Compliance as Code

Compliance as Code

Compliance is an important part of IT systems. It is often performed only as a regular annual audit. The auditors pick up samples of data to check. They can’t check all the data.

I went through classical audits, where you fill tens of excel sheets and then consult with internal audit what and how to improve etc. As SRE (Site Reliability Engineer) deals with monitoring and automation, there is also depriving people of manual work. I have seen how the problem is solved on a large scale (cloud providers). I have experience with Oracle Cloud Infrastructure (OCI) and Amazon Web Services (AWS). I’ll show you how to move from Excel to an automatic, near real-time compliance check solution using Chef Inspec Framework.

55d57afc217d360cd3aad3e2a8d4e5a0?s=128

Ladislav Prskavec

January 23, 2020
Tweet

Transcript

  1. Compliance as Code Ladislav Prskavec Ladislav Prskavec - itSMF, 23.

    1. 2020 1
  2. Who Am I 4 Senior Manager in Oracle Cloud Infrastructure

    4 Twitter: @abtris 4 Blog and talks: https://blog.prskavec.net/ Ladislav Prskavec - itSMF, 23. 1. 2020 2
  3. Compliance Ladislav Prskavec - itSMF, 23. 1. 2020 3

  4. Ladislav Prskavec - itSMF, 23. 1. 2020 4

  5. Automating Away the Regulatory Compliance Myth Ladislav Prskavec - itSMF,

    23. 1. 2020 5
  6. Regulatory Compliance Ladislav Prskavec - itSMF, 23. 1. 2020 6

  7. Ladislav Prskavec - itSMF, 23. 1. 2020 7

  8. Ladislav Prskavec - itSMF, 23. 1. 2020 8

  9. Ladislav Prskavec - itSMF, 23. 1. 2020 9

  10. Language is key Ladislav Prskavec - itSMF, 23. 1. 2020

    10
  11. 6.2.1 Set SSH Protocol to 2 (Scored) Profile Applicability: -

    Level 1 Description: SSH supports two different and incompatible protocols: SSH1 and SSH2. SSH1 was the original protocol and was subject to security issues. SSH2 is more advanced and secure. Rationale: SSH v1 suffers from insecurities that do not affect SSH v2. Audit: To verify the correct SSH setting, run the following command and verify that the output is as shown: # grep "^Protocol" /etc/ssh/sshd_config Protocol 2 Remediation: Edit the /etc/ssh/sshd_config file to set the parameter as follows: Protocol 2 Ladislav Prskavec - itSMF, 23. 1. 2020 11
  12. control 'ssh-04' do impact 1.0 title 'Client: Specify protocol version

    2' desc "Only SSH protocol version 2 connections should be permitted..." describe ssh_config do its('Protocol') { should eq('2') } end end 4 ssh_spec.rb Ladislav Prskavec - itSMF, 23. 1. 2020 12
  13. Compliance as Code 4 Defining Policies Upfront 4 Automated Gates

    and Checks 4 Managing Changes in Continuous Delivery 4 Separation of Duties in the DevOps Audit Toolkit 4 Using the Audit Defense Toolkit 4 Code Instead of Paperwork Ladislav Prskavec - itSMF, 23. 1. 2020 13
  14. Chef Inspec framework www.inspec.io - 1.0 Sep 2016 Ladislav Prskavec

    - itSMF, 23. 1. 2020 14
  15. Ladislav Prskavec - itSMF, 23. 1. 2020 15

  16. Define policies Ladislav Prskavec - itSMF, 23. 1. 2020 16

  17. How to start Ladislav Prskavec - itSMF, 23. 1. 2020

    17
  18. DevSec Hardening Framework Baselines Ladislav Prskavec - itSMF, 23. 1.

    2020 18
  19. Ladislav Prskavec - itSMF, 23. 1. 2020 19

  20. Ladislav Prskavec - itSMF, 23. 1. 2020 20

  21. Ladislav Prskavec - itSMF, 23. 1. 2020 21

  22. Ladislav Prskavec - itSMF, 23. 1. 2020 22

  23. Ladislav Prskavec - itSMF, 23. 1. 2020 23

  24. Ladislav Prskavec - itSMF, 23. 1. 2020 24

  25. Ladislav Prskavec - itSMF, 23. 1. 2020 25

  26. Automate audit Ladislav Prskavec - itSMF, 23. 1. 2020 26

  27. Metrics # HELP inspec_checks_total Number of inspec checks # TYPE

    inspec_checks_total gauge inspec_checks_total{profile="ssl-baseline",status="passed"} 6 inspec_checks_total{profile="ssl-baseline",status="failed"} 0 inspec_checks_total{profile="ssl-baseline",status="skipped"} 0 4 prometheus_inspec_exporter by Dave Cadwallader Ladislav Prskavec - itSMF, 23. 1. 2020 27
  28. Ladislav Prskavec - itSMF, 23. 1. 2020 28

  29. Summary 4 Why Compliance? 4 Why Compliance as code? 4

    Why Automated audit? Ladislav Prskavec - itSMF, 23. 1. 2020 29
  30. Q & A Or ask on twitter: @abtris Ladislav Prskavec

    - itSMF, 23. 1. 2020 30