Towards Verifiable Infrastructure Security

Transcript

1. Infrastructure as Code
   Towards Verifiable Infrastructure Security
   Abhisek Datta
   Head of Technology, Appsecco
   

   View Slide

2. Lets start with how attackers work
   An attacker wants to hack a target and for this, will
   perform a bunch of activities
   1. Online Attack Surfaces
   2. Breached Credentials
   3. Known Vulnerable Software
   4. (Easy to?) exploit security vulnerabilities
   5. If nothing works
   • Invest skill and resources in 0days
   

   View Slide

3. What is the root cause?
   Inspite of so much investment in security, why does low hanging fruits still
   exist for an attacker to exploit?
   

   View Slide

4. How to be secure?
   By establishing
   TRUST
   

   View Slide

5. How does trust looks like?
   A DFD representing the Transaction Flow in a Online Banking Application
   Re-auth
   Anti-
   fraud
   Confirm with
   sender for high
   value
   transactions
   

   View Slide

6. The Challenge of Security at Scale
   This is the Amazon Microservices Graph
   The
   Challenge of
   Security at
   Scale is really
   –
   The
   SCALE
   

   View Slide

7. How do we solve this? (My Opinion)
   • By applying the principles of Secure Software
   Development Life-cycle while building Infrastructure
   • Requirement Analysis
   • Design
   • Versioning
   • Secure Development
   • Testing & Verification
   • Deployment
   • Rolling Update
   • Rollback (if required)
   

   View Slide

8. Infrastructure as Code
   

   View Slide

9. What is it?
   • The process of provisioning and managing
   infrastructure through machine readable code &
   configuration
   • It is an alternative approach compared to managing
   physical hardware and provisioning them with
   interactive setup and configuration tools
   

   View Slide

10. The Tooling with an Example
    1. Setup 3 EC2
    instances in AWS
    2. Setup an EFS for
    shared state
    3. Deploy containers
    4. Collect output
    5. Monitor for
    availability
    

    View Slide

11. Options for Adoption - Infrastructure
    IaaS Platform Tools Vendor
    GCP, AWS, Azure Terraform Hashicorp
    AWS Cloud Formations AWS
    Azure Azure Resource
    Manager
    Microsoft
    Google Cloud Deployment
    Manager
    Google
    

    View Slide

12. What can be done with it?
    • Codify infrastructure
    • Version control
    • Test & Verify
    • Bug Fix
    • Automated & Continuous Deployment
    

    View Slide

13. Verifiable Infrastructure
    What is it really?
    

    View Slide

14. Enterprise Security Requirements
    Can we agree, that the most important requirement is
    To not get breached?
    

    View Slide

15. How to be secure?
    By establishing
    TRUST
    

    View Slide

16. Secure Software Development Lifecycle
    Security
    Requirements
    Secure
    Architecture
    Secure
    Development
    Security
    Testing
    Exploit
    Mitigation
    Release
    Management
    

    View Slide

17. Mapping SSDLC to Infrastructure as Code
    SSDLC Secure Infrastructure
    Security Requirements Security Requirements
    Secure Architecture Secure Architecture
    Secure Development Infrastructure as Code
    Security Testing Static Analysis and Verification
    Exploit Mitigation Anomaly Detection and Prevention
    Release Management Release Management
    

    View Slide

18. An Example of Verifying Infrastructure
    A journey towards adopting infrastructure as code
    

    View Slide

19. A proposed network architecture
    

    View Slide

20. Codify the Infrastructure (Example uses AWS)
    

    View Slide

21. The Graph
    

    View Slide

22. The Threat Model
    

    View Slide

23. Now what?
    • Add security controls (mitigations) in architecture
    • Edit code to include the required resources and
    configuration
    • Push to repository
    • This triggers CI/CD
    • CI/CD runs test cases on code (if any)
    • CI/CD update the live infrastructure
    

    View Slide

24. Build
    Test
    Deploy
    Audit
    Update
    How does it all look like?
    

    View Slide

25. Questions?
    abhisek@appsecco.com
    That’s all for now.. J
    https://appsecco.com
    @abh1sek
    github.com/abhisek
    

    View Slide