Often times, developers and auditors can be at odds. The agile, fast-moving environments that developers enjoy will typically give auditors heartburn. The more controlled and stable environments that auditors prefer to demonstrate and maintain compliance are traditionally not friendly to developers or innovation. We'll walk through how Netflix moved its PCI and SOX environments to the cloud and how we were able to leverage the benefits of the cloud and agile development to satisfy both auditors and developers.

1. Splitting the Check on
Compliance and Security

2. Splitting the Check on
Compliance and Security
Jason Chan
Engineering Director – Cloud Security
@chanjbs

3. 2015 for Developers

4. 2015 for Auditors and Security Teams

5. The Problem

6. Developers:
Incentives
• Speed
• Features
Want
• Freedom to innovate
• New technology
Incentives and Perspectives
Auditors:
Incentives
• Compliance with regulatory
obligations
• Verifiable processes
Want
• Well-known technology
• Predictability and stability

7. The Resolution

8. “You build it, you run
it.”
-Werner Vogels, Amazon CTO
(June 2006)

9. Who Cares About These Answers?
• When did that code change?
• Who made the change?
• Who logged in to that host?
• What did they do?
• Who pushed that code?
• When was this dependency
introduced?
• Was that build tested before
deployment?
• What were the test results?
?

10. Before
Developers and Auditors
After
AuditorDev
Auditor
Dev

11. How Do We Get There?

12. Two Approaches to Compliance

13. Pillars for Effective, Efficient, and
Flexible Compliance

14. The Pillars
1. Traceability in development
2. Continuous security visibility
3. Compartmentalization

15. Discussion Format

16. Traceability in Development

17. Common Audit Requirements for
Software Development
• Review changes.
• Track changes.
• Test changes.
• Deploy only approved code.
• For all actions:
• Who did it?
• When?

18. Spinnaker for Continuous Deployment
• Customizable development
pipelines (workflows)
• Based on team
requirements
• Single interface to entire
deployment process
• Answers who, what, when,
and why
• For developers and
auditors
Auditor
Dev

19. Spinnaker: Compliance-Relevant Features
• Integrated access to development artifacts
• Pull requests, test results, build artifacts, etc.
• Push authorization
• Restricted deployment windows (time, region)
• Deployment notifications

20. Spinnaker: App-Centric View & Multistage Pipeline
Multiple deployment stagesAutomated
Manual
Failed test, do not proceed
Application-specific components
Link to build (Jenkins CI),
code changes (Stash)

21. Automated Canary Analysis
Canary test score
Link to details
Result

22. Manual Approval (Optional)

23. Restricted Deployment Window (Optional)

24. Restricted Deployment Window (Optional)

25. Deployment Notification (Optional)

26. Spinnaker vs. Manual Deployments
• Deployment is independent of languages and other
underlying technology.
• Java, Python, Linux, Windows…
• Multiple stages of automated testing.
• Integration, security, functional, production canary.
• Fully traceable pipeline.
• Changes and change drivers are fully visible.
• All artifacts and test results available.

27. Control Mapping
Control Description
PCI 6.3.2 Perform code reviews prior to release.
PCI 6.4.5 Test changes to verify no adverse security impact.
COBIT BAI03.08 Execute solution testing.

28. Continuous Security Visibility

29. Issues with Application Security Risk Management
• Spreadsheets and surveys!
• Human driven.
• Presuppose managed
intake.
• One-time vs. continuous.

31. Penguin Shortbread – Automated Risk Analysis for
Microservice Architectures
• Analyze microservice
connectivity.
• Passively monitor app and
cloud configuration.
• Develop risk scoring based
on observations.

32. Application Risk Metric
Metric summary
Metric algorithm
Scoring

33. Application Risk Rollup
Metrics
Risk metrics by region/environment

34. Control Mapping
Control Description
PCI 1.2.1 Restrict traffic to that which is necessary.
PCI 12.2 Implement a risk-assessment process.
APO 12.03 Maintain a risk profile.

35. Compartmentalization

36. Compartmentalization
Resilience: Limit blast radius Confidentiality: Need to know

37. User Payments
application
Payment
processors
and
partners
Encrypted credit
card database
Name Encrypted CC
John Doe XXXXXXXXXX
HSM
Monolithic Card Processing in the Data Center
Sign up/change CC
Store/retrieve CC
Real-time/batch
auth
Tax, analytics,
fraud, etc.
Web server

38. Microservices and Tokenization in AWS
CloudHSM
Payment
application
Token
service
Token db
Token Encrypted CC
abc123 XXXXXXXXXXCrypto
proxy
Name Token
John Doe abc123
Payments db
Token vault
User
Sign up/change CC
Web server

39. Control Mapping
Control Description
PCI 2.2 Implement one primary function per server.
DSS05.02 Manage network and connectivity security.
DSS05.03 Manage endpoint security.

40. Wrapping Up!
• Limit investments in
approaches that meet
narrow regulatory needs.
• Embrace core security
design and operational
principles.
• Focus on tools and
techniques that serve
multiple audiences. Auditor
Dev

41. Thank you!
@chanjbs - chan@netflix.com