Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Auditing Your Automation's Access... Using More...

Rosemary Wang
October 19, 2022

Auditing Your Automation's Access... Using More Automation

Originally presented at Datadog DASH 2022.

From CI/DI pipelines to container orchestrators to developer debugging tools, you spend years building the automation needed to scale your systems. As we grow our automation footprint over time, we grant more and more access to new systems. But how do you know if that automation is accessing the right systems at the right time? And more recently, we’ve encountered new incidents in which an unauthorized user can exploit automation, compromise credentials, and access systems with us completely unaware.

This talk will discuss ways to build observability into your automation in order to audit its access across different parts of the software development lifecycle. Whether clicking on various things in the console or uploading .tar.gz files, too much human access to the phases of the SDLC can be risky. We will look at automation within your CI/CD pipelines and services, and talk through use cases where the replacement of human access might benefit from automation.

We will also outline some techniques to maintain least-privilege access, mitigate blast radius of compromised credentials, and better observe interactions between services so you quickly identify unauthorized access.

You will learn about managing, aggregating, and configuring audit logging and metrics using:
- Service mesh for authorization
- Secrets management for credentials
- Secure access management for manual access to systems

By the end of this talk, you will be able to identify ways to better secure your automation and observe its access across a system.

Rosemary Wang

October 19, 2022
Tweet

More Decks by Rosemary Wang

Other Decks in Technology

Transcript

  1. Time to Resolution Reduce time for these stages. Fix automation.

    Identify security issue. Recognize and remediate.
  2. Automation need lots of access. Example - Deployment Pipelines •Check

    out code •Build infrastructure •Deploy application •Test application •Check code quality Need access to… •Version control •Infrastructure provider •Platform/release repository •Data/other services •Quality assurance tool
  3. Why audit access? Observe service interactions Maintain least privilege Identify

    and mitigate blast radius Standardize event information
  4. Engineers need access to build. Engineers… •Test •Debug •Deploy Needs

    access to… •Production Applications •Databases •Managed Services •Infrastructure APIs •Platform APIs
  5. Track human interactions Audit logs from cloud providers Audit logs

    from managed services Audit logs from secure access management tools
  6. Services need access to other services. Services… •Test •Debug •Deploy

    Need access to… •Production Applications •Databases •Managed Services •Infrastructure APIs •Platform APIs
  7. Track production interactions Audit logs from secrets manager Audit logs

    from providers Audit logs from secure access management tools
  8. Event-Driven Access Control WEBHOOK DATADOG Declare incident. status: active BOUNDARY

    Authorizes engineers to open sessions. Create temporary role with access to production.
  9. Event-Driven Access Control WEBHOOK DATADOG Resolve incident. status: resolved BOUNDARY

    Revokes access and terminates sessions. Delete temporary role with access to production.
  10. Why audit access? Observe service interactions Maintain least privilege Identify

    and mitigate blast radius Standardize event information
  11. Time to Resolution Reduce time for these stages. Fix automation.

    Identify security issue. Recognize and remediate.