Download as PDF, PPTX
Uploaded byPriyanka Aash
Pragmatic Security Automation for Cloud
The document discusses pragmatic security automation strategies for cloud environments, emphasizing the importance of cloud-native security practices. It outlines principles such as software-defined security, event-driven models, and the use of guardrails for managing cloud resources effectively. Recommendations for implementing automation include defining problems, building workflows, and using event-driven guardrails to enhance operational security and efficiency.
More Related Content
![[OPD 2019] Governance as a missing part of IT security architecture](https://cdn.slidesharecdn.com/ss_thumbnails/owaspday-final-191021172307-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to Pragmatic Security Automation for Cloud
Pragmatic Security Automation for Cloud
- 1. SESSION ID: #RSAC Rich Mogull PRAGMATICSECURITY AUTOMATION FOR CLOUD CSV-R04 Analyst/VP of Product Securosis/DisruptOPS rmogull@disruptops.com @rmogull
- 2. #RSAC Cloud is FundamentallyDifferent 2 Abstraction Automation
- 3. #RSAC Automation is Inherent 3 TheNIST Model (courtesy the CSA)
- 4. #RSAC APIs are Ubiquitous 4 CloudSecurity Alliance IaaS Reference Model }
- 5. #RSAC Cloud Security MustBe Cloud Native 5 Management Plane Volatility/Velocity Distribution/Segregation Account Virtual Network Subnet Security Group Virtual Network Subnet Security Group Account Virtual Network Subnet Security Group Virtual Network Subnet Security Group
- 6. #RSAC The Categories 6 Guardrails WorkflowsOrchestrations Continuously assess and enforce operational and security policies Streamline and accelerate IT operations and security through automated workflows Empower new capabilities through advanced orchestration of infrastructure, operations, and security Fix security group or S3 misconfigurations Incident response Automatic WAF insertion and configuration
- 7.
- 8. #RSAC The Foundation 8 Cloud ServiceProvider Cloud Consumer (you) ‣ API and full administrative activity logging ‣ Events/triggers/rules ‣ Function as a Service (Serverless) ‣ Notification service ‣ Continuous Integration Pipeline ‣ Version control repository ‣ Full IAM access to accounts/subscriptions/ projects ‣ Security development team (person) Critical Capabilities
- 9. #RSAC The Process 9 Define Your Problem EvalFOSS/Existing tools Determine Tech Stack Build Initial Automations (Ops) Expand for Scale/Scope
- 10. #RSAC Things We AreSkipping (for time) 10 How to configure all the core monitoring/logging Setting up IAM and permissions The details of implementation on Azure and GCP We will list the core capabilities, but can’t cover all 3 with real examples in 45 minutes
- 11. #RSAC What’s a Guardrail? 11 Defineand set limits Can be “allow” or “deny” Find deviations Assessment or event based Evaluate the issue Fix/remediate Automatically or manually depending on rules Find Eval Fix
- 12. #RSAC Example Guardrails 12 If youfind a public S3 bucket, restrict it to our known network addresses Unless it is approved or tagged Don’t allow internal security groups with all ports and protocols open in Prod But allow in Dev Require MFA for API access for any user that needs MFA for console access Create our baseline IAM policies and roles for all new accounts Based on the environment Validate that monitoring and alerting is properly configured And fix if not Disable access keys that haven’t been used in 90 days Find instances with an IAM role that allows power user or greater access via API Restrict the privileges Identify all cross-network peering from accounts we don’t own Then check the security group permissions
- 13. #RSAC What Makes aGood Guardrail? 13 Accounts for different environments At least Dev vs. Prod Handles exceptions And is capable of remembering them Understands state and context Doesn’t bog down the alert queue Can remediate automatically Either completely, or after manual approval Ops communications/notifications Education, not Blamification
- 14. #RSAC Building a Guardrail 14 Define Criteria/Issues AddFilters Set Triggers Add Actions And Targets
- 15. #RSAC Our Guardrail 15 Criteria/Issues All instanceswith port 22 open to the 0.0.0.0/0 (the Internet) Filters Region is us-west-2p (could be VPC/tag/etc) Trigger Time = every 5 minutes Action Restrict to known IP range Demo
- 16. #RSAC Our Event-Driven Guardrail 16 Criteria/Issues Newinbound security group rule added Filters IAM user, VPC, Tag Trigger API event (CloudTrail) Action Reverse + Notify Demo
- 17. #RSAC Expanding to EnterpriseScale 17 Hitting all 14 regions simultaneously Multiplex Central event stream Queues/SNS AuthN/AuthZ
- 18. #RSAC Building a Workflow 18 DefineSteps Determine Inputs Choose Execution Model Modularize Code Can be built on Guardrails and support Orchestrations
- 19. #RSAC Our Workflow 19 Steps (IncidentResponse) Collect metadata (before we change it) Quarantine on the network and in AWS Snapshot all storage and attach for forensics Analyze Inputs Instance ID Execution Model Command line (container or remote) Modularize Code Classes for analyze vs. respond All methods reusable Demo
- 20. #RSAC Workflows Advice 20 Workflows areto speed up common, manual tasks Guardrails are for automated enforcement The line between a guardrail action and an Workflows is often thin Execution environment matters Lambda vs. containers vs. your laptop Use your pipeline Continuous integration servers (Jenkins) make great platforms for repeat automation, not just security testing Make a static console E.g. S3 + API Gateway + SQS
- 21. #RSAC Building a Orchestration 21 IDapps and APIs Locate SDK if available Consider flow/value Modularize Integrate in code
- 22. #RSAC Our Orchestration 22 Apps/API EC2 +Route 53 + Incapsula SDK AWS Ruby + REST client Flow/Value ID public web servers -> determine DNS -> check WAF -> add WAF Limit: default AWS domain names Modularize Find web instances, ELBs Change DNS, add Incapsula Integrate into code See video Demo
- 23. #RSAC Complexities 23 Account Virtual Network Subnet Security Group Virtual Network Subnet Security Group Account VirtualNetwork Subnet Security Group Virtual Network Subnet Security Group Scaling Multiple Accounts Multiple Providers Circuit Breakers
- 24.
- 25. #RSAC Where to Start 25 Startwith something simple Build it in one account/subscription/project Event + Notification is super easy to start Then go with your first FaaS Desktop first, then FaaS for execution environment Build a library Experiment with execution environments, but standardize quickly Add enterprise scaling capabilities Will depend on your execution environment/model Build it in the cloud and leverage PaaS options Make sure you use CI/CD for long term management
- 26. SESSION ID: #RSAC Rich Mogull PRAGMATICSECURITY AUTOMATION FOR CLOUD CSV-R04 Analyst/VP of Product Securosis/DisruptOPS rmogull@disruptops.com @rmogull