2017-02-21 AFCEA West Building Continuous Integration & Deployment (CI/CD) Pipelines in...

DevOpsSec: Building CI/CDwith Security Teams

Shawn WellsChief Security StrategistRed Hat Pubic Sectorshawn@redhat.com || 443-534-0130

NDA REQUIRED | JIM TYRRELL

1/dayRELEASES PER YEAR

1/hour

9

INTRO TO CI/CD

https://www.youtube.com/watch?v=65BnTLcDAJI

sourcerepository

CI/CDengine

dev container

10

INTRO TO CI/CD

https://www.youtube.com/watch?v=65BnTLcDAJI

Meanwhile, in Government:FISMA from an earlier era

● Written in 2003-2004

● Pre GovCloud, C2S, MilCloud

● Pre DevOps, Infrastructure as Code

● Multi-year dev/ship cycles common

● Waterfall dominant

● IT was more manual a decade ago

11

https://www.telos.com/assets/Telos-AWS-white-paper.pdf

Meanwhile, in Government:FISMA from an earlier era

12

13

DevOps + Security

14

Layered Packaging: Separation of Concerns

Operations Architects Application developers

Public and Private Registries

● What security meta-datais available for your images?

● Are the images updatedregularly?

● Are there access controls inthe registry? How strong arethey?

15

Registries: Where do you get your containers?

● Red Hat Container Registry

● Policies to control who can deploy which containers

● Certification Catalog

● Trusted content with security updates

HOST OS

CONTAINER

OS

RUNTIME

APP

HOST OS

CONTAINER

OS

RUNTIME

APP

You need to know . . .

● Will what’s inside your containercompromise your infrastructure?

● Are there known vulnerabilitiesin the application layer?

● Are the runtime and operatingsystem layers up to date?

16

Container Contents Matter

CONTAINER

OS

RUNTIME

APPLICATION

17

Community created portfolio of tools and contentto assess systems for known vulnerabilities.

https://github.com/NSAgovOr direct: https://github.com/OpenSCAP

18

https://github.com/nsagov

19

RHEL7 STIG content, rebased in RHEL 7.3:

● 6,180 commits from 95 people● 441,055 lines of code

OpenSCAP interpreter contains:

● 6,811 commits from 74 people● 157,775 lines of code

“Security Button” RHEL7 Installer:

● 6 people, 90 days

Shipping in RHEL 7:

● Intelligence Community: C2S and CS2

● DoD: RHEL7 Vendor STIG

● Civilian: USGCB/OSPP

● Justice: FBI Criminal Justice Info. Systems(FBI CJIS)

20

Atomic ScanEnables multiple container scanners

21

Red Hat container scanning

API

RED HATCONTAINER SCANNING INTERFACE

Example Pipeline

22

demos!

Thank You

25

Contact Info

LinkedIn: https://www.linkedin.com/in/shawndwells/

EMail: shawn@redhat.com

Cell: 443-534-0130 (US EST)

Blog: https://shawnwells.io

OpenSCAP Slides + Videos:https://github.com/OpenSCAP/scap-security-guide/wiki/Collateral-and-References