Practical DevSecOps - How to Continuosly Adapt to Threats_AWSPSSummit_Singapore
•
0 gefällt mir•388 views
Own Your AWS
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Ähnlich wie Practical DevSecOps - How to Continuosly Adapt to Threats_AWSPSSummit_Singapore
Ähnlich wie Practical DevSecOps - How to Continuosly Adapt to Threats_AWSPSSummit_Singapore (20)
Mehr von Amazon Web Services
Mehr von Amazon Web Services (20)
Practical DevSecOps - How to Continuosly Adapt to Threats_AWSPSSummit_Singapore
- 1. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved. Paul Hidalgo Solutions Architect, Trend Micro Practical DevSecOps: How to Continuously Adapt to Threats
- 3. Lack of SecOps agility • Slow threat assessments • Can’t patch fast enough • Reactive security posture • Slow to onboard new customers • Hard to practice true DevOps • Outpaced by disruptors • Rogue dev projects Lack of business agility
- 5. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. DevOps is the combination of cultural philosophies, practices, and tools that increases an organization’s ability to deliver applications and services at high velocity
- 6. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. DevOps is not a process change, nor a tool; it’s a culture change
- 8. 1 Cloud Birth 2 Cloud Chaos 3 Hybrid Groove Security Decision Making Security & Compliance Posture Operational Cost
- 9. Dev Run stuff Break stuff Architecture review PII compliance Standards conformance Walkthroughs Code development Code validation Test case development Design review Unit test Installation guidelines Load and stress test Documentation Performance verification System test Function/component test Buffer overflow risk assessment Foot printing Mobile readiness User interface design Resource consumption metrics Scalability Web- readiness Help file construction Lock out users SDLC Budget Staffing Skills development Ops How Development Sees Operations
- 10. Job 1 is Deploying code Quickly use new technologies Ability to deploy regardless of platform Freedom! How developers click
- 11. Service Level Agreements Dev Write code Test some ITIL Compliance Power consumption IT Service Desk Metrics Site security Acquisition and procurement Network configuration High availability COBIT Alignment Business Continuity Planning Backup/recovery strategy Web security Storage consumption Equipment upgrade/retirement Vendor certification Change Review Board Network bandwidth forecasting Intrusion prevention/detectionFallback/roll forward Patching Identity and Access Management Virtual machine management Space planning Skills development Legacy environment support Containers Cloud migration strategy ITIL Compliance Organizational design BYOD Security Third-party risk management Budget and funding Cost recovery/chargeback Ops How Operations Sees Development
- 12. Reduce Surprises Standards and control everywhere Controlled changes Less regulatory pressure What helps security teams sleep
- 13. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. How do we use that philosophy in improving your security posture?
- 14. Micro segmentation and flow visibility Detection and response Cloud security posture management Automated security scanning Cloud access security broker Software-defined perimeter Privileged account management Active anti- phishing Application control on server workloads CARTA-inspired vulnerability management Source: Gartner (June 2018) Gartner Top 10 Security Projects for 2018
- 16. Security Events in Monitoring: Influencing Design Automatic Remediation Automatic Isolation Heal configuration Drift Automated Auditing
- 17. Securing Code and using Code Secure Coding Practices Proactive controls enforce by code Using code to build infrastructure
- 18. Build Checking Scan for Vulnerabilities or Malware Enable Secrets Management Configuration Scrubbing
- 19. Deployment Security Continuous Vulnerability Scanning Automated deployment of Approved Images Just in time server access
- 20. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Example: Managing Vulnerabilities and Malware in Containers
- 21. Challenge: How can you verify that containers deployed in production do not contain any known malware or vulnerabilities?
- 22. Jenkins
- 23. Completed Build
- 24. Failed Build.. But why?
- 25. Malware Found in the APIs
- 27. Check Scans
- 28. Scan Details
- 29. Find where Vulnerability was introduced Vulnerable Package Installed
- 30. Find where malware was introduced Malware Copied
- 31. Easily Reference in Dockerfile Malware Copied Vulnerable Package Installed
- 33. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Example: Automated Policy Assignment
- 34. Challenge: Your security team implemented Amazon GuardDuty. How do you know that your instances are protected from attacks?
- 37. IPS is Turned on but no Rules Applied No Rules
- 38. GuardDuty detects an event Attack Type
- 39. AWS Lambda Function triggered by GuardDuty
- 40. Scan for Integrity and Recommendations Triggered Scan Initiated
- 42. Alerts on Slack
- 44. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Example: Virtual Patching
- 45. Challenge: Average Patching time for customers is 176 Days, How would you protect your containers when zero day strikes
- 52. Virtual Patching applied Runs on Docker Rules Applied
- 55. Event View Attack type and CVE
- 56. Details of the Attack Attack String
- 57. Alerts on Slack
- 60. Key Takeaways Start Small Study Secure Frameworks in building apps Security team has to learn some coding DevOps is very powerful, use it for security Don’t be afraid ~ integrate
- 61. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Nothing is Permanent and Nothing is Perfect
- 62. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Thank You