Integrating Compliance into the Development Process - OWASP DC

Everyone wants to move faster and ship updates with higher velocity. Regulatory burdens and compliance can add extra drag on the system. Controls that live in notebooks, spreadsheets, and PDF files are difficult to verify. Scanning the production systems for compliance means you find violations when it's too late and when they're most expensive to fix. Compliance must be managed as code and must be part of your everyday development process if you'd like to improve compliance and increase velocity. In this talk, we'll look at one way you can move compliance controls directly into your development process. We'll explore InSpec, an open-source testing framework for infrastructure with a human- and machine-readable language for specifying compliance, security and policy requirements.

Recording of the presentation - https://www.youtube.com/watch?v=RaeN7w8rQAI

Transcript

1. Integrating Compliance into the
   Development Process
   

   View Slide

2. https://youtu.be/RaeN7w8rQAI
   This was recorded at the OWASP DC Meetup
   

   View Slide

3. View Slide

4. View Slide

5. View Slide

6. View Slide

7. View Slide

8. SSH Control
   SSH supports two different protocol
   versions. The original version, SSHv1, was
   subject to a number of security issues.
   Please use SSHv2 instead to avoid these.
   

   View Slide

9. How will I verify this?
   

   View Slide

10. Whip up a one-liner!
    grep "^Protocol" /etc/ssh/sshd_config | sed 's/Protocol //'
    

    View Slide

11. Apache Server Information Leakage – Server Token Directive
    •  Description
     
    This Directive Controls wheather Server response field is sent back to clients includes a description of Generic OS Type of the Server.
     
    This allows attackers to identify web servers details greatly and increases the efficiency of any attack,as security vulnerabilities are
    dependent upon specific software versions.
    •  How to Test
     
    In order to test for ServerToken configuration, one should check the Apache configuration file.
    •  Misconfiguration
     
    ServerTokens Full
    •  Remediation
     
    Configure the ServerTokens directive in the Apache configuration to value of Prod or ProductOnly. This tells Apache to only return
    "Apache" in the Server header, returned on every page request.
     
    ServerTokens Prod
     
    or
     
    ServerTokens ProductOnly
    https://www.owasp.org/index.php/SCG_WS_Apache
    

    View Slide

12. Whip up a one-liner!
    grep "^ServerTokens" /etc/httpd/conf/httpd.conf | sed 's/ServerTokens //'
    

    View Slide

13. View Slide

14. View Slide

15. View Slide

16. View Slide

17. View Slide

18. Two-thirds of organizations did
    not adequately test the security
    of all in-scope systems!
    

    View Slide

19. Key Trends
    •  While individual rule compliance
    is up, testing of security systems
    is down
    •  Sustainability is low. Fewer than
    a third of companies were found
    to be still fully compliant less
    than a year after successful
    validation.
    

    View Slide

20. View Slide

21. Shell Scripts
    grep "^Protocol" /etc/ssh/sshd_config | sed 's/Protocol //'
    grep "^ServerTokens" /etc/httpd/conf/httpd.conf | sed 's/ServerTokens //'
    

    View Slide

22. Infrastructure Code
    package 'httpd' do
    action :install
    end
    service 'httpd' do
    action [ :start, :enable ]
    end
    

    View Slide

23. What We Have Here Is A Communications Problem
    

    View Slide

24. View Slide

25. Security != Compliance
    

    View Slide

26. View Slide

27. View Slide

28. View Slide

29. View Slide

30. View Slide

31. View Slide

32. InSpec
    

    View Slide

33. Create a check
    describe service 'ssh-agent' do
    it { should be_running }
    end
    

    View Slide

34. Test a target
    $ inspec exec test.rb
    .
    Finished in 0.00901 seconds (files took 0.98501 seconds to load)
    1 example, 0 failures
    

    View Slide

35. Test Locally
    $ inspec exec test.rb
    

    View Slide

36. Test Remote via SSH
    $ inspec exec test.rb -i ~/.aws/nathen.pem -t ssh://ec2-user@54.152.7.203
    

    View Slide

37. Test Remote via WinRM
    $ inspec exec test.rb -t winrm://Admin@192.168.1.2 --password super
    

    View Slide

38. Test Docker Container
    $ inspec exec test.rb -t docker://3dda08e75838
    

    View Slide

39. InSpec
    Test any target
    

    View Slide

40. SSH Control
    SSH supports two different protocol
    versions. The original version, SSHv1, was
    subject to a number of security issues.
    Please use SSHv2 instead to avoid these.
    

    View Slide

41. SSH Version Check
    describe file('/etc/ssh/sshd_config') do
    its(:content) { should match /Protocol 2/ }
    end
    

    View Slide

42. SSH Version Check
    describe sshd_config do
    its('Protocol') { should cmp 2 }
    end
    

    View Slide

43. Available Resources
    apache_conf
    apt
    audit_policy
    auditd_conf
    auditd_rules
    bond
    bridge
    csv
    command
    directory
    etc_group
    file
    gem
    group
    host
    inetd_conf
    interface
    iptables
    kernel_module
    kernel_parameter
    limits_conf
    login_defs
    mount
    mysql_conf
    mysql_session
    npm
    ntp_conf
    oneget
    os
    os_env
    package
    parse_config
    parse_config_file
    passwd
    pip
    port
    postgres_conf
    postgres_session
    powershell
    processes
    registry_key
    security_policy
    service
    ssh_config
    sshd_config
    user
    windows_feature
    yaml
    yum
    

    View Slide

44. InSpec
    Test any target
    Be expressive
    

    View Slide

45. View Slide

46. ©2016 Chef Software Inc.
    Test Kitchen
    

    View Slide

47. ©2016 Chef Software Inc.
    Test Kitchen Commands and Configuration
    

    View Slide

48. InSpec
    kitchen-inspec
    

    View Slide

49. Setup our test
    $ chef generate cookbook apache
    $ cd apache
    $ vim .kitchen.yml
    $ kitchen converge
    $ rm -rf test/integration/default/*
    $ mkdir -p test/integration/default/inspec/
    $ vim test/integration/default/inspec/default_spec.rb
    

    View Slide

50. SSH Version Check
    describe sshd_config do
    its('Protocol') { should cmp 2 }
    end
    

    View Slide

51. Run the test
    $ kitchen verify
    Failures:
    1) SSH Configuration Protocol should cmp 2
    Failure/Error: its('Protocol') { should cmp 2 }
    expected: 2
    got:
    

    View Slide

52. Fix the issue (manually)
    $ kitchen login
    $ sudo vi /etc/ssh/sshd_config
    $ exit
    $ kitchen verify
    Finished in 0.0382 seconds (files took 0.7536 seconds to load)
    1 example, 0 failures
    Finished verifying (0m0.47s).
    

    View Slide

53. Apache Server Information Leakage – Server Token Directive
    •  Description
     
    This Directive Controls wheather Server response field is sent back to clients includes a description of Generic OS Type of the Server.
     
    This allows attackers to identify web servers details greatly and increases the efficiency of any attack,as security vulnerabilities are
    dependent upon specific software versions.
    •  How to Test
     
    In order to test for ServerToken configuration, one should check the Apache configuration file.
    •  Misconfiguration
     
    ServerTokens Full
    •  Remediation
     
    Configure the ServerTokens directive in the Apache configuration to value of Prod or ProductOnly. This tells Apache to only return
    "Apache" in the Server header, returned on every page request.
     
    ServerTokens Prod
     
    or
     
    ServerTokens ProductOnly
    https://www.owasp.org/index.php/SCG_WS_Apache
    

    View Slide

54. Apache ServerTokens
    describe apache_conf do
    its('ServerTokens') { should eq ["Prod"] }
    end
    

    View Slide

55. Verify Apache ServerTokens
    $ kitchen verify
    Pending: (Failures listed here are expected and do not affect your
    suite's status)
    1) Apache Config /etc/httpd/conf/httpd.conf Can't find file "/
    etc/httpd/conf/httpd.conf"
    # Not yet implemented
    # /Users/nathenharvey/.chefdk/gem/ruby/2.1.0/gems/
    inspec-0.12.0/lib/inspec/runner.rb:131
    Finished in 0.03081 seconds (files took 0.78295 seconds to load)
    2 examples, 0 failures, 1 pending
    

    View Slide

56. Install Apache with a Chef Recipe
    $ vim recipes/default.rb
    package 'httpd' do
    action :install
    end
    service 'httpd' do
    action :start
    end
    

    View Slide

57. Verify Apache
    $ kitchen converge
    $ kitchen verify
    Failures:
    1) Apache Config /etc/httpd/conf/httpd.conf ServerTokens should eq ["Prod"]
    Failure/Error: its('ServerTokens') { should eq ["Prod"] }
    expected: ["Prod"]
    got: nil
    (compared using ==)
    # ./test/integration/default/inspec/default_spec.rb:6:in `block (2 levels) in load'
    # /Users/nathenharvey/.chefdk/gem/ruby/2.1.0/gems/inspec-0.12.0/lib/inspec/runner_rspec.rb:55:in `run'
    Finished in 0.05239 seconds (files took 0.85597 seconds to load)
    2 examples, 1 failure
    

    View Slide

58. Fix Apache
    $ kitchen login
    $ sudo vi /etc/httpd/conf/httpd.conf
    $ exit
    $ kitchen verify
    Finished in 0.03416 seconds (files took 0.75269 seconds to load)
    2 examples, 0 failures
    

    View Slide

59. InSpec
    Test any target
    Be expressive
    

    View Slide

60. InSpec
    kitchen-inspec
    

    View Slide

61. InSpec
    Open Source
    https://github.com/chef/inspec
    

    View Slide

62. InSpec
    Used with Chef Compliance
    

    View Slide

63. View Slide

64. View Slide

65. Apache ServerTokens
    control "Apache Server Information Leakage"
    impact 0.1
    title 'Server Token Directive'
    desc <<-EOF
    This Directive Controls wheather Server response field is sent back to
    clients includes a description of Generic OS Type of the Server. This
    allows attackers to identify web servers details greatly and increases the
    efficiency of any attack,as security vulnerabilities are dependent upon
    specific software versions.
    EOF
    tag 'OWASP: SCG WS Apache', url: 'https://www.owasp.org/index.php/SCG_WS_Apache#Apache_Server_Information_Leakage'
    describe apache_conf do
    its('ServerTokens') { should eq ["Prod"] }
    end
    end
    

    View Slide

66. View Slide

67. View Slide

68. Chef Provides a Proven Approach to DevOps
    Apps
    Runtime
    environments
    Infrastructure
    ..
    .
    Targets/Workloads
    Collaborative
    Development
    Chef Insights
    Production
    Chef Server
    Chef Server
    Chef Supermarket
    Assessment
    Chef Compliance
    Search
    Audit
    Discover
    Deploy
    Chef Delivery
    Local
    Development
    Model
    Build
    Test
    Chef DK
    Chef Client & Cookbooks
    

    View Slide

69. View Slide

70. View Slide

71. https://www.chef.io/blog/2016/04/01/chef-compliance-1-0-release/
    

    View Slide

72. View Slide

73. View Slide

74. View Slide

75. Austin, TX | July 11-13
    Early Bird Pricing Through April 17th
    «  Workshops & Chef Training!
    «  Community Summit!
    «  Chef Partner Summit!
    «  Welcome Reception!
    «  Keynotes!
    «  Technical Sessions!
    «  Happy Hour!
    «  Keynotes!
    «  Technical Sessions!
    «  Awesome Chef Awards!
    «  Community Celebration!
    ChefConf.com
    

    View Slide

76. Nathen Harvey
    VP, Community Development at Chef
    Co-host of the Food Fight Show Podcast
    Occasional farmer – http://ei.chef.io
    Love eggs – http://eggs.chef.io
    Part-time detective - http://bit.ly/detectivedecker
    @nathenharvey
    nharvey@chef.io
    

    View Slide

77. View Slide