Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Security at Scale

Security at Scale

In this presentation, I highlight patterns to secure modern software delivery workflows and explain what steps are important and why.

This version of the talk was given as the closing keynote during the Open Source Cloud Strategies and Solutions Day in November 2023.

---

Companion Code: github.com/workloads

Kerim Satirli

November 23, 2023

More Decks by Kerim Satirli

Other Decks in Programming

Transcript

  1. Open Source Cloud Strategies and Solutions
    Towards Reliability and Compliance
    Security at Scale

    View full-size slide

  2. Open Source is the default.

    View full-size slide

  3. 96% of applications
    have OSS dependencies
    and they're in your repos.
    96% of applications
    have OSS dependencies
    and they're in your repos.

    View full-size slide

  4. Sr. Developer Advocate at HashiCorp
    for Infrastructure and Orchestration
    @ksatirli
    he / him
    Kerim
    Satirli

    View full-size slide

  5. developer's environment
    and remote experiences
    develop
    developer's environment
    and build environments
    build
    build environments and
    artifact registries
    store
    orchestration platforms
    (Nomad, Kubernetes etc)
    run
    Software Delivery Lifecycle

    View full-size slide

  6. trust
    trust
    developer's environment
    and remote experiences
    developer's environment
    and build environments
    build environments and
    artifact registries
    orchestration platforms
    (Nomad, Kubernetes etc)
    trust trust
    Software Delivery Lifecycle

    View full-size slide

  7. Using unverified code
    is like doing a trust fall
    with people you don't know.

    View full-size slide

  8. Assume hostile intent
    for any unverified code.

    View full-size slide

  9. 01
    Securing Development

    View full-size slide

  10. ! dscl . -read /Groups/admin GroupMembership
    GroupMembership: root
    Terminal
    "

    View full-size slide

  11. ! dscl . -read /Groups/admin GroupMembership
    GroupMembership: root kerim #
    Terminal
    $

    View full-size slide

  12. Endpoint Protection
    is important.

    View full-size slide

  13. Securing Development
    Level 1
    ▪ clear guidelines on what is
    acceptable and what isn’t
    ▪ locally available tooling to
    verify code meets rulesets
    Level 2
    ▪ automated linting and
    testing after git push
    ▪ cryptographically signed
    and verified commits
    Level 3
    ▪ branch protection and
    required trust levels
    ▪ no unaudited bypassing
    of security functionality

    View full-size slide

  14. 02
    Protecting Builds

    View full-size slide

  15. Protecting Builds
    Level 1
    ▪ no builds using unsigned
    or unverified commits
    ▪ build server configuration
    is codified and tested
    Level 3
    ▪ all builds have a validated
    software bill of materials
    ▪ all builds are hermetic, all
    dependencies packaged
    Level 2
    ▪ actively create and store
    tamper-proof build logs
    ▪ build server configuration
    uses strong addressing

    View full-size slide

  16. 03
    Safeguarding Artifacts

    View full-size slide

  17. Safeguarding Artifacts
    Level 1
    ▪ artifacts must be fully
    cryptographically signed
    ▪ monitor for outliers in
    artifact attributes
    Level 2
    ▪ isolate artifact servers by
    application environment
    ▪ limit admin access and
    regularly audit access
    Level 3
    ▪ all dependencies must be
    explicitly allowed for use
    ▪ artifacts must pass
    regular scans while "live"

    View full-size slide

  18. 04
    Securing Orchestrators

    View full-size slide

  19. Securing Orchestrators
    Level 1
    ▪ consider the shared
    responsibility model
    ▪ lock down ingress and
    egress of service interface
    Level 2
    ▪ only allow codified
    workloads to be executed
    ▪ define a clear secrets
    management strategy
    Level 3
    ▪ right-size hardware and
    monitor for zombie usage
    ▪ build patterns to fail
    securely instead of safely

    View full-size slide

  20. Codified Patterns
    github.com/workloads/

    View full-size slide

  21. Defense requires Layers.

    View full-size slide

  22. Layers require People.

    View full-size slide

  23. Security is a Team Sport.

    View full-size slide

  24. Open Source Cloud Strategies and Solutions
    speakerdeck.com/ksatirli
    Thank you

    View full-size slide