The Science of Compliance

The Science of Compliance
Early Code to Secure your Node
judy johnson
Software Engineer
Onyx Point
@miz_j

The Science of Compliance judy johnson Twitter: @miz_j GitHub: judyj Agile + DevOps Virtual Summit
Today’s Agenda
● A little about DevOps and a little about baking
● Compliance vs Security
● Why We need Compliance
● Why We need Automation
● How you know you are Compliant
● My ideal DevSecOps Process
● Compliance In Dev, Test, and Production
● Tools
● Recipe!
2

● Programming since middle school when my Dad brought home a PDP-8
● Software engineer for [many] years
● Various job titles: Software Engineer, Systems Engineer, Project
Manager, ScrumMaster, and a CD Store Clerk
● Working at Onyx Point since 2015 (note: opinions here are my own)
● Interests - baking, hockey, rock concerts, reading, volunteering
(especially in events that promote diversity in tech)
● Greatest Accomplishment - two amazing daughters - both engineers
About the Speaker
3

So… why is DevOps so important to me?
● Cooperation
● Communication
● Retrospection
● Repeatability/Consistency
● Efﬁciency
● Automation
© 123RF
4

● Fun activity with family and friends
● Stress relief
● Enables creativity
● Makes people happy
● “Practice makes perfect”
● Makes a great analogy to continue through
this talk...
...and why is baking so important to me?
5

The DevOps Cycle
6

The Baking Cycle
7

“DevSecOps means thinking about application
and infrastructure security from the start. It also
means automating some security gates to keep
the DevOps workflow from slowing down.
However, effective DevOps security requires
more than new tools—it builds on the cultural
changes of DevOps to integrate the work of
security teams sooner rather than later.”
(from Red Hat)
What is DevSecOps?
8

...what does the “Sec” in the middle mean to me?
● “In high-performing organizations, everyone within the team shares a
common goal - quality, availability, and security aren’t the responsibility of
individual departments, but are a part of everyone’s job, every day.” - Gene
Kim
● Of course security should be part of continuous improvement
● But is the “Sec” necessary, or implied?
DevSecCodeTestRunDeployMLEtcOps
9

Security vs Compliance (wiki)
Security is freedom from, or resilience against, potential harm (or other unwanted coercive change)
caused by others. Beneﬁciaries (technically referents) of security may be of persons and social groups,
objects and institutions, ecosystems or any other entity or phenomenon vulnerable to unwanted change.
In general, compliance means conforming to a rule, such as a speciﬁcation, policy, standard or law.
Regulatory compliance describes the goal that organizations aspire to achieve in their efforts to ensure
that they are aware of and take steps to comply with relevant laws, policies, and regulations.[1]
Due to the
increasing number of regulations and need for operational transparency, organizations are increasingly
adopting the use of consolidated and harmonized sets of compliance controls.[2]
This approach is used to
ensure that all necessary governance requirements can be met without the unnecessary duplication of
effort and activity from resources.
10

PROVABLE DISPROVABLE
SECURITY X ✔
COMPLIANCE ✔ ✔
● Compliance - enforcing a deﬁned/testable set of rules
● Security - ensuring that your system is not vulnerable
● Both are attempts to minimize risk
Security vs Compliance
11

© NIST
Risk Management Framework
12

● Compliance is following the recipe
● Correct controls (temperature, measurement, etc),
create consistent, predictable product
● A “typo” or incident could ruin your product
● Substitutions - are they valid?
● Mistake? Learn and document
● Minimizing Risk - Follow instructions, Document
anomalies
Baking and Compliance
13

● Improve Security
● Implement security concepts in a provable way
● Maintain Trust/Integrity
● Add transparency
● Maintain Consistency (process management)
● Maintain Control
● Risk Management
Why do we need compliance?
14

Reasons we need to start compliance earlier
● Doing work up-front saves time later
● Awareness of compliance early-on
● Creates a culture of security
● Early insertion of tools allows for continuous monitoring even during
development, shortening the feedback loop
● Compliance resources are available earlier in the process
● Fixes and updates can be made earlier and cheaper
● Reduces the risk of problems when adding new code/tools
● Have you ever tried to put the chocolate chips in the cookies when they were
done?
15

...and baking…
● Know the requirements
○ Read the recipe ﬁrst
○ Ensure you have all the ingredients
before you start
● Consistent infrastructure
○ Preheated oven ensures
temperature stability
○ Ensure you have appropriate
measuring devices
16

Reasons we need to Automate Compliance
● An compliant infrastructure allows for simpler development and
maintenance
● Compliance is consistently applied
● Modularizing code increases ability and speed of updating
● Code is easily shareable - tools can be put into CM (Git, etc) and
reused in multiple places (with access to the most current tools)
● Reporting is more accurate and more timely (audit trail)
● Open collaboration creates continued transparency
● “Simplify and Optimize”
17

Reasons people are hesitant (and replies)
● People believe that it is a huge time investment (it is, but will be worth it
later)
● Making large changes in processes is risky (no more risky than using a
non-compliant system)
● People feel that it is not necessary to train application developers on security
and compliance (of course it is!)
● “We’ve always done it that way…” (sigh.)
18

Typical Process - Old School
● Requirements Created
● Code Written
● Code Reviewed and Tested
● Security Team runs Tests
● An action plan may be written
● Code is rewritten/re-reviewed/re-tested
● New requirements - do we learn from mistakes? © 123RF
19

Ideal Process
● Code and Compliance Requirements Created
● Compliance & Code Written simultaneously
● Compliance code shared/reused
● Compliance tickets reside with target (application) code tickets
● ALL Code Reviewed and Tested Continuously
● ALL Code is rewritten/re-reviewed/re-tested
20

How do you know you are Compliant?
● Out-of-the-box testing tools based on a speciﬁc set of rules (e.g.Nessus,
OpenScap, OVAL)
● Toolkits to test compliance status - more flexible (e.g. InSpec, ServerSpec)
● Manual tests
● Compliance tests from scratch
● Logs!
21

● Did your cake rise?
● Were your cookies the right consistency?
● Were your “auditors” - (friends, family,
co-workers) satisﬁed with the product?
● Is the kitchen on ﬁre?
How do you know you are Recipe Compliant?
© 123RF
22

How we bake it in...
23

Hardening your O/S
● Hardening begins with O/S
● Non-compliant code will be exposed early
● Dev/Test platforms have the same rules as target platforms
● Compliance issues and ﬁxes are found early and shared early
● Using an automated provisioning system such as Puppet, Ansible, Chef, or
SaltStack will allow you to start immediately
● Items such as disk and data encryption, which are hard to add later, are set early
● Customize and standardize features such as open ports, ciphers, allowable tools
24

Ensuring your Dev systems are Compliant
● Eliminate some of the threats immediately via O/S
○ e.g. ports, encryption
○ Keep up with O/S patches
● Ensure development and test tools are known to be compliant
● Do not change O/S settings as you develop (or clean up after yourself)
● Create a compliance baseline
25

Ensuring Compliance is part of Testing
● Testing framework and platform (CI)
○ Test under varying conditions
○ Test all components together
● Last chance to catch issues before code goes live
● Read Logs!
26

Adding Compliance to Testing
● Acceptance tests - Beaker (Litmus)/VM/Container tests
● Chef’s Inspec
● Manual testing
● Static code analysis tools
● Dynamic code analysis tools
● Use the tools you have!
27

● Passing once is not enough
● Ensure that your automated tests (spec, acceptance, integration) run with
every check-in and/or periodically
Compliance Testing in CI
© 123RF
28

Check out this video - applies to both CI and cooking!
( https://www.youtube.com/watch?v=rfROcNPsb3w )
29
Continuous testing of your recipe

30

Ensuring your Production Systems Stay Compliant
● Your production environment is open
to threats
● “Chaos Monkey”-like tools randomly
test for various issues
● Canary deployments and feature flags
(start with a small sample)
● Logs! Logs! Logs!
31

What to look out for
● Ensure that the “deﬁnition of done” or goals of the compliance code are
deﬁned up front (a “single source of truth”)
● Ensure developers/security/sysadmins are communicating goals and
practices to avoid redundancy and allow for reuse
32

Tools
● Many tools are available, and it is important that your organization evaluates
the tools they already have, and do thorough “analysis of alternatives” to
ensure that tools are selected and used appropriately
33

Tools for Consistency / Correction
Compliance
● Puppet, Salt, Ansible, Chef
● Any programming language, script
● CI
● Manual fix
Ensure fixes are documented and remain in the
process
Recipe
● Cake mix (customize within
constraints)
● Pre-mixed spices
● Frosting to cover up any goofs
● Salt ;-)
Ensure the fix is noted for next time
© 123RF © Paul Prudhomme
34

Sample Commercial Tools - Development Stages
● SCA – Software Composition Analysis - Dependency Check, Blackduck,
NexusIQ, SourceClear, Whitesource
● SAST - Static Application Security Testing (White Box Testing) [Source Code
Check] – SonarQube, Veracode, Checkmarx, Coverity, Fortify, and
language-speciﬁc tools Brakeman (Ruby), Bandit (Python)
● DAST - Dynamic Application Security Testing (Black Box Testing) [running
app] - Burp, Zap, Sn1per, Nikto, WebInspect, AppScan, Acunetix, Netsparker
(thanks, Thaddeus @thaddeuswalsh)
35

Other types of tools
● Infrastructure Vulnerability Management – Tenable, Qualys, Rapid7, OpenVAS
● Container – Clair, Trivy, Aqua, Twistlock
● Cloud - Prowler (AWS assessment tool)
● Database scanner - SQLmap (open source SQL Injection and db takeover tool),
(tool listings thanks to
Thaddeus @thaddeuswalsh)
36

● Puppet
○ Ensures your setup remains solid by running every
30 minutes (or predetermined)
● Cron job or CI tool
○ Can recheck and reset if there is an issue
● Ensure that reoccurring issues are documented and
addressed
OK, it’s passed all the tests, and I’ve deployed...
37

My baking slide (1)
Carrot Cake
● 1 1/2 cups corn oil
● 2 cups sugar (not salt :) )
● 3 eggs
● 2 cups flour
● 1 1/2 teaspoons cinnamon
● 2 teaspoons baking soda
● 2 teaspoons vanilla
● 1/2 teaspoon salt (not sugar :) )
● 2 cups grated carrots
● 1 cup chopped walnuts
Combine all ingredients.
Pour in greased 13" x 9" pan.
Bake at 350 for 45 minutes.
Cool, frost.
● Carrot cake is one of my favorites!
● Vegetables and security - necessary evils
to some
● Carrot - a vegetable and unexpected - are
baked in, yet the cake is sweet and moist
38

● Imagine the frosting as your app.
● Solid base - add your personal touch
● Ensure that you do not alter the
foundation that the cake has created
when you personalize it
Cream Cheese Frosting
● 3 oz cream cheese
● 1 2/3 cups confectioners sugar
● 1/8 teaspoon salt
● 1 teaspoon vanilla
Combine all ingredients. Beat until creamy.
Spread on cake.
My baking slide (2)
39

● A secure O/S on development and all other platforms allows you to start with an advantage
● Compliance testing can - and should - be done at all stages of your CI
● Watch your test tool - there can be false positives as well as false negatives
● A tool such as Puppet or Cron can run (or run scripts) at regular time increments to check
your compliance, and alert you if something needs correction
● Correction can be done with an automated tool or manually
● Ensure that security is integrated into your team and process
● Create a Culture of Security
● No matter what you are creating, remember to bake in the goodness!
Summary...
40

Thanks!
To co-workers who teach me every day, and
peer review my code, documents, and
cookies… to family and friends who inspire
me daily… to the friends who helped me put
this together and make it pretty
Never stop learning – and make sure you
have time to spend on things you enjoy!
https://unsplash.com/ and
https://www.123rf.com/ (for photos)
Thanks!
41

The Science of Compliance

Recommended

Recommended

More Related Content

What's hot

What's hot (17)

Similar to The Science of Compliance

Similar to The Science of Compliance (20)

Recently uploaded

Recently uploaded (20)

The Science of Compliance