. Scan for Compliance Build &Test Locally Build & Test CI/CD Remediate Verify New Workflow
- 55. CONTINUOUS COMPLIANCE AUTOMATION InSpec- Part of your InfoSec toolchain FIREWALL ANTIVIRUS INTRUSION DETECTION/ PREVENTION PENETRATION TESTING
- 56. The Chef AutomatePlatform Continuous Automation for High Velocity IT Workflow • Local development • Integration • Tooling (APIs & SDKs) COLLABORATE ▪ Package ▪ Test ▪ Approve BUILD ▪ Provision ▪ Configure ▪ Execute ▪ Update DEPLOY ▪ Secure ▪ Comply ▪ Audit ▪ Measure ▪ Log MANAGE Infrastructure Automation Compliance AutomationApplication Automation OSS AUTOMATION ENGINES Increase Speed ▪ Package infrastructure and app configuration as code ▪ Continuously automate infrastructure and app updates Improve Efficiency ▪ Define and execute standard workflows and automation ▪ Audit and measure effectiveness of automation Decrease Risk ▪ Define compliance rules as code ▪ Deliver continuous compliance as part of standard workflow
- 58.
- 59. InSpec Azure •https://github.com/chef/inspec-azure •Uses AzureRuby SDK •~/.azure/credentials •http://seththoenen.com/cloud-inspec/getting-started-azure
- 60.
- 61. azure_resource_group control 'azure-1' do impact1.0 title 'Checks that there is only one storage account in the resource group' describe azure_resource_group(name: 'MyResourceGroup').where { type == 'Microsoft.Storage/storageAccounts' }.entries do its('count') { should eq 1 } end end
- 62. azure_virtual_machine control 'azure-1' do impact1.0 title 'Make sure Ubuntu Servers are built from an Ubuntu template' describe azure_virtual_machine(name: '[YOUR VM NAME]', resource_group: '[YOUR RESOURCE GROUP]') do its('sku') { should eq '16.04.0-LTS' } its('publisher') { should eq 'Canonical' } its('offer') { should eq 'UbuntuServer' } end end