Compliance as Code

Compliance is an important part of IT systems. It is often performed only as a regular annual audit. The auditors pick up samples of data to check. They can’t check all the data.

I went through classical audits, where you fill tens of excel sheets and then consult with internal audit what and how to improve etc. As SRE (Site Reliability Engineer) deals with monitoring and automation, there is also depriving people of manual work. I have seen how the problem is solved on a large scale (cloud providers). I have experience with Oracle Cloud Infrastructure (OCI) and Amazon Web Services (AWS). I’ll show you how to move from Excel to an automatic, near real-time compliance check solution using Chef Inspec Framework.

Transcript

1. Compliance as Code
   Ladislav Prskavec
   Ladislav Prskavec - itSMF, 23. 1. 2020 1
   

   View Slide

2. Who Am I
   4 Senior Manager in Oracle Cloud Infrastructure
   4 Twitter: @abtris
   4 Blog and talks: https://blog.prskavec.net/
   Ladislav Prskavec - itSMF, 23. 1. 2020 2
   

   View Slide

3. Compliance
   Ladislav Prskavec - itSMF, 23. 1. 2020 3
   

   View Slide

4. Ladislav Prskavec - itSMF, 23. 1. 2020 4
   

   View Slide

5. Automating Away the
   Regulatory Compliance
   Myth
   Ladislav Prskavec - itSMF, 23. 1. 2020 5
   

   View Slide

6. Regulatory Compliance
   Ladislav Prskavec - itSMF, 23. 1. 2020 6
   

   View Slide

7. Ladislav Prskavec - itSMF, 23. 1. 2020 7
   

   View Slide

8. Ladislav Prskavec - itSMF, 23. 1. 2020 8
   

   View Slide

9. Ladislav Prskavec - itSMF, 23. 1. 2020 9
   

   View Slide

10. Language is key
    Ladislav Prskavec - itSMF, 23. 1. 2020 10
    

    View Slide

11. 6.2.1 Set SSH Protocol to 2 (Scored)
    Profile Applicability:
    - Level 1
    Description:
    SSH supports two different and incompatible protocols: SSH1 and SSH2. SSH1 was the
    original protocol and was subject to security issues. SSH2 is more advanced and secure.
    Rationale:
    SSH v1 suffers from insecurities that do not affect SSH v2.
    Audit:
    To verify the correct SSH setting, run the following command and verify that the output is
    as shown:
    # grep "^Protocol" /etc/ssh/sshd_config
    Protocol 2
    Remediation:
    Edit the /etc/ssh/sshd_config file to set the parameter as follows:
    Protocol 2
    Ladislav Prskavec - itSMF, 23. 1. 2020 11
    

    View Slide

12. control 'ssh-04' do
    impact 1.0
    title 'Client: Specify protocol version 2'
    desc "Only SSH protocol version 2 connections should be permitted..."
    describe ssh_config do
    its('Protocol') { should eq('2') }
    end
    end
    4 ssh_spec.rb
    Ladislav Prskavec - itSMF, 23. 1. 2020 12
    

    View Slide

13. Compliance as Code
    4 Defining Policies Upfront
    4 Automated Gates and Checks
    4 Managing Changes in Continuous Delivery
    4 Separation of Duties in the DevOps Audit Toolkit
    4 Using the Audit Defense Toolkit
    4 Code Instead of Paperwork
    Ladislav Prskavec - itSMF, 23. 1. 2020 13
    

    View Slide

14. Chef Inspec framework
    www.inspec.io - 1.0 Sep 2016
    Ladislav Prskavec - itSMF, 23. 1. 2020 14
    

    View Slide

15. Ladislav Prskavec - itSMF, 23. 1. 2020 15
    

    View Slide

16. Define policies
    Ladislav Prskavec - itSMF, 23. 1. 2020 16
    

    View Slide

17. How to start
    Ladislav Prskavec - itSMF, 23. 1. 2020 17
    

    View Slide

18. DevSec Hardening Framework Baselines
    Ladislav Prskavec - itSMF, 23. 1. 2020 18
    

    View Slide

19. Ladislav Prskavec - itSMF, 23. 1. 2020 19
    

    View Slide

20. Ladislav Prskavec - itSMF, 23. 1. 2020 20
    

    View Slide

21. Ladislav Prskavec - itSMF, 23. 1. 2020 21
    

    View Slide

22. Ladislav Prskavec - itSMF, 23. 1. 2020 22
    

    View Slide

23. Ladislav Prskavec - itSMF, 23. 1. 2020 23
    

    View Slide

24. Ladislav Prskavec - itSMF, 23. 1. 2020 24
    

    View Slide

25. Ladislav Prskavec - itSMF, 23. 1. 2020 25
    

    View Slide

26. Automate audit
    Ladislav Prskavec - itSMF, 23. 1. 2020 26
    

    View Slide

27. Metrics
    # HELP inspec_checks_total Number of inspec checks
    # TYPE inspec_checks_total gauge
    inspec_checks_total{profile="ssl-baseline",status="passed"} 6
    inspec_checks_total{profile="ssl-baseline",status="failed"} 0
    inspec_checks_total{profile="ssl-baseline",status="skipped"} 0
    4 prometheus_inspec_exporter by Dave Cadwallader
    Ladislav Prskavec - itSMF, 23. 1. 2020 27
    

    View Slide

28. Ladislav Prskavec - itSMF, 23. 1. 2020 28
    

    View Slide

29. Summary
    4 Why Compliance?
    4 Why Compliance as code?
    4 Why Automated audit?
    Ladislav Prskavec - itSMF, 23. 1. 2020 29
    

    View Slide

30. Q & A
    Or ask on twitter: @abtris
    Ladislav Prskavec - itSMF, 23. 1. 2020 30
    

    View Slide