Shift-Left Infrastructure Compliance Testing

Talk and demo presented at the Test Automation Meetup at the TradeMe office in Wellington on 2nd March 2017.

Transcript

1. Mrinal Mukherjee Sr. Consultant - Technology mukherjee_mk https://www.linkedin.com/in/mrinalmukherjee
3. Infrastructure Compliance? - Secure IT Infrastructure from malicious attacks - Uniform configurations across IT Infrastructure - Industry standards (PCI, CSI) are enforced
4. The world of surprises! - Manual compliance validation - Irregular cadence of compliance validation - Remediation is costly - A bit too late at times!
5. Shift-Left Infrastructure Compliance - Embed infrastructure compliance in delivery pipeline - Detect compliance issues earlier - fix them earlier - Avoid surprises at a later stage!
6. Inspec - Compliance as Code - Open-source testing framework - Specify compliance, security and policy requirements - Command-line Interface (CLI)
7. Demo
8. Chef Compliance - Checks infrastructure for compliance rules - Doesn’t need Chef software to run on the VMs under test - Prebuilt (CIS) and custom ‘Compliance Profiles’ - Continuously monitor compliance - Audit reports and analytics - Integrates with Inspec - Can be invoked from a ‘stage’ of a CI system