SecDevOps Securing DevOps. Aarno Aukia VSHN AG The DevOps Company

Transcription

1 SIGS Technology Conference SecDevOps Securing DevOps Aarno Aukia VSHN AG The DevOps Company

2 Agenda About Aarno / VSHN Agile Software Engineering Agile Infrastructure Engineering Agile Security Engineering Securing the software delivery process Example: authentication & authorization Q&A

3 Who Aarno Aukia, CTO & co-founder ETH Google Atrila or VSHN AG - the DevOps Company Since 2014, 20 people in Zürich Running web applications on-premises and in the clouds making both visitors and developers happy

4 Software Engineering 1/2 Requirements Design Implementation Validation Maintenance

5 Software Engineering 2/2 Requirements Design Implementation Validation Maintenance

6 Agile Software Engineering Design Implementation Requirements Release Testing

7 Agile Infrastructure Engineering? How do operations cope with the continuous changes by the developers? How do you change the operations process from reactive (fire brigade) to proactive (fire detector, sprinkler, building regulations)? How do operations change from infrastructure provider to service provider?

8 Ops: fire brigade as a Service

9 Agile Infrastructure Engineering 1/2 Close collaboration between Dev & Ops = DevOps Proactive consulting, adding value to the development process Automating processes Accelerate the time-to-market up until self-service by PL/PO/Dev Eliminate manual errors and achieve higher robustness Standardize deployment, monitoring, logging, access control, scaling

10

11 Agile Infrastructure Engineering 2/2 Automation = infrastructure as code Quality assurance like in a software-project Testing the automation process Versioning, changelog, rollback Repeatability, reproducability, traceability By default and from the beginning with security

12 How to prevent cleaning up a mess?

13 Agile Security Engineering 1/3 Also known as AppSec Contributes to success like UX Design, usability, performance, operations A quality aspect of applications Proactively involved in application engineering Security Requirements Security Design/Architecture Security best practices in development Security testing Security Operations (SecOps) Use same language, development cycle and goal as developers

14 Agile Security Engineering 2/3

15 Agile Security Engineering 3/3 Safe software development process = integrity of the application Separation of applications on process level (container, virtual machine) Separation on network level Reproducibility of configuration (dev/test/stageenvironments, Disaster Recovery) Authentication & Authorization Controlling the access to applications RBAC on control plane Logging

16 SecDevOps

17 Securing the Software Delivery Process 1/2

18 Securing the Software Delivery Process 2/2

19 Authentication & Authorization

20 AAI = Keycloak Identity & Access Management Single sign in/out Identity brokering: OpenID Connect (OAuth2 social login, FB/Twitter/Github etc.), SAML2.0, Kerberos User federation: LDAP, ActiveDirectory, custom RDBMS Multi-Factor-Authentication: TOTP/HOTP Managing the Authorization groups

21 Audit Log = ElasticSearch, Logstash, Kibana Logging all access and changes through the control plane Logging all access to the application and correlate with application logs Index, view, filter, aggregate KPI monitoring Store outside of application scope

22 APPUiO.ch Container Platform as a Service On-premises, private or public cloud in Switzerland Based on Docker, Kubernetes, OpenShift Run on any infrastructure Turnkey platform with proactive support Consulting services to become cloud native and integration From YoloOps to RelaxOps

23 Thank you Questions? VSHN AG Aarno Aukia Neugasse Zürich