Here are the slides from Beth Cornils & Verne Lindner's PuppetConf 2016 presentation called How We Are Helping You When Everything is Burning. Watch the videos at https://www.youtube.com/playlist?list=PLV86BgbREluVjwwt-9UL8u2Uy8xnzpIqa

1. Security Roadmap:
How we are helping you when
everything is burning
Verne Lindner and Beth Cornils, PuppetConf 2016

2. Who are we?
● @vernelindner @bethpdx
● Sr. UX Architect at Puppet
● Sr. Product Manager at Puppet
2

3. 3

4. Why are we here?
(This room specifically, listening to this talk…)

5. We want you to have fewer of these
5

6. Why is Puppet good for security?
Infrastructure
as code
RBAC Auditing Enforcement
6

7. How is PE helping DevOps
and Security teams?
Is it a tire fire or a campfire?

8. Multi-pronged approach to
Security
8

9. Audience participation
Let’s take the temperature of security here
9

10. Why do things burn: key terms
● White Hat - Security and compliance vendors
● Black Hat - Nation states, mafia, ransomware, DDoS
10

11. Existing terminology
● Vulnerability - Common Vulnerabilities and Exposures (CVEs)
● Unmanaged - Nodes that have an agent but the resource does not have a manifest
● Events - The Events tab, aka Event Inspector, in the PE console

12. New terms
● Intentional Change - Change driven by an update to Puppet code
● Corrective Change - Change made by Puppet to return a system to the desired
state, as defined by Puppet code

13. White Hat stuff
● Secret management (Conjur)
● Visibility into intentional vs. corrective change
● Whole infrastructure view (long-term)
● Security company integration (CloudPassage)

14. Let's start with secrets...
14

15. How do we avoid exposing secrets in Puppet?
Easiest to hardest
● Avoid exposing secrets in
Logs
PDB
Console
15
https://flic.kr/p/aCJZrf

16. Conjur and Puppet
16
$planet = conjur_variable('planet')
file { '/etc/hello.txt':
content => "Hello ${planet}!n"
}
conjurize_file { '/etc/hello.txt':
variable_map => {
planet => ‘!var puppetdemo/planet’
}
}

17. Conjur, Vault, Keywhiz,
Amazon KMS, Confidant
17

18. Visibility into Intentional vs.
Corrective Change
How to narrow down what might be burning
18

19. When your infrastructure is burning, how can PE help?
● Intentional change reporting
● Corrective change reporting
19

20. Corrective change: v1
20

21. Corrective change workflow 1: by node
21

23. 23
Select report

24. 24
view details

25. Corrective change workflow 2: across time
25

27. Event Inspector, Node Graph, resource reporting, and
reporting on nodes not under active Puppet management
Corrective change: Future
27

28. Full view of your infrastructure
Reducing the clutter in your head via a single view
28

29. Managed & unmanaged change

30. Tying in vulnerability scanning
How many fucks do I need to give about a given corrective
change?
30

31. Security vendor integration

32. What vendor integration gets you
● Security company integration (CloudPassage)
● Vulnerability comparison to your PE infrastructure.
● Easier compliance tracking

33. Summary
33
What have we learned?

34. Random cat slide
34

35. Q&A

36. Other Security talks
● Bill Weiss from Puppet http://sched.co/6fkD
● Peter Souter from Puppet http://sched.co/6fjZ
● Seth Vargo from Hashicorp http://sched.co/6fjv
● Ben Hughes from Etsy http://sched.co/6fkM

37. Where to find out more
More on Conjur https://www.conjur.net/puppet-secret-server
Module on Forge https://forge.puppet.com/conjur/conjur

38. Agile Security and Compliance with
CloudPassage and Puppet
Application Lifecycle Management with Security using Halo and Puppet

39. Continuous Security Assessment and Compliance
Role based server
group for your
environments
Current security and
compliance posture of
your environments
Critical,
Non-Critical
Security Incident

40. Automated Security & Compliance Assessment
Monitor and protect workloads using,
● Firewall Automation
● Workload Vulnerability
Assessment
● File Integrity Monitoring
● Log-based IDS
● Multi-factor Authentication
● Install & manage Halo agent on
workloads
● Change workload configuration
and provide remediation based
on security & compliance report
provided by Halo

41. Workload Security Assessment Report
Workload Security Assessment Report
● Easy to deploy Halo using Puppet
● Agent is in “Read-only” mode and does
not change state of workload
● Collect security & compliance issues
● Provide full report in few minutes
● The report provides visibility on:
○ Servers with Critical / Non-critical
issues
○ User accounts
○ SW Vulnerability with CVE
information
○ Compliance against CIS Benchmark
○ Running processes
● Easily integrate these findings with Puppet
to start the remediation process.

42. App. Lifecycle Mgmt with Security using Halo and Puppet