DevSecOps Bootcamp - Week 2 - Lesson 1

This is the first lesson of the DevSecOps bootcamp to describe Software Defined Environments so we can get started with writing a bad/weak app.

Transcript

1. 1 DevSecOps Bootcamp BUILDING RUGGED SOFTWARE YEAR ONE / WEEK TWO / LESSON ONE Copyright © DevSecOps Foundation 2015-2016
2. 2 Copyright © DevSecOps Foundation 2015-2016 How my Grandfather ran a stack… Glen Beck (background) and Betty Snyder (foreground) program ENIAC in BRL building 328. (U.S. Army photo)
3. 3 Copyright © DevSecOps Foundation 2015-2016 How my Mother ran a stack… Lawrence Livermore National Laboratory [Attribution], via Wikimedia Commons
4. 4 Copyright © DevSecOps Foundation 2015-2016 How I run a stack… ec2-run-instances ami-12345678 -t t1.micro -k my-key-pair -g my-security-group © 2007 Nuno Pinheiro & David Vignoni & David Miller & Johann Ollivier Lapeyre& Kenneth Wimer & Riccardo Iaconelli / KDE, via Wikimedia Commons
5. 5 Copyright © DevSecOps Foundation 2015-2016 • Virtualized/abstracted infrastructure managed by software, ie. Configuration as Code: • Chef • Puppet • AWS CloudFormation • The software being deployed defines the configuration and virtualized infrastructure requirements. • The virtualized infrastructure extends past the data center to allow for multiple environments. Software Defined Environment
6. 6 Copyright © DevSecOps Foundation 2015-2016 • Solution Definition • Software Pattern • Infrastructure Pattern • Software Defined Infrastructure • Software Defined Network • Software Defined Storage • Software Defined Compute • Software Defined Security • Software Defined … Common Characteristics of SDEs
7. 7 Copyright © DevSecOps Foundation 2015-2016 • Automatically adjusts to workload based on demand (autoscale) • Centrally managed • Everything as Code, underlying policies are code (JSON, YAML etc.) • Better resource management • Holistic overview of the environment • Faster deployments • Built-in audit trails and API endpoints Benefits of SDEs Speed Ease Security
8. 8 Copyright © DevSecOps Foundation 2015-2016 • Networking • Programming • Application • Security • Operating System • Micro-services Skills Needed for SDE Development
9. 9 Auto Scaling group Availability Zone #1 DevSecOps.org security group security group root volume data volume Elastic Load Balancing Amazon S3 bucket logs Amazon EBS snapshot EC2 instance web app server Amazon Route 53 SDE Example in AWS Amazon RDS us-west-2 AWS CloudFormation
10. 10 Copyright © DevSecOps Foundation 2015-2016 • Decomposed Applications where each piece of functionality is its own service • Scales by replicating these microservices across computing resources as needed • Usually use a light weight communication protocol (HTTPS API) • Commonly leverages a queue Micro-services CC0 Public Domain
11. 11 Copyright © DevSecOps Foundation 2015-2016 • Managed services make it possible to run a full application that does not require physical server • Each managed service is considered a microservice • Multiple microservices can be put together to create a fully functional application • Great for HTML 5 and Angular web applications Serverless Microservice Architecture CloudFront Distribution Amazon Route 53 www.devsecops.org Amazon S3 CloudFront Logs
12. 12 Copyright © DevSecOps Foundation 2015-2016 • Amazon Web Services • Google Cloud Platform • Rackspace • Heroku • Many others Serverless Microservice Architecture
13. 13 Copyright © DevSecOps Foundation 2015-2016 • Is there visibility? • Is there logging? • Is there auditing the logging? • Are there service logs? • Are there API access logs? • Is there encryption? • Can customers control their own encryption keys? Security Considerations
14. 14 Copyright © DevSecOps Foundation 2015-2016 • Login in and familiarize yourselves with CentOS 7 Is everybody setup? $ vagrant ssh
15. 15 Copyright © DevSecOps Foundation 2015-2016 • Follow along... • sudo • yum • Commands: cd, ls, find, grep • The filesystem • The network Lightning fast intro to Linux/CentOS 7
16. 16 Copyright © DevSecOps Foundation 2015-2016 the filesystem: Lightning fast intro to Linux/CentOS 7 http://www.tldp.org/
17. 17 Copyright © DevSecOps Foundation 2015-2016 Port Forwarding (for the lab)
18. 18 Copyright © DevSecOps Foundation 2015-2016 • Login in and familiarize yourself with rails and mariadb Let’s get going $ vagrant ssh $ sudo yum -y install mariadb mariadb-server $ gem install rails
19. 19 Copyright © DevSecOps Foundation 2015-2016 • https://github.com/devsecops/bootcamp/blob/master/Week- 2/labs/LESSON-1.md Lab 1 – Getting your Lab Environment Ready