Vulnerability Testing in the Cloud by dint of DevSecOps
- 1. Vulnerability Testing in the Cloud by dint of DevSecOps Owen Byrne Cisco dCloud obyrne@cisco.com https://www.linkedin.com/in/owen-byrne/ @owbyrne devopsdays Galway 2017
- 3. Enabled by some great OpenSource tools…
- 4. Cloud ‘Authorisation to Operate’ (CATO)
- 5. Conundrum
- 6. Security? Not my job!
- 7. • CD model means deployed code is constantly changing • Security Tools vary in: • Skill level to operate (developer friendly, automation possible?) • Coverage (gaps & detection – false positives/negatives) • Varied output formats (JSON, XML, Unstructured, But…Security Testing is Hard
- 10. • Ability to plug in new, home-grown tests & 3rd party tools quickly • Docker images containing preconfigured tools to scan for a specific type of vulnerability Containerised Security Tests
- 11. How Norad Works Cust omer Cl oud NORAD Cisco Confidential
- 14. Python (boto) AWS CLIAWS Console Powershell Tools Cloud Module Cloudformation BUT…many other ways to create Infra… AutoScaling
- 15. “You can think of CloudWatch Events as the central nervous system for your AWS environment. It is wired in to every nook and cranny of the supported services, and becomes aware of operational changes as they happen. Then, driven by your rules, it activates functions and sends messages (activating muscles, if you will) to respond to the environment, making changes, capturing state information, or taking corrective action.” AWS CloudWatch Events
- 16. “AWS Lambda is a compute service that lets you run code without provisioning or managing servers” “…use AWS Lambda to run your code in response to events” AWS Lambda
- 18. Continuous Compliance with Lambda Based on: https://github.com/awslabs/aws-security- benchmark Config Check Rule evaluated every 24hours
- 19. When SecOps show up to the meeting http://devopsreactions.tumblr.com/post/142837211682/when-secops-shows-up-to-the-meeting
- 20. Thank You!