How to secure your coded infrastructure... - Automacon 2015

@apollocatlin How to secure your coded infrastructure Or Common Sense
Still Applies… Apollo Catlin, Sr Infrastructure Engineer, Threat Stack Inc

@apollocatlin

@apollocatlin Don’t commit any secrets to source control

@apollocatlin Questions

@apollocatlin People Systems

@apollocatlin People

@apollocatlin Mindset Situational awareness, it is more state of mind
not a skill “Situational Awareness is the ability to identify, process, and comprehend the critical elements of information about what is happening to the team with regards to the mission. More simply, it's knowing what is going on around you.” - Coast Guard

@apollocatlin –Nathan Cooprider (Threat Stack Engineer) A lot of security
is having a paranoid attitude.

@apollocatlin – Melvin Conway “organizations which design systems ... are constrained
to produce designs which are copies of the communication structures of these organizations”

@apollocatlin Teams

@apollocatlin Empower your security team via automation.

@apollocatlin Watch out for shadow IT

@apollocatlin Shadow IT is a communication problem in disguise.

@apollocatlin Build Trust in your Organization

@apollocatlin Build Consensus and Buy-in

@apollocatlin physical security encrypt hard drive secure communication 2FA [https://github.com/google/google-authenticator]
strong passwords/password managers

@apollocatlin Systems Security in systems is about making your systems
either cost or time- prohibitive to attack or compromise

@apollocatlin Systems Design in Security Package securely SSL on as
much trafﬁc as you can handle Key rotation Use an audit tool to keep track of actions inside your system

@apollocatlin The slide where I say application packaging sucks… see
Joe Damato’s talk… yesterday… he posted the slides on packagecloud.io already

@apollocatlin Packer https://www.packer.io/

@apollocatlin Benefits Build a base box that can be reviewed
Boxes can be signed (x509 on AWS), definitely have an audit trail Boxes are built in your account, and saved there. Easy output of multiple formats 2 line config to output a local Vagrant version of the box for testing/dev

@apollocatlin • AWS (EC2 AMI) • DigitalOcean • Docker •
Google Compute Engine • OpenStack • Parallels • QEMU • VirtualBox • VMware

@apollocatlin Secure Packer Provision/converge/etc. Run your CM system for a
base set of system configuration Setup monitoring, but do not enable Once that is finished, REMOVE ALL SECRETS before Packer finishes

@apollocatlin SSL Let’s Encrypt Free Comodo SSL Cert Mozilla SSL
Conﬁguration Generator [https://mozilla.github.io/server- side-tls/ssl-conﬁg-generator/] Qualsys SSL Labs [https://www.ssllabs.com/ssltest/]

@apollocatlin SSL • UPDATE YOUR CODE FREQUENTLY

@apollocatlin Log and Monitor Excessively

@apollocatlin –Threat Stack “Buy Threat Stack, it solves this problem”

@apollocatlin If you have monitoring, start monitoring and alerting security
events

@apollocatlin Check out these audit frameworks NISPOM - National Industrial
Security Program CAPP - Controlled Access Protection Proﬁle LSPP - Labeled Security Protection Proﬁle STIG - Security Technical Implementation Guidelines

@apollocatlin Iterate your systems

@apollocatlin Try to to have monitoring be conﬁgured and ﬁrst
as you converge/ emerge a new system, better to have monitoring/metrics gathering on while you are installing all that cool software you want to track

@apollocatlin Secrets Storage Use your CM, not a bad place
for this at all. Ansible Vault Chef Encrypted Data Bags Puppet Hiera-eyaml Salt Pillars

@apollocatlin BFG Repo-Cleaner https://rtyley.github.io/bfg-repo- cleaner/

@apollocatlin Key Rotation Tools sneaker vault keywhiz credstash trousseau redoctober
jass

@apollocatlin Value YOUR product and YOUR reality over vendor relationships

@apollocatlin Netﬂix’s Security Monkey [https://github.com/Netﬂix/security_monkey]

@apollocatlin http://hardening.io/

@apollocatlin Security Topics to Check Out OODA Loops (Observe-Orient-Decide-Act) Cyber
Kill Chain (Eric M. Hutchins, Michael J. Cloppert, and Rohan M. Amin, Ph.D.) [http://www.lockheedmartin.com/content/dam/lockheed/ data/corporate/documents/LM-White-Paper-Intel-Driven-Defense.pdf] Leveraging behavioral science to mitigate cyber security risk (Shari Lawrence Pﬂeeger) [http://www.sciencedirect.com/science/article/pii/ S0167404811001659]

@apollocatlin Keep Learning

How to secure your coded infrastructure... - Au...

How to secure your coded infrastructure... - Automacon 2015

Other Decks in Technology

Featured

Transcript