1 / 35

The Defense RESTs: Automation and APIs for Better Security

The Defense RESTs: Automation and APIs for Better Security. September 26, 2012. David Mortman. Introduction. Want to get better at security? . Improve your operations. Improve your developement. The Problem. Huge % of incidents revolve around operational or coding issues. Why?.

ena
Download Presentation

The Defense RESTs: Automation and APIs for Better Security

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. The Defense RESTs: Automation and APIs for Better Security September 26, 2012 David Mortman

  2. Introduction

  3. Want to get better at security?

  4. Improve your operations

  5. Improve your developement

  6. The Problem

  7. Huge % of incidents revolve around operational or coding issues

  8. Why?

  9. People Are Bad At Repeatable Tasks!

  10. Centralization, automation & testing can address this

  11. Use APIs and existing ops/devtools!

  12. Chef, Puppet, etc

  13. Compliance & Change Control

  14. Configuration Drift AKA Variation is Evil

  15. Key Management

  16. Auto-Scaling

  17. Auto-scanning on VM launch

  18. INSTANCE=`ec2-run-instances $AMI -t $TYPE -k $KEY | grepi- | cut -f 2`; until [ $IP ]; do sleep 15; IP=`ec2-describe-instances $INSTANCE | grepi- | cut -f 17`; done ; curl -H "X-Requested-With: DM Automation" -u $USER:$PASS "https://qualysapi.qualys.com/msp/asset_ip.php?action=add&host_ips=$IP"; curl -H "X-Requested-With: DM Automation" -u $USER:$PASS "https://qualysapi.qualys.com/msp/scan.php?ip=$IP&save_report=yes"

  19. Jenkins

  20. Findbugs et al. http://findbugs.sourceforge.net/

  21. Functional and Unit Testing

  22. Positive and Negative Testing

  23. Gauntlt https://github.com/thegauntlet/gauntlt

  24. Auto-code/site scanning on commit

  25. PUT https://sentinel.whitehatsec.com/api/vuln/retest/<id>

  26. A Little DevOps

  27. Woodward: Code Changes & Complexity

  28. APIs: REST vs SOAP

  29. Future Directions & Resources

  30. iControl & Space

  31. IF-MAP

  32. Security Automation List SecurityAutomata.Com

  33. IAM SCIM/XACML

  34. Conclusion

  35. Any questions? David MortmanChief Security Architectdavid.mortman@enstratus.com@mortman

More Related