SlideShare a Scribd company logo
Copyright © 2016Copyright © 2017
Security as Code
How to adopt a cloud native DevOps model
without sacrificing security
June 29, 2017
Copyright © 2016Copyright © 2017
Alan Shimel
Editor & Chief at
DevOps.com
Anthony Johnson
Staff Engineer at Ellie Mae
John Hutchison
Solutions Engineer at
Evident.io
SPEAKERS
Copyright © 2016Copyright © 2017
Automation Compliance Policies
Fine-grained Controls
Configuration Management Techniques
Compliance at Scale
AGENDA
The Answer is Automation
Cloud Platform and Operations
Anthony Johnson
6/24/17©2015 Ellie Mae. All rights reserved. 5
Introduction
Anthony Johnson
Staff Engineer - Cloud Platform
Fun Facts
• Joined Ellie Mae in May 2016
• Loves to bake bread
• Visits Japan every year
• Wants to live on Mars
Ellie Mae’s north star is to automate everything
automatable in the residential mortgage industry.
East-Bay Fintech Company
Fun Facts
• Established in 1997
• 2016 Bay Area Best Places to Work
• Processes more than 25% of the mortgages in the US
• Public Company (Not a government agency)
6/24/17©2015 Ellie Mae. All rights reserved. 6
History as I know it
• Thick client era (TCE)
• Hybrid client era (HCE)
• Hybrid Cloud era (YEA!)
1997 2011
Established IPO
2016
Cloud
Strategy
thick client hybrid client hybrid cloud
The past really doesn’t matter!
2016
Anthony
Joins
6/24/17©2015 Ellie Mae. All rights reserved. 7
Why did Ellie Mae choose Public Cloud
Disclaimer: This decision pre-dates me
• Stability of internal offering
• Scaling of internal offering
• Agility of internal offering
• cost
6/24/17©2015 Ellie Mae. All rights reserved. 8
Cloud Strategy Pillars
• You Build It, You Run It
• Least Privilege
• Trust but Verify
• Automation and Self Healing
• Customer Focused/Open Door
6/24/17©2015 Ellie Mae. All rights reserved. 9
You Build It, You Run It, You Pay for it
Bold Words!
You Build It
An Engineering team builds it
You Run It
The same Engineering team runs it, gets called on it and is accountable
You Pay for It
Cost is a design variable. We should expose the real costs whenever possible.
Bonus if we can expose cost modeling throughout
6/24/17©2015 Ellie Mae. All rights reserved. 10
Least Privilege - Separation of Duties
Development, QA, etc Pre-Prod, Prod
CI/CD
Developers
Full Access
No PII Data Allowed
Developers
Read Only
No Access to PII
Data
6/24/17©2015 Ellie Mae. All rights reserved. 11
Least Privilege - AWS Security Practices
• Private and Public Subnets
• VPCs are centrally managed
• IAM Instance Profiles
• User Groups/Roles
• Service Users
• Security Groups
• EC2 Access
6/24/17©2015 Ellie Mae. All rights reserved. 12
Least Privilege - Everything else
CI/CD
All code is reviewed. Everything is code. Deploy Gates.
Network
All VPC-to-VPC connectivity goes through a firewall
Production Accounts
Only the Public Cloud team has privileged access, but Public Cloud accessing it
should be an exception, not the norm
6/24/17©2015 Ellie Mae. All rights reserved. 13
Automation and Self Healing
• Have a strategy for programmatic creation of common
resources
• Operations should be idempotent
• Avoid CloudFormation for this task
6/24/17©2015 Ellie Mae. All rights reserved. 14
Trust but Verify using Automation
Demo
6/24/17©2015 Ellie Mae. All rights reserved. 15
Demo video
6/24/17©2015 Ellie Mae. All rights reserved. 16
Lots of options
6/24/17©2015 Ellie Mae. All rights reserved. 17
Customer Focused/Open Door
• Create a wiki page that is for your
customers
• Functional information only
• No implementation details
• Know your customers
• Know your value
• Develop a training strategy early
6/24/17©2015 Ellie Mae. All rights reserved. 18
How to choose your offering?
• Look for global optimizations
• Find ways to engage with your customers
• Adopt a product development attitude
• Our team adopted narrative-driven development
• Sprints/Epics/Backlogs
• Prioritize on business value
Questions?
Copyright © 2016Copyright © 2017
Q&A Session
Please submit your questions though the Q&A chat box.
@evidentdotio
/company/evident-io
/evident.io/
sales@evident.io

More Related Content

What's hot

ITAM UK 2017 ITAM in the Cloud Era_Martin Thompson
ITAM UK 2017 ITAM in the Cloud Era_Martin ThompsonITAM UK 2017 ITAM in the Cloud Era_Martin Thompson
ITAM UK 2017 ITAM in the Cloud Era_Martin Thompson
Martin Thompson
 
Journey to The Cloud-Native Enterprise
Journey to The Cloud-Native Enterprise Journey to The Cloud-Native Enterprise
Journey to The Cloud-Native Enterprise
dektlong
 
Activiti Cloud Deep Dive
Activiti Cloud Deep DiveActiviti Cloud Deep Dive
Activiti Cloud Deep Dive
Mauricio (Salaboy) Salatino
 
Brian Scanlan - Intercom and AWS
Brian Scanlan - Intercom and AWSBrian Scanlan - Intercom and AWS
Brian Scanlan - Intercom and AWS
Brian Scanlan
 
Mark Schroeder - Considering APIs?
Mark Schroeder - Considering APIs?Mark Schroeder - Considering APIs?
Mark Schroeder - Considering APIs?
John Zozzaro
 
Atlassian
AtlassianAtlassian
Atlassian
Josh Hamet
 
Company presontation
Company presontationCompany presontation
Company presontation
Carl Scheller
 
8 Tips to Scale Faster in the Cloud
8 Tips to Scale Faster in the Cloud8 Tips to Scale Faster in the Cloud
8 Tips to Scale Faster in the Cloud
Datto
 
The Evolution of Hosting and What's Next with Cloud
The Evolution of Hosting and What's Next with CloudThe Evolution of Hosting and What's Next with Cloud
The Evolution of Hosting and What's Next with Cloud
Josh Ward
 
Oracle Cloudday - the future of retail
Oracle Cloudday - the future of retailOracle Cloudday - the future of retail
Oracle Cloudday - the future of retail
Johan Louwers
 

What's hot (10)

ITAM UK 2017 ITAM in the Cloud Era_Martin Thompson
ITAM UK 2017 ITAM in the Cloud Era_Martin ThompsonITAM UK 2017 ITAM in the Cloud Era_Martin Thompson
ITAM UK 2017 ITAM in the Cloud Era_Martin Thompson
 
Journey to The Cloud-Native Enterprise
Journey to The Cloud-Native Enterprise Journey to The Cloud-Native Enterprise
Journey to The Cloud-Native Enterprise
 
Activiti Cloud Deep Dive
Activiti Cloud Deep DiveActiviti Cloud Deep Dive
Activiti Cloud Deep Dive
 
Brian Scanlan - Intercom and AWS
Brian Scanlan - Intercom and AWSBrian Scanlan - Intercom and AWS
Brian Scanlan - Intercom and AWS
 
Mark Schroeder - Considering APIs?
Mark Schroeder - Considering APIs?Mark Schroeder - Considering APIs?
Mark Schroeder - Considering APIs?
 
Atlassian
AtlassianAtlassian
Atlassian
 
Company presontation
Company presontationCompany presontation
Company presontation
 
8 Tips to Scale Faster in the Cloud
8 Tips to Scale Faster in the Cloud8 Tips to Scale Faster in the Cloud
8 Tips to Scale Faster in the Cloud
 
The Evolution of Hosting and What's Next with Cloud
The Evolution of Hosting and What's Next with CloudThe Evolution of Hosting and What's Next with Cloud
The Evolution of Hosting and What's Next with Cloud
 
Oracle Cloudday - the future of retail
Oracle Cloudday - the future of retailOracle Cloudday - the future of retail
Oracle Cloudday - the future of retail
 

Similar to Security as Code

Cutting Through the Disruption
Cutting Through the DisruptionCutting Through the Disruption
Cutting Through the Disruption
OSSCube
 
Empowering Marketing Solutions Teams
Empowering Marketing Solutions TeamsEmpowering Marketing Solutions Teams
Empowering Marketing Solutions Teams
Zenoss
 
Building a DevOps Team that Isn't Evil
Building a DevOps Team that Isn't EvilBuilding a DevOps Team that Isn't Evil
Building a DevOps Team that Isn't Evil
IBM UrbanCode Products
 
Applied tactics for your transformation
Applied tactics for your transformationApplied tactics for your transformation
Applied tactics for your transformation
Stuart Charlton
 
Continuous Delivery in the Enterprise
Continuous Delivery in the EnterpriseContinuous Delivery in the Enterprise
Continuous Delivery in the Enterprise
IBM UrbanCode Products
 
AWS FSI Symposium 2017 NYC- CTP & Cloud Migration Best Practices
AWS FSI Symposium 2017 NYC- CTP & Cloud Migration Best PracticesAWS FSI Symposium 2017 NYC- CTP & Cloud Migration Best Practices
AWS FSI Symposium 2017 NYC- CTP & Cloud Migration Best Practices
Amazon Web Services
 
5 strategies for enterprise cloud infrastructure success
5 strategies for enterprise cloud infrastructure success5 strategies for enterprise cloud infrastructure success
5 strategies for enterprise cloud infrastructure success
Rogue Wave Software
 
Innovating Government: Building a Culture of DevSecOps for Rapid and Secure M...
Innovating Government: Building a Culture of DevSecOps for Rapid and Secure M...Innovating Government: Building a Culture of DevSecOps for Rapid and Secure M...
Innovating Government: Building a Culture of DevSecOps for Rapid and Secure M...
Amazon Web Services
 
SkillsMatter June 2018: Java in the 21st Century: Are You Thinking Far Enough...
SkillsMatter June 2018: Java in the 21st Century: Are You Thinking Far Enough...SkillsMatter June 2018: Java in the 21st Century: Are You Thinking Far Enough...
SkillsMatter June 2018: Java in the 21st Century: Are You Thinking Far Enough...
Steve Poole
 
Realizing Hybrid Cloud: Using IBM Bluemix, APIs, and DataPower
Realizing Hybrid Cloud: Using IBM Bluemix, APIs, and DataPowerRealizing Hybrid Cloud: Using IBM Bluemix, APIs, and DataPower
Realizing Hybrid Cloud: Using IBM Bluemix, APIs, and DataPowerAkana
 
DV 2016: Mission Possible - Building a New Analytics Framework
DV 2016: Mission Possible - Building a New Analytics FrameworkDV 2016: Mission Possible - Building a New Analytics Framework
DV 2016: Mission Possible - Building a New Analytics Framework
Tealium
 
Blockchain 101 for Government Officials
Blockchain 101 for Government OfficialsBlockchain 101 for Government Officials
Blockchain 101 for Government Officials
Marquis Cabrera
 
Live Demo: Accelerate the integration of workday applications
Live Demo: Accelerate the integration of workday applicationsLive Demo: Accelerate the integration of workday applications
Live Demo: Accelerate the integration of workday applications
SnapLogic
 
Core Transformation: How Pekin Insurance Modernized Its Systems on AWS - FSI2...
Core Transformation: How Pekin Insurance Modernized Its Systems on AWS - FSI2...Core Transformation: How Pekin Insurance Modernized Its Systems on AWS - FSI2...
Core Transformation: How Pekin Insurance Modernized Its Systems on AWS - FSI2...
Amazon Web Services
 
Dev talks Cluj 2018 : Java in the 21 Century: Are you thinking far enough ahead?
Dev talks Cluj 2018 : Java in the 21 Century: Are you thinking far enough ahead?Dev talks Cluj 2018 : Java in the 21 Century: Are you thinking far enough ahead?
Dev talks Cluj 2018 : Java in the 21 Century: Are you thinking far enough ahead?
Steve Poole
 
DevOps: The Amazon Story
DevOps: The Amazon StoryDevOps: The Amazon Story
DevOps: The Amazon Story
Amazon Web Services
 
Using ELT to load 1 Billion Rows of Data in 15 Minutes
Using ELT to load 1 Billion Rows of Data in 15 MinutesUsing ELT to load 1 Billion Rows of Data in 15 Minutes
Using ELT to load 1 Billion Rows of Data in 15 Minutes
Matillion
 
Using containerization to enable your microservice architecture
Using containerization to enable your microservice architecture Using containerization to enable your microservice architecture
Using containerization to enable your microservice architecture
Apigee | Google Cloud
 
DEV206_Life of a Code Change to a Tier 1 Service
DEV206_Life of a Code Change to a Tier 1 ServiceDEV206_Life of a Code Change to a Tier 1 Service
DEV206_Life of a Code Change to a Tier 1 Service
Amazon Web Services
 

Similar to Security as Code (20)

Cutting Through the Disruption
Cutting Through the DisruptionCutting Through the Disruption
Cutting Through the Disruption
 
Empowering Marketing Solutions Teams
Empowering Marketing Solutions TeamsEmpowering Marketing Solutions Teams
Empowering Marketing Solutions Teams
 
Building a DevOps Team that Isn't Evil
Building a DevOps Team that Isn't EvilBuilding a DevOps Team that Isn't Evil
Building a DevOps Team that Isn't Evil
 
Applied tactics for your transformation
Applied tactics for your transformationApplied tactics for your transformation
Applied tactics for your transformation
 
Continuous Delivery in the Enterprise
Continuous Delivery in the EnterpriseContinuous Delivery in the Enterprise
Continuous Delivery in the Enterprise
 
AWS FSI Symposium 2017 NYC- CTP & Cloud Migration Best Practices
AWS FSI Symposium 2017 NYC- CTP & Cloud Migration Best PracticesAWS FSI Symposium 2017 NYC- CTP & Cloud Migration Best Practices
AWS FSI Symposium 2017 NYC- CTP & Cloud Migration Best Practices
 
5 strategies for enterprise cloud infrastructure success
5 strategies for enterprise cloud infrastructure success5 strategies for enterprise cloud infrastructure success
5 strategies for enterprise cloud infrastructure success
 
Innovating Government: Building a Culture of DevSecOps for Rapid and Secure M...
Innovating Government: Building a Culture of DevSecOps for Rapid and Secure M...Innovating Government: Building a Culture of DevSecOps for Rapid and Secure M...
Innovating Government: Building a Culture of DevSecOps for Rapid and Secure M...
 
SkillsMatter June 2018: Java in the 21st Century: Are You Thinking Far Enough...
SkillsMatter June 2018: Java in the 21st Century: Are You Thinking Far Enough...SkillsMatter June 2018: Java in the 21st Century: Are You Thinking Far Enough...
SkillsMatter June 2018: Java in the 21st Century: Are You Thinking Far Enough...
 
Realizing Hybrid Cloud: Using IBM Bluemix, APIs, and DataPower
Realizing Hybrid Cloud: Using IBM Bluemix, APIs, and DataPowerRealizing Hybrid Cloud: Using IBM Bluemix, APIs, and DataPower
Realizing Hybrid Cloud: Using IBM Bluemix, APIs, and DataPower
 
Marketing in the Age of Mobile
Marketing in the Age of MobileMarketing in the Age of Mobile
Marketing in the Age of Mobile
 
DV 2016: Mission Possible - Building a New Analytics Framework
DV 2016: Mission Possible - Building a New Analytics FrameworkDV 2016: Mission Possible - Building a New Analytics Framework
DV 2016: Mission Possible - Building a New Analytics Framework
 
Blockchain 101 for Government Officials
Blockchain 101 for Government OfficialsBlockchain 101 for Government Officials
Blockchain 101 for Government Officials
 
Live Demo: Accelerate the integration of workday applications
Live Demo: Accelerate the integration of workday applicationsLive Demo: Accelerate the integration of workday applications
Live Demo: Accelerate the integration of workday applications
 
Core Transformation: How Pekin Insurance Modernized Its Systems on AWS - FSI2...
Core Transformation: How Pekin Insurance Modernized Its Systems on AWS - FSI2...Core Transformation: How Pekin Insurance Modernized Its Systems on AWS - FSI2...
Core Transformation: How Pekin Insurance Modernized Its Systems on AWS - FSI2...
 
Dev talks Cluj 2018 : Java in the 21 Century: Are you thinking far enough ahead?
Dev talks Cluj 2018 : Java in the 21 Century: Are you thinking far enough ahead?Dev talks Cluj 2018 : Java in the 21 Century: Are you thinking far enough ahead?
Dev talks Cluj 2018 : Java in the 21 Century: Are you thinking far enough ahead?
 
DevOps: The Amazon Story
DevOps: The Amazon StoryDevOps: The Amazon Story
DevOps: The Amazon Story
 
Using ELT to load 1 Billion Rows of Data in 15 Minutes
Using ELT to load 1 Billion Rows of Data in 15 MinutesUsing ELT to load 1 Billion Rows of Data in 15 Minutes
Using ELT to load 1 Billion Rows of Data in 15 Minutes
 
Using containerization to enable your microservice architecture
Using containerization to enable your microservice architecture Using containerization to enable your microservice architecture
Using containerization to enable your microservice architecture
 
DEV206_Life of a Code Change to a Tier 1 Service
DEV206_Life of a Code Change to a Tier 1 ServiceDEV206_Life of a Code Change to a Tier 1 Service
DEV206_Life of a Code Change to a Tier 1 Service
 

More from DevOps.com

Modernizing on IBM Z Made Easier With Open Source Software
Modernizing on IBM Z Made Easier With Open Source SoftwareModernizing on IBM Z Made Easier With Open Source Software
Modernizing on IBM Z Made Easier With Open Source Software
DevOps.com
 
Comparing Microsoft SQL Server 2019 Performance Across Various Kubernetes Pla...
Comparing Microsoft SQL Server 2019 Performance Across Various Kubernetes Pla...Comparing Microsoft SQL Server 2019 Performance Across Various Kubernetes Pla...
Comparing Microsoft SQL Server 2019 Performance Across Various Kubernetes Pla...
DevOps.com
 
Comparing Microsoft SQL Server 2019 Performance Across Various Kubernetes Pla...
Comparing Microsoft SQL Server 2019 Performance Across Various Kubernetes Pla...Comparing Microsoft SQL Server 2019 Performance Across Various Kubernetes Pla...
Comparing Microsoft SQL Server 2019 Performance Across Various Kubernetes Pla...
DevOps.com
 
Next Generation Vulnerability Assessment Using Datadog and Snyk
Next Generation Vulnerability Assessment Using Datadog and SnykNext Generation Vulnerability Assessment Using Datadog and Snyk
Next Generation Vulnerability Assessment Using Datadog and Snyk
DevOps.com
 
Vulnerability Discovery in the Cloud
Vulnerability Discovery in the CloudVulnerability Discovery in the Cloud
Vulnerability Discovery in the Cloud
DevOps.com
 
2021 Open Source Governance: Top Ten Trends and Predictions
2021 Open Source Governance: Top Ten Trends and Predictions2021 Open Source Governance: Top Ten Trends and Predictions
2021 Open Source Governance: Top Ten Trends and Predictions
DevOps.com
 
A New Year’s Ransomware Resolution
A New Year’s Ransomware ResolutionA New Year’s Ransomware Resolution
A New Year’s Ransomware Resolution
DevOps.com
 
Getting Started with Runtime Security on Azure Kubernetes Service (AKS)
Getting Started with Runtime Security on Azure Kubernetes Service (AKS)Getting Started with Runtime Security on Azure Kubernetes Service (AKS)
Getting Started with Runtime Security on Azure Kubernetes Service (AKS)
DevOps.com
 
Don't Panic! Effective Incident Response
Don't Panic! Effective Incident ResponseDon't Panic! Effective Incident Response
Don't Panic! Effective Incident Response
DevOps.com
 
Creating a Culture of Chaos: Chaos Engineering Is Not Just Tools, It's Culture
Creating a Culture of Chaos: Chaos Engineering Is Not Just Tools, It's CultureCreating a Culture of Chaos: Chaos Engineering Is Not Just Tools, It's Culture
Creating a Culture of Chaos: Chaos Engineering Is Not Just Tools, It's Culture
DevOps.com
 
Role Based Access Controls (RBAC) for SSH and Kubernetes Access with Teleport
Role Based Access Controls (RBAC) for SSH and Kubernetes Access with TeleportRole Based Access Controls (RBAC) for SSH and Kubernetes Access with Teleport
Role Based Access Controls (RBAC) for SSH and Kubernetes Access with Teleport
DevOps.com
 
Monitoring Serverless Applications with Datadog
Monitoring Serverless Applications with DatadogMonitoring Serverless Applications with Datadog
Monitoring Serverless Applications with Datadog
DevOps.com
 
Deliver your App Anywhere … Publicly or Privately
Deliver your App Anywhere … Publicly or PrivatelyDeliver your App Anywhere … Publicly or Privately
Deliver your App Anywhere … Publicly or Privately
DevOps.com
 
Securing medical apps in the age of covid final
Securing medical apps in the age of covid finalSecuring medical apps in the age of covid final
Securing medical apps in the age of covid final
DevOps.com
 
How to Build a Healthy On-Call Culture
How to Build a Healthy On-Call CultureHow to Build a Healthy On-Call Culture
How to Build a Healthy On-Call Culture
DevOps.com
 
The Evolving Role of the Developer in 2021
The Evolving Role of the Developer in 2021The Evolving Role of the Developer in 2021
The Evolving Role of the Developer in 2021
DevOps.com
 
Service Mesh: Two Big Words But Do You Need It?
Service Mesh: Two Big Words But Do You Need It?Service Mesh: Two Big Words But Do You Need It?
Service Mesh: Two Big Words But Do You Need It?
DevOps.com
 
Secure Data Sharing in OpenShift Environments
Secure Data Sharing in OpenShift EnvironmentsSecure Data Sharing in OpenShift Environments
Secure Data Sharing in OpenShift Environments
DevOps.com
 
How to Govern Identities and Access in Cloud Infrastructure: AppsFlyer Case S...
How to Govern Identities and Access in Cloud Infrastructure: AppsFlyer Case S...How to Govern Identities and Access in Cloud Infrastructure: AppsFlyer Case S...
How to Govern Identities and Access in Cloud Infrastructure: AppsFlyer Case S...
DevOps.com
 
Elevate Your Enterprise Python and R AI, ML Software Strategy with Anaconda T...
Elevate Your Enterprise Python and R AI, ML Software Strategy with Anaconda T...Elevate Your Enterprise Python and R AI, ML Software Strategy with Anaconda T...
Elevate Your Enterprise Python and R AI, ML Software Strategy with Anaconda T...
DevOps.com
 

More from DevOps.com (20)

Modernizing on IBM Z Made Easier With Open Source Software
Modernizing on IBM Z Made Easier With Open Source SoftwareModernizing on IBM Z Made Easier With Open Source Software
Modernizing on IBM Z Made Easier With Open Source Software
 
Comparing Microsoft SQL Server 2019 Performance Across Various Kubernetes Pla...
Comparing Microsoft SQL Server 2019 Performance Across Various Kubernetes Pla...Comparing Microsoft SQL Server 2019 Performance Across Various Kubernetes Pla...
Comparing Microsoft SQL Server 2019 Performance Across Various Kubernetes Pla...
 
Comparing Microsoft SQL Server 2019 Performance Across Various Kubernetes Pla...
Comparing Microsoft SQL Server 2019 Performance Across Various Kubernetes Pla...Comparing Microsoft SQL Server 2019 Performance Across Various Kubernetes Pla...
Comparing Microsoft SQL Server 2019 Performance Across Various Kubernetes Pla...
 
Next Generation Vulnerability Assessment Using Datadog and Snyk
Next Generation Vulnerability Assessment Using Datadog and SnykNext Generation Vulnerability Assessment Using Datadog and Snyk
Next Generation Vulnerability Assessment Using Datadog and Snyk
 
Vulnerability Discovery in the Cloud
Vulnerability Discovery in the CloudVulnerability Discovery in the Cloud
Vulnerability Discovery in the Cloud
 
2021 Open Source Governance: Top Ten Trends and Predictions
2021 Open Source Governance: Top Ten Trends and Predictions2021 Open Source Governance: Top Ten Trends and Predictions
2021 Open Source Governance: Top Ten Trends and Predictions
 
A New Year’s Ransomware Resolution
A New Year’s Ransomware ResolutionA New Year’s Ransomware Resolution
A New Year’s Ransomware Resolution
 
Getting Started with Runtime Security on Azure Kubernetes Service (AKS)
Getting Started with Runtime Security on Azure Kubernetes Service (AKS)Getting Started with Runtime Security on Azure Kubernetes Service (AKS)
Getting Started with Runtime Security on Azure Kubernetes Service (AKS)
 
Don't Panic! Effective Incident Response
Don't Panic! Effective Incident ResponseDon't Panic! Effective Incident Response
Don't Panic! Effective Incident Response
 
Creating a Culture of Chaos: Chaos Engineering Is Not Just Tools, It's Culture
Creating a Culture of Chaos: Chaos Engineering Is Not Just Tools, It's CultureCreating a Culture of Chaos: Chaos Engineering Is Not Just Tools, It's Culture
Creating a Culture of Chaos: Chaos Engineering Is Not Just Tools, It's Culture
 
Role Based Access Controls (RBAC) for SSH and Kubernetes Access with Teleport
Role Based Access Controls (RBAC) for SSH and Kubernetes Access with TeleportRole Based Access Controls (RBAC) for SSH and Kubernetes Access with Teleport
Role Based Access Controls (RBAC) for SSH and Kubernetes Access with Teleport
 
Monitoring Serverless Applications with Datadog
Monitoring Serverless Applications with DatadogMonitoring Serverless Applications with Datadog
Monitoring Serverless Applications with Datadog
 
Deliver your App Anywhere … Publicly or Privately
Deliver your App Anywhere … Publicly or PrivatelyDeliver your App Anywhere … Publicly or Privately
Deliver your App Anywhere … Publicly or Privately
 
Securing medical apps in the age of covid final
Securing medical apps in the age of covid finalSecuring medical apps in the age of covid final
Securing medical apps in the age of covid final
 
How to Build a Healthy On-Call Culture
How to Build a Healthy On-Call CultureHow to Build a Healthy On-Call Culture
How to Build a Healthy On-Call Culture
 
The Evolving Role of the Developer in 2021
The Evolving Role of the Developer in 2021The Evolving Role of the Developer in 2021
The Evolving Role of the Developer in 2021
 
Service Mesh: Two Big Words But Do You Need It?
Service Mesh: Two Big Words But Do You Need It?Service Mesh: Two Big Words But Do You Need It?
Service Mesh: Two Big Words But Do You Need It?
 
Secure Data Sharing in OpenShift Environments
Secure Data Sharing in OpenShift EnvironmentsSecure Data Sharing in OpenShift Environments
Secure Data Sharing in OpenShift Environments
 
How to Govern Identities and Access in Cloud Infrastructure: AppsFlyer Case S...
How to Govern Identities and Access in Cloud Infrastructure: AppsFlyer Case S...How to Govern Identities and Access in Cloud Infrastructure: AppsFlyer Case S...
How to Govern Identities and Access in Cloud Infrastructure: AppsFlyer Case S...
 
Elevate Your Enterprise Python and R AI, ML Software Strategy with Anaconda T...
Elevate Your Enterprise Python and R AI, ML Software Strategy with Anaconda T...Elevate Your Enterprise Python and R AI, ML Software Strategy with Anaconda T...
Elevate Your Enterprise Python and R AI, ML Software Strategy with Anaconda T...
 

Recently uploaded

APIs for Browser Automation (MoT Meetup 2024)
APIs for Browser Automation (MoT Meetup 2024)APIs for Browser Automation (MoT Meetup 2024)
APIs for Browser Automation (MoT Meetup 2024)
Boni García
 
Atelier - Innover avec l’IA Générative et les graphes de connaissances
Atelier - Innover avec l’IA Générative et les graphes de connaissancesAtelier - Innover avec l’IA Générative et les graphes de connaissances
Atelier - Innover avec l’IA Générative et les graphes de connaissances
Neo4j
 
A Sighting of filterA in Typelevel Rite of Passage
A Sighting of filterA in Typelevel Rite of PassageA Sighting of filterA in Typelevel Rite of Passage
A Sighting of filterA in Typelevel Rite of Passage
Philip Schwarz
 
Developing Distributed High-performance Computing Capabilities of an Open Sci...
Developing Distributed High-performance Computing Capabilities of an Open Sci...Developing Distributed High-performance Computing Capabilities of an Open Sci...
Developing Distributed High-performance Computing Capabilities of an Open Sci...
Globus
 
Webinar: Salesforce Document Management 2.0 - Smarter, Faster, Better
Webinar: Salesforce Document Management 2.0 - Smarter, Faster, BetterWebinar: Salesforce Document Management 2.0 - Smarter, Faster, Better
Webinar: Salesforce Document Management 2.0 - Smarter, Faster, Better
XfilesPro
 
Vitthal Shirke Microservices Resume Montevideo
Vitthal Shirke Microservices Resume MontevideoVitthal Shirke Microservices Resume Montevideo
Vitthal Shirke Microservices Resume Montevideo
Vitthal Shirke
 
GraphSummit Paris - The art of the possible with Graph Technology
GraphSummit Paris - The art of the possible with Graph TechnologyGraphSummit Paris - The art of the possible with Graph Technology
GraphSummit Paris - The art of the possible with Graph Technology
Neo4j
 
OpenFOAM solver for Helmholtz equation, helmholtzFoam / helmholtzBubbleFoam
OpenFOAM solver for Helmholtz equation, helmholtzFoam / helmholtzBubbleFoamOpenFOAM solver for Helmholtz equation, helmholtzFoam / helmholtzBubbleFoam
OpenFOAM solver for Helmholtz equation, helmholtzFoam / helmholtzBubbleFoam
takuyayamamoto1800
 
First Steps with Globus Compute Multi-User Endpoints
First Steps with Globus Compute Multi-User EndpointsFirst Steps with Globus Compute Multi-User Endpoints
First Steps with Globus Compute Multi-User Endpoints
Globus
 
How Recreation Management Software Can Streamline Your Operations.pptx
How Recreation Management Software Can Streamline Your Operations.pptxHow Recreation Management Software Can Streamline Your Operations.pptx
How Recreation Management Software Can Streamline Your Operations.pptx
wottaspaceseo
 
Dominate Social Media with TubeTrivia AI’s Addictive Quiz Videos.pdf
Dominate Social Media with TubeTrivia AI’s Addictive Quiz Videos.pdfDominate Social Media with TubeTrivia AI’s Addictive Quiz Videos.pdf
Dominate Social Media with TubeTrivia AI’s Addictive Quiz Videos.pdf
AMB-Review
 
Exploring Innovations in Data Repository Solutions - Insights from the U.S. G...
Exploring Innovations in Data Repository Solutions - Insights from the U.S. G...Exploring Innovations in Data Repository Solutions - Insights from the U.S. G...
Exploring Innovations in Data Repository Solutions - Insights from the U.S. G...
Globus
 
AI Pilot Review: The World’s First Virtual Assistant Marketing Suite
AI Pilot Review: The World’s First Virtual Assistant Marketing SuiteAI Pilot Review: The World’s First Virtual Assistant Marketing Suite
AI Pilot Review: The World’s First Virtual Assistant Marketing Suite
Google
 
Climate Science Flows: Enabling Petabyte-Scale Climate Analysis with the Eart...
Climate Science Flows: Enabling Petabyte-Scale Climate Analysis with the Eart...Climate Science Flows: Enabling Petabyte-Scale Climate Analysis with the Eart...
Climate Science Flows: Enabling Petabyte-Scale Climate Analysis with the Eart...
Globus
 
Globus Connect Server Deep Dive - GlobusWorld 2024
Globus Connect Server Deep Dive - GlobusWorld 2024Globus Connect Server Deep Dive - GlobusWorld 2024
Globus Connect Server Deep Dive - GlobusWorld 2024
Globus
 
Lecture 1 Introduction to games development
Lecture 1 Introduction to games developmentLecture 1 Introduction to games development
Lecture 1 Introduction to games development
abdulrafaychaudhry
 
OpenMetadata Community Meeting - 5th June 2024
OpenMetadata Community Meeting - 5th June 2024OpenMetadata Community Meeting - 5th June 2024
OpenMetadata Community Meeting - 5th June 2024
OpenMetadata
 
Automated software refactoring with OpenRewrite and Generative AI.pptx.pdf
Automated software refactoring with OpenRewrite and Generative AI.pptx.pdfAutomated software refactoring with OpenRewrite and Generative AI.pptx.pdf
Automated software refactoring with OpenRewrite and Generative AI.pptx.pdf
timtebeek1
 
GlobusWorld 2024 Opening Keynote session
GlobusWorld 2024 Opening Keynote sessionGlobusWorld 2024 Opening Keynote session
GlobusWorld 2024 Opening Keynote session
Globus
 
Understanding Globus Data Transfers with NetSage
Understanding Globus Data Transfers with NetSageUnderstanding Globus Data Transfers with NetSage
Understanding Globus Data Transfers with NetSage
Globus
 

Recently uploaded (20)

APIs for Browser Automation (MoT Meetup 2024)
APIs for Browser Automation (MoT Meetup 2024)APIs for Browser Automation (MoT Meetup 2024)
APIs for Browser Automation (MoT Meetup 2024)
 
Atelier - Innover avec l’IA Générative et les graphes de connaissances
Atelier - Innover avec l’IA Générative et les graphes de connaissancesAtelier - Innover avec l’IA Générative et les graphes de connaissances
Atelier - Innover avec l’IA Générative et les graphes de connaissances
 
A Sighting of filterA in Typelevel Rite of Passage
A Sighting of filterA in Typelevel Rite of PassageA Sighting of filterA in Typelevel Rite of Passage
A Sighting of filterA in Typelevel Rite of Passage
 
Developing Distributed High-performance Computing Capabilities of an Open Sci...
Developing Distributed High-performance Computing Capabilities of an Open Sci...Developing Distributed High-performance Computing Capabilities of an Open Sci...
Developing Distributed High-performance Computing Capabilities of an Open Sci...
 
Webinar: Salesforce Document Management 2.0 - Smarter, Faster, Better
Webinar: Salesforce Document Management 2.0 - Smarter, Faster, BetterWebinar: Salesforce Document Management 2.0 - Smarter, Faster, Better
Webinar: Salesforce Document Management 2.0 - Smarter, Faster, Better
 
Vitthal Shirke Microservices Resume Montevideo
Vitthal Shirke Microservices Resume MontevideoVitthal Shirke Microservices Resume Montevideo
Vitthal Shirke Microservices Resume Montevideo
 
GraphSummit Paris - The art of the possible with Graph Technology
GraphSummit Paris - The art of the possible with Graph TechnologyGraphSummit Paris - The art of the possible with Graph Technology
GraphSummit Paris - The art of the possible with Graph Technology
 
OpenFOAM solver for Helmholtz equation, helmholtzFoam / helmholtzBubbleFoam
OpenFOAM solver for Helmholtz equation, helmholtzFoam / helmholtzBubbleFoamOpenFOAM solver for Helmholtz equation, helmholtzFoam / helmholtzBubbleFoam
OpenFOAM solver for Helmholtz equation, helmholtzFoam / helmholtzBubbleFoam
 
First Steps with Globus Compute Multi-User Endpoints
First Steps with Globus Compute Multi-User EndpointsFirst Steps with Globus Compute Multi-User Endpoints
First Steps with Globus Compute Multi-User Endpoints
 
How Recreation Management Software Can Streamline Your Operations.pptx
How Recreation Management Software Can Streamline Your Operations.pptxHow Recreation Management Software Can Streamline Your Operations.pptx
How Recreation Management Software Can Streamline Your Operations.pptx
 
Dominate Social Media with TubeTrivia AI’s Addictive Quiz Videos.pdf
Dominate Social Media with TubeTrivia AI’s Addictive Quiz Videos.pdfDominate Social Media with TubeTrivia AI’s Addictive Quiz Videos.pdf
Dominate Social Media with TubeTrivia AI’s Addictive Quiz Videos.pdf
 
Exploring Innovations in Data Repository Solutions - Insights from the U.S. G...
Exploring Innovations in Data Repository Solutions - Insights from the U.S. G...Exploring Innovations in Data Repository Solutions - Insights from the U.S. G...
Exploring Innovations in Data Repository Solutions - Insights from the U.S. G...
 
AI Pilot Review: The World’s First Virtual Assistant Marketing Suite
AI Pilot Review: The World’s First Virtual Assistant Marketing SuiteAI Pilot Review: The World’s First Virtual Assistant Marketing Suite
AI Pilot Review: The World’s First Virtual Assistant Marketing Suite
 
Climate Science Flows: Enabling Petabyte-Scale Climate Analysis with the Eart...
Climate Science Flows: Enabling Petabyte-Scale Climate Analysis with the Eart...Climate Science Flows: Enabling Petabyte-Scale Climate Analysis with the Eart...
Climate Science Flows: Enabling Petabyte-Scale Climate Analysis with the Eart...
 
Globus Connect Server Deep Dive - GlobusWorld 2024
Globus Connect Server Deep Dive - GlobusWorld 2024Globus Connect Server Deep Dive - GlobusWorld 2024
Globus Connect Server Deep Dive - GlobusWorld 2024
 
Lecture 1 Introduction to games development
Lecture 1 Introduction to games developmentLecture 1 Introduction to games development
Lecture 1 Introduction to games development
 
OpenMetadata Community Meeting - 5th June 2024
OpenMetadata Community Meeting - 5th June 2024OpenMetadata Community Meeting - 5th June 2024
OpenMetadata Community Meeting - 5th June 2024
 
Automated software refactoring with OpenRewrite and Generative AI.pptx.pdf
Automated software refactoring with OpenRewrite and Generative AI.pptx.pdfAutomated software refactoring with OpenRewrite and Generative AI.pptx.pdf
Automated software refactoring with OpenRewrite and Generative AI.pptx.pdf
 
GlobusWorld 2024 Opening Keynote session
GlobusWorld 2024 Opening Keynote sessionGlobusWorld 2024 Opening Keynote session
GlobusWorld 2024 Opening Keynote session
 
Understanding Globus Data Transfers with NetSage
Understanding Globus Data Transfers with NetSageUnderstanding Globus Data Transfers with NetSage
Understanding Globus Data Transfers with NetSage
 

Security as Code

  • 1. Copyright © 2016Copyright © 2017 Security as Code How to adopt a cloud native DevOps model without sacrificing security June 29, 2017
  • 2. Copyright © 2016Copyright © 2017 Alan Shimel Editor & Chief at DevOps.com Anthony Johnson Staff Engineer at Ellie Mae John Hutchison Solutions Engineer at Evident.io SPEAKERS
  • 3. Copyright © 2016Copyright © 2017 Automation Compliance Policies Fine-grained Controls Configuration Management Techniques Compliance at Scale AGENDA
  • 4. The Answer is Automation Cloud Platform and Operations Anthony Johnson
  • 5. 6/24/17©2015 Ellie Mae. All rights reserved. 5 Introduction Anthony Johnson Staff Engineer - Cloud Platform Fun Facts • Joined Ellie Mae in May 2016 • Loves to bake bread • Visits Japan every year • Wants to live on Mars Ellie Mae’s north star is to automate everything automatable in the residential mortgage industry. East-Bay Fintech Company Fun Facts • Established in 1997 • 2016 Bay Area Best Places to Work • Processes more than 25% of the mortgages in the US • Public Company (Not a government agency)
  • 6. 6/24/17©2015 Ellie Mae. All rights reserved. 6 History as I know it • Thick client era (TCE) • Hybrid client era (HCE) • Hybrid Cloud era (YEA!) 1997 2011 Established IPO 2016 Cloud Strategy thick client hybrid client hybrid cloud The past really doesn’t matter! 2016 Anthony Joins
  • 7. 6/24/17©2015 Ellie Mae. All rights reserved. 7 Why did Ellie Mae choose Public Cloud Disclaimer: This decision pre-dates me • Stability of internal offering • Scaling of internal offering • Agility of internal offering • cost
  • 8. 6/24/17©2015 Ellie Mae. All rights reserved. 8 Cloud Strategy Pillars • You Build It, You Run It • Least Privilege • Trust but Verify • Automation and Self Healing • Customer Focused/Open Door
  • 9. 6/24/17©2015 Ellie Mae. All rights reserved. 9 You Build It, You Run It, You Pay for it Bold Words! You Build It An Engineering team builds it You Run It The same Engineering team runs it, gets called on it and is accountable You Pay for It Cost is a design variable. We should expose the real costs whenever possible. Bonus if we can expose cost modeling throughout
  • 10. 6/24/17©2015 Ellie Mae. All rights reserved. 10 Least Privilege - Separation of Duties Development, QA, etc Pre-Prod, Prod CI/CD Developers Full Access No PII Data Allowed Developers Read Only No Access to PII Data
  • 11. 6/24/17©2015 Ellie Mae. All rights reserved. 11 Least Privilege - AWS Security Practices • Private and Public Subnets • VPCs are centrally managed • IAM Instance Profiles • User Groups/Roles • Service Users • Security Groups • EC2 Access
  • 12. 6/24/17©2015 Ellie Mae. All rights reserved. 12 Least Privilege - Everything else CI/CD All code is reviewed. Everything is code. Deploy Gates. Network All VPC-to-VPC connectivity goes through a firewall Production Accounts Only the Public Cloud team has privileged access, but Public Cloud accessing it should be an exception, not the norm
  • 13. 6/24/17©2015 Ellie Mae. All rights reserved. 13 Automation and Self Healing • Have a strategy for programmatic creation of common resources • Operations should be idempotent • Avoid CloudFormation for this task
  • 14. 6/24/17©2015 Ellie Mae. All rights reserved. 14 Trust but Verify using Automation Demo
  • 15. 6/24/17©2015 Ellie Mae. All rights reserved. 15 Demo video
  • 16. 6/24/17©2015 Ellie Mae. All rights reserved. 16 Lots of options
  • 17. 6/24/17©2015 Ellie Mae. All rights reserved. 17 Customer Focused/Open Door • Create a wiki page that is for your customers • Functional information only • No implementation details • Know your customers • Know your value • Develop a training strategy early
  • 18. 6/24/17©2015 Ellie Mae. All rights reserved. 18 How to choose your offering? • Look for global optimizations • Find ways to engage with your customers • Adopt a product development attitude • Our team adopted narrative-driven development • Sprints/Epics/Backlogs • Prioritize on business value
  • 20. Copyright © 2016Copyright © 2017 Q&A Session Please submit your questions though the Q&A chat box. @evidentdotio /company/evident-io /evident.io/ sales@evident.io