Building security tools for modern infrastructures

Lessons learnt from 15 years of evolution of providing security services for modern infrastructures: from manual solutions to custom-tailored software to serial infrastructure components.

Transcript

1. Building security tools for modern infrastructures Eugene Pilyankevich Chief Technical Officer, Cossack Labs
2. DevOps ≃ SecOps some stories
3. Building security tooling started like… getting stuff done efficiently.
4. Building security tooling was like… getting stuff done consistently.
5. Building security tooling is like… getting stuff done industrially.
6. DevOps ≃ SecOps some lessons learned
7. continous tested fast deploys consistent state verified enforced DevOps ≃ SecOps
8. DevOps ≃ SecOps Automate all the things!
9. similar goals mean similar methods
10. From delivering solutions into infrastructures to delivering products for infrastructures
11. cossacklabs.com/acra
12. Starting early is a must
13. Role-based deploy scenarios: • Compartmentation • Controlled attack surface • Code authenticity Security
14. Role-based deploy scenarios: • Automatic config generation • Easy scaling • Easier monitoring DevOps
15. Continuous QA: • Run crypto tests everywhere • Static code analysis • Leak detection • In-memory artefact hunting Security
16. Continuous QA: • Consistent, predictible builds • Quicker delivery DevOps
17. Beware of analysis paralysis
18. Deterministic deploys: 
 • Do one thing and do it well • Use reasonable modularity DevOps + Security
19. • Peer = [Peers] • No unique states Generate useful side effects:
20. Talking earlier saves lives!
21. WAT
22. Well-defined things are automatable.
23. Well-defined things are automatable.
24. Let’s jump to conclusions!
25. Automate builds Automate deploys Automate maintenance
26. Methods are similar when infrastructure is some code around some other code.
27. No CI/CD processes? Security relies on humans
28. Attack scenarios can be tests. NIST can do it, so you should too.
29. Security is not incremental. Convenience is.
30. cossacklabs.com 
 ivychapel.ink Thank you for your time! @9gunpi