Compliance as Code

Compliance is an important part of IT systems. It is often performed only as a regular annual audit. The auditors pick up samples of data to check. They can’t check all the data.

I went through classical audits, where you fill tens of excel sheets and then consult with internal audit what and how to improve etc. As SRE (Site Reliability Engineer) deals with monitoring and automation, there is also depriving people of manual work. I have seen how the problem is solved on a large scale (cloud providers). I have experience with Oracle Cloud Infrastructure (OCI) and Amazon Web Services (AWS). I’ll show you how to move from Excel to an automatic, near real-time compliance check solution using Chef Inspec Framework.

Transcript

1. Compliance as Code Ladislav Prskavec Ladislav Prskavec - itSMF, 23. 1. 2020 1
2. Who Am I 4 Senior Manager in Oracle Cloud Infrastructure 4 Twitter: @abtris 4 Blog and talks: https://blog.prskavec.net/ Ladislav Prskavec - itSMF, 23. 1. 2020 2
3. Compliance Ladislav Prskavec - itSMF, 23. 1. 2020 3
4. Ladislav Prskavec - itSMF, 23. 1. 2020 4
5. Automating Away the Regulatory Compliance Myth Ladislav Prskavec - itSMF, 23. 1. 2020 5
6. Regulatory Compliance Ladislav Prskavec - itSMF, 23. 1. 2020 6
7. Ladislav Prskavec - itSMF, 23. 1. 2020 7
8. Ladislav Prskavec - itSMF, 23. 1. 2020 8
9. Ladislav Prskavec - itSMF, 23. 1. 2020 9
10. Language is key Ladislav Prskavec - itSMF, 23. 1. 2020 10
11. 6.2.1 Set SSH Protocol to 2 (Scored) Profile Applicability: - Level 1 Description: SSH supports two different and incompatible protocols: SSH1 and SSH2. SSH1 was the original protocol and was subject to security issues. SSH2 is more advanced and secure. Rationale: SSH v1 suffers from insecurities that do not affect SSH v2. Audit: To verify the correct SSH setting, run the following command and verify that the output is as shown: # grep "^Protocol" /etc/ssh/sshd_config Protocol 2 Remediation: Edit the /etc/ssh/sshd_config file to set the parameter as follows: Protocol 2 Ladislav Prskavec - itSMF, 23. 1. 2020 11
12. control 'ssh-04' do impact 1.0 title 'Client: Specify protocol version 2' desc "Only SSH protocol version 2 connections should be permitted..." describe ssh_config do its('Protocol') { should eq('2') } end end 4 ssh_spec.rb Ladislav Prskavec - itSMF, 23. 1. 2020 12
13. Compliance as Code 4 Defining Policies Upfront 4 Automated Gates and Checks 4 Managing Changes in Continuous Delivery 4 Separation of Duties in the DevOps Audit Toolkit 4 Using the Audit Defense Toolkit 4 Code Instead of Paperwork Ladislav Prskavec - itSMF, 23. 1. 2020 13
14. Chef Inspec framework www.inspec.io - 1.0 Sep 2016 Ladislav Prskavec - itSMF, 23. 1. 2020 14
15. Ladislav Prskavec - itSMF, 23. 1. 2020 15
16. Define policies Ladislav Prskavec - itSMF, 23. 1. 2020 16
17. How to start Ladislav Prskavec - itSMF, 23. 1. 2020 17
18. DevSec Hardening Framework Baselines Ladislav Prskavec - itSMF, 23. 1. 2020 18
19. Ladislav Prskavec - itSMF, 23. 1. 2020 19
20. Ladislav Prskavec - itSMF, 23. 1. 2020 20
21. Ladislav Prskavec - itSMF, 23. 1. 2020 21
22. Ladislav Prskavec - itSMF, 23. 1. 2020 22
23. Ladislav Prskavec - itSMF, 23. 1. 2020 23
24. Ladislav Prskavec - itSMF, 23. 1. 2020 24
25. Ladislav Prskavec - itSMF, 23. 1. 2020 25
26. Automate audit Ladislav Prskavec - itSMF, 23. 1. 2020 26
27. Metrics # HELP inspec_checks_total Number of inspec checks # TYPE inspec_checks_total gauge inspec_checks_total{profile="ssl-baseline",status="passed"} 6 inspec_checks_total{profile="ssl-baseline",status="failed"} 0 inspec_checks_total{profile="ssl-baseline",status="skipped"} 0 4 prometheus_inspec_exporter by Dave Cadwallader Ladislav Prskavec - itSMF, 23. 1. 2020 27
28. Ladislav Prskavec - itSMF, 23. 1. 2020 28
29. Summary 4 Why Compliance? 4 Why Compliance as code? 4 Why Automated audit? Ladislav Prskavec - itSMF, 23. 1. 2020 29
30. Q & A Or ask on twitter: @abtris Ladislav Prskavec - itSMF, 23. 1. 2020 30