DevOps iş təhlükəsizliyi sizi maraqlandırır? İstər developer, istər təhlükəsizlik mühəndisi, istərsə də DevOps həvəskarı olun, bu tədbir şəbəkələşmək, biliklərinizi bölüşmək və DevSecOps sahəsində ən son təcrübələri öyrənmək üçün mükəmməl fürsətdir! Bu workshopda DevOps infrastrukturlarının təhlükəsizliyini necə artırmaq barədə danışacayıq. DevOps sistemləri qurularkən avtomatlaşdırılmış, yüksək əlçatan və etibarlı olması ilə yanaşı, həm də təhlükəsizlik məsələləri nəzərə alınmalıdır. Bu səbəbdən, DevOps komandolarının təhlükəsizliyə yönəlmiş praktikalara riayət etməsi vacibdir.

1. Unlocking DevOps
Security
Here is where your presentation begins

2. 01 02
03 04
Table of contents
Kubernetes Security
CI/CD Pipeline
Security
Infrastructure
Security
IAM in DevOps
(Keycloak)

3. Infrastructure security involves
protecting a company's physical
and virtual resources (servers,
network devices, cloud
environments, etc.).
Infrastructure
Security

4. Infrastructure Security
● WAF - Web Application Firewall
● PAM - Privileged Access Management
● Infrastructure as Code (Terraform, Cloudformation, Terrascan)
● NSX Vmware - Network and Security Virtualization
● Configuration Management Tools (Ansible, Saltstack)
● CIS Benchmarks
● Logging of the system (filebeat, winlogbeat)
● Secret Management Tools - (Vault, AWS Secret management )
● Least Privilege Access Implementation, MFA
● Backup and Recovery (Implement backuping system and disaster recovery
plan)

5. Infrastructure Security
WAF (Web Application Firewall) - Protects web applications from variety of
application layer attacks, such as XSS(cross-site-scripting), SQL Injection.

6. Infrastructure Security
PAM (Privileged Access Management) - Security tool for controlling and
monitoring activity of privileged users.
Example: Cyberark PAM, BeyondTrust

7. Infrastructure Security
IaC (Infrastructure as Code)- the ability to provision and support your computing
infrastructure using code instead of manual processes and settings
Example: Terraform, Terrascan

8. VMware NSX | Networking and Security Virtualization
Infrastructure Security

9. Infrastructure Security
Configuration management tools - automate configurations
(storage, networking etc) of servers
Example: Ansible, Saltstack, Chef

10. Infrastructure Security
CIS Benchmarks (Center for Internet Security) - Best practices to implement
security.
Link: https://www.cisecurity.org/cis-benchmarks

11. Infrastructure Security
Logging of the system (Filebeat , Winlogbeat)

12. Infrastructure Security
Secret Management Tools
Example: Vault, AWS Secret Manager

13. Infrastructure Security
Least Privilege Access Management, MFA

14. Infrastructure Security
Backup and Disaster Recovery

15. ● Container Isolation: Namespace () & cgroups ()
● Network Policies (Calico, Cilium, NSX-T)
● RBAC on Kubernetes
● Upgrade Kube cluster
● ETCD encrypted
● Container Sandboxing
● mTLS/ ServiceMeshes - traffic between pods should be encrypted
● OPA - Open Policy Agent
● Falco
● AppArmor, Seccomp
Kubernetes Security

16. Container Isolation: Namespace & cgroups
Namespaces -> Other processes, users, filesystems
Cgroups > RAM, Disk, CPU
Kubernetes Security

17. Network Policies
Kubernetes Security

18. RBAC on Kubernetes
Combinations:
1. Role - Rolebinding → user has permissions in
single namespace
2. ClusterRole - ClusterRoleBinding → user has
same permissions in all namespaces
3. ClusterRole - RoleBinding → user has same
permissions in multiple namespace
Kubernetes Security

19. Upgrading Kubernetes Cluster
Kubernetes Security

20. Encryption at rest - Encrypt ETCD Key-Value DB
Kubernetes Security

21. Container Sandboxing - Kata Containers
Kubernetes Security

22. gVisor
gVisor is also one of the
Sandbox Runtime. It is
user-space kernel for
containers
Kubernetes Security

23. mTLS, Service Mesh
mTLS - mutual TLS
● Mutual authentication
● Two-way (bilateral) authentication
● Two parties authenticating each-other at the
same time
By default in kubernetes every pod can communicate
with each-other and this is done unecrypted
Kubernetes Security

24. OPA - Open Policy Agent
OPA is an open-source, general-purpose policy engine that enables unified, context-aware policy enforcement across the
entire stack.
OPA Gatekeeper
Kubernetes Security

25. Falco
Falco is a cloud native runtime security, it provides deep kernel tracing built on the Linux kernel, it describe security rules against a
system and detect unwanted behavior. Automated respond to a security violations
Kubernetes Security

26. Apparmor
Kubernetes Security
Profile Modes:
Unconfined → Process can escape
Complain → Process can complain but it will
be logged
Enforce → Processes cannot escape

27. seccomp:
Seccomp (Secure Computing
Mode) is a Linux kernel security
feature that restricts the system
calls a process can make,
significantly reducing the
potential attack surface for a
process
Kubernetes Security

28. CI/CD Pipeline
● Gitlab Configuration, Access
Management for Users, Ldap
Authentication, Branch
Protection
● Gitlab SAST, SCA, Defectojot,
Sonarqube, Fortify
● Dependency checks
● Docker Images and Image
Vulnerability Scanning (Trivy,
Clair)

29. CI/CD Pipeline
● Gitlab Configuration
● Access Management for Users
● Ldap Authentication
● Branch Protection
● Do not use Hard Coded Values

30. CI/CD Pipeline
Gitlab SAST, SCA, Fortify SAST/DAST Tool, Defectojo, Vulnerability Report, Sonarqube.

31. CI/CD Pipeline
● Dependency management
● Prevent Supply Chain Attacks
● Use trusted, verified sources for your
dependencies
● Dependencies organize in a file, use
dependency management tools maven, npm
or gradle
● Use centralized artifact repo

32. CI/CD Pipeline
Dockerfile Images:
Reduce image size via applying multi-stage images
Always mention proper version tag for image, do not use
latest. Use specific package version
Do not run as root
Make filesystem read only RUN chmod a-w /etc
→
Remove shell access RUN rm -rf /bin/*
→
Store image in your own private registry

33. CI/CD Pipeline
Image Vulnerability Scanning (Trivy, Clair)
Dive Tool for Image Analysing

34. Keycloak (IAM)
• Authentication & Authorization
(OpenID Connect & OAuth2)
• Single Sign-On (SSO)
• User federation (LDAP, AD.
DB)
• Social Login (Google, Facebook)
• RBAC

35. Keycloak (IAM)
As an Identity Provider in microservices

36. Keycloak (IAM)
Keycloak + Gateway + APP

37. Keycloak Deployment on
Kubernetes
and Integration
APP

38. Thanks!