This document outlines 5 key practices for modern security success in DevSecOps: 1) Cloud & DevSecOps practices, 2) Pre-Commit controls like the "paved road" of secure templates, 3) Commit controls through CI/CD pipelines, 4) Acceptance controls for supply chain security, and 5) Operations controls for continuous security compliance. The presentation provides examples for implementing controls at each stage to integrate security practices into the DevSecOps workflow.
2. Puma Security, LLCPuma Security, LLC 2
• Principal Security Engineer, Puma Security
– Coder: static analysis engine, cloud automation, security tools
– Security assessments: DevSecOps, cloud, source code, web apps, mobile
apps
• DevSecOps Curriculum Manager, SANS Institute
– SANS Certified Instructor
– Contributing author of SEC540, DEV544, and DEV531
• Education & Training
– Iowa State M.S. Information Assurance, B.S. Computer Engineering
– AWS Certified Developer, CISSP, GSSP, GWAPT
• Contact information
– Email: eric.johnson@pumascan.com
– Twitter: @emjohn20
$WHOAMI
3. Puma Security, LLCPuma Security, LLC 3
Agenda
• Keys for Modern
Security Success
1. Cloud & DevSecOps Practices
2. Pre-Commit: The Paved Road
3. Commit: CI / CD Security Controls
4. Acceptance: Supply Chain Security
5. Operations: Continuous Security
Compliance
4. Puma Security, LLCPuma Security, LLC 4
What are the goals and principles in
DevSecOps?
• Make security a first-class problem in
DevOps
• Make security a first-class participant in
DevOps
• Increase trust between dev, ops, and sec
• Integrate security practices and ideas into
DevOps culture
• Wire security into DevOps workflows to
incrementally improve security
SecDevOps / DevSecOps / DevOpsSec / Rugged DevOps
https://memegenerator.net/img/instances/81941458/devsecops.jpg
5. Puma Security, LLCPuma Security, LLC 5
• Cloud Security
Top 10
• Serverless
Security Top 10
• DevSecOps
Toolchain
• Building a
DevSecOps
Program
Secure Cloud & DevOps Practices (https://www.sans.org/u/OGx)
8. Puma Security, LLCPuma Security, LLC 8
Dev, Sec, and Ops teams build secure by
default frameworks, libraries, and services:
• Popularized by Netflix "Gates to
Guardrails"
• Operations: Automated pipelines build,
certify, and publish cloud infrastructure /
machine images
• Development: Secure templates for Web,
APIs, front-end, serverless projects
• Security: Automated security pipeline
scans, unit tests, acceptance tests,
production assertions
Build The Paved Road PRE-COMMIT
http://www.flickr.com/photos/25173673@N03/4785565610/
9. Puma Security, LLCPuma Security, LLC 9
Network, Cloud, Infrastructure as Code templates for quickly
provisioning certified environments for the development team to
use:
• On-premise or cloud hosted virtual machine gold images
• On-premise or cloud hosted container gold images
• Provisioning cloud network infrastructure
• Deploying API gateway appliances for microservices
• Managing Functions as a Service (FaaS)
Operations Paved Road
11. Puma Security, LLCPuma Security, LLC 11
Templates covering approved technology stacks with protection for
common application security issues and misconfigurations:
• Node.js, Django, Spring Boot, .NET Core, Ruby Rails, Functions,
etc.
• Secrets management storage
• Secure transport configuration (HTTPS)
• Enable authentication / authorization
• Configure password management / single sign on
• Include common libraries for data validation, logging, encoding,
etc.
Development Paved Road
14. Puma Security, LLCPuma Security, LLC
• Integrate tools to automate build, test, acceptance, and
deployment of infrastructure, cloud, and applications into a
repeatable workflow:
Continuous Integration & Delivery Security Controls COMMIT (CI)
14
15. Puma Security, LLCPuma Security, LLC
• Merging new features requires approval from peers and security
team prior to triggering the build pipeline:
CI / CD Security Controls: Version Control
15
16. Puma Security, LLCPuma Security, LLC
• Approved merge request triggers automated unit tests, security
scans, audit reports, and fast feedback:
CI / CD Security Controls: Acceptance Testing
16
17. Puma Security, LLCPuma Security, LLC
• Build pipelines contain artifacts from security scans and
compliance checks:
CI / CD Security Controls: Audit Reports
17
19. Puma Security, LLCPuma Security, LLC 19
Serious vulnerabilities can be inherited from open
source libraries, docker images, infrastructure
templates, and serverless functions:
• Carefully review content before usage
• Run tools to automatically the scan code base /
images
• Identify external dependencies
• Check against public vulnerability database(s)
• Integrate supply chain security scanning into
CI/CD
• WARNING: Some tools may not check
transitive dependencies
Supply Chain Security
23. Puma Security, LLCPuma Security, LLC 23
• Invoking an Anchore image scan and capturing vulnerability data
in a Jenkins CI pipeline:
Supply Chain Security: Container Image Scanning Example
24. Puma Security, LLCPuma Security, LLC 24
Hardened infrastructure templates can be used as references:
• DevSec Hardening Templates
— Automated hardening framework using Puppet, Chef, Ansible
— Linux, Windows, SSH, Docker, K8S, Apache, Nginx
— https://github.com/dev-sec
• System Integrity Management Platform (SIMP)
— Hardened Puppet infrastructure configuration and testing
— NIST 800-53, DISA STIG, FIPS 140-2 RHEL & CentOS templates
— https://github.com/simp/
Supply Chain Security: Hardened Infrastructure Templates
INFRASTRUCTURE AS
CODE
ACCEPTANCE
25. Puma Security, LLCPuma Security, LLC
Managing function dependencies in AWS Lambda can
be achieved using Layers:
• Build pipelines remove third-party libraries from
deployment packages
• CloudOps manages centralized layers containing
approved third-party libraries
• Third-party vendors are leveraging Layers to
further harden function runtime environments:
— PureSec FunctionShield
— Twistlock Defender
Supply Chain Security: FaaS Dependency Management
Lambda function
Layer
Layer
Execution
Environment
25
27. Puma Security, LLCPuma Security, LLC 27
Leveraging security configuration tools to automate audit
and compliance checks:
• Test the server and infrastructure configuration against
expected baseline and report any deviations
• Tests should include severity, risk level, and description
information
• Match tests against compliance checklist items or
regulatory policies
• Automated testing tools available for Linux, Unix,
Windows, AWS, Azure and VMWare
Continuous Security Compliance
PRODUCTION
29. Puma Security, LLC 29Puma Security, LLC 29
Running InSpec against a running Docker container:
Example InSpec output results from the Linux baseline profile:
1
2
$ docker run -it --rm -v $(pwd):/share chef/inspec exec baseline -t
docker://container_id
Continuous Security Compliance: InSpec Docker Scan
1
2
3
4
5
6
7
8
9
✅ os-01: Trusted hosts login
✅☑︎ Command find / -name '.rhosts' stdout should be empty
✅ Command find / -name 'hosts.equiv' stdout should be empty
X os-02: Check owner and permissions for /etc/shadow (1 failed)
✅ File /etc/shadow should exist
✅ File /etc/shadow should be file
✅ File /etc/shadow should be owned by "root"
✅ File /etc/shadow should not be executable
X File /etc/shadow group should eq nil
30. Puma Security, LLCPuma Security, LLC 30
• Exporting InSpec results to JUnit format and integrating with
Jenkins CI:
Continuous Security Compliance: Jenkins InSpec Integration
32. Puma Security, LLCPuma Security, LLC Puma Security, LLC | 2019 32
Thank you for
attending!• Keys for Modern
Security Success
S U M M A R Y
1. Cloud & DevSecOps Practices
2. Pre-Commit: The Paved Road
3. Commit: CI / CD Security Controls
4. Acceptance: Supply Chain Security
5. Operations: Continuous Security
Compliance
Contact Information:
• eric.johnson@pumascan.com
• @emjohn20
Editor's Notes
10 years in corporate America, large FI. Dev ---> AppSec risk assessment / audits. Co-founder of Puma Security, where we focus on modern static analysis, DevSecOps automation, secure development lifecycle consulting, cloud security assessments. Many of the real life experiences and war stories from our endeavors led to me co-authoring SEC540 with Jim Bird, Frank Kim, Ben Allen a modern Cloud Security and DevSecOps Automation course.
Goals for today is to introduce you to the phases of DevSecOps, and discuss what I believe to be the key security controls in DevSecOps.
DevSecOps means different things to folks working in different disciplines of InfoSec. DevOps itself originates from a software development methodology to support the speed of Agile by delivering changes out to the real world faster, rather than letting them build up over time. Toolchain relies heavily on dev tools, source control (git), CI (Jenkins), Cloud (Infrastructure / Services) historically used only by development teams.
- For this reason, Application security folks (OWASP junkies) will say that DevSecOps == AppSec. As a whole, DevSecOps is much bigger than Dev & AppSec.
- Operations: Infrastructure as Code allows us to rapidly build and provision on-premise and cloud networks. Network Security teams can leverage DevSecOps to automate network scans, look for anomalies in traffic, provision network device configuration of firewalls, switches, routers, etc. ALL in code through CI / CD.
- SOC / IR: Chris Rothe from Red Canary - Writing AV signatures, detectors in yaml / Ruby DSL test cases and automatically running acceptance testing with Rspec.
Forensics: Student took our 540 class, and after 4 days of watching pipelines build apps, containers, cloud infrastructure, suddenly light bulb came on
Overall, DevSecOps is a methodology with massive support from the open source community.
Free resource created by the SEC540 authors, link is on the slide. Eric, Ben Allen, Jim Bird, Frank, Ben Hagen, Ory Segal from PureSec.
The First Key To Modern Security success: Build The Paved Road. Things that we can do before code is written.
The Netflix devsecops journey is very mature at this point & is well documented on their github repositories, white papers, presentations at AWS RE:Invent. Success stories from Facebook, Twitter, Etsy, and other early DevSecOps adopters all include this paved road concept. Here's key #1 to modern security success:
Iteration Zero builds a paved road template for engineers to start with. Take the up front time to build a repeatable, code-driven template for the long haul.
Operations creates ansible / terraform scripts for building the gold images / container base images / networks for hosting the development stack.
Development - creating a scaffoldoing template with approved packages for crypto, validation, authN, authZ, etc. pre-configured. File -> New -> Web API project.
Security - Pipelines for continuously assessing DSC of the cloud, running unit tests, acceptance tests. Checking for high risk code changes.
Infrastructure as Code to build gold images -> Vagrant for acceptance testing a temporary vm, and packer to export the image to VMWare, AWS, GCP, or Azure VMs.
Dockerfile to private container registries holding gold docker images.
Terraform / CloudFormation / Puppet to build cloud infrastructure with secure by default FaaS, api gateways, VPC networks, etc.
CVE-2019-5736: Example of patching runc - Malicious container escape -. Patching AMI and redeploying infrastructure.
Learn to love these tools. Automate all of the things. No tool is worth purchasing if the API does not support everything that you can do from the user interface. Jenkins, Azure DevOps, Team City, Circle CI.
Interesting notes from class: Forensics pipelines, pen testing pipelines (app sec pipeline), audit pipelines, copy editing SANS materials.
High risk code reviews, comments, tracking requirements down to a single line of code that was modified to address the requirement.
cfn-nag - security scanner against the templates. Puppet-lint-security, terrascan, custom security tests, high risk code checks.
Auditing evidence for compliance. Look, we ran our security scanner, results were clean on each build. The cloud infrastructure meets the AWS CIS Benchmark.
In my opinion, largest problem facing InfoSec today. SANS DevSecOps survey: 80% code we didn't write.
App side - nuget, maven, npm not new issues.
What is new - gold images can be downloaded from the chef supermarket, puppet forge, and aws marketplace. Docker images.
Taking a step further - aws waf marketplace download firewall rules. Or Serverless app repository to install and execute serverless functions.
Audit / compliance / security start managing desired state config smoke tests after deployments.