Download as PDF, PPTX
Uploaded byKarl Ots
Azure Saturday: Security + DevOps + Azure = Awesomeness
The document discusses the Azure Security Kit (AZSK) presented by Karl Ots at Azure Saturday 2018, highlighting the increasing threat landscape in cloud security and the challenges of managing Azure's security features. AZSK aims to enhance security in Azure environments by providing tools for automated checks and secure coding practices, while emphasizing that it is not a complete solution and should be part of a broader security strategy. Key features include security verification tests, continuous assurance setups, and integration into existing DevOps processes.
More Related Content
Similar to Azure Saturday: Security + DevOps + Azure = Awesomeness
Azure Saturday: Security + DevOps + Azure = Awesomeness
- 1. 1 Azure Saturday2018 Security + DevOps + Azure = Awesomeness Karl Ots | Kompozure @fincooper
- 2. 2 Azure Saturday2018 Thank you, sponsors!
- 3. KARL OTS @KOMPOZURE • Co-organizer of IglooConf and PolarConf • Podcast host at Cloud Gossip • Working on Azure since 2011 • Patented inventor • Worked with tens of different customers on full-scale Azure projects, from startups to Fortune 500 enterprises Managing Consultant [email protected] +358 50 480 1102
- 5. SECURITY LANDSCAPE • Cloud-baseduser account attacks have increased 300% YoY (Microsoft Security Intelligence Report, Volume 22) • An attacker is on a victim’s network 99 days on average before they are detected (FireEye/Mandiant report – March 14, 2017) • Average cost of a data breach in 2017 was 4 M $ (IBM security)
- 6. WHY AZSK? • Cloudsecurity is hard. • Knowledge of Azure security controls is not widespread. • MS IT wanted to accelerate internal Azure adoption in a controlled way • Approach: avoid reinventing the wheel o Use as much out-of-the-box Azure features as possible o For example: outsource VM controls to Security Center
- 8. SECURE DEVOPS KITFOR AZURE (AZSK)
- 9.
- 10. SUBSCRIPTION SECURITYSubscription RBAC provisioning Deploy mandatoryand scenario/solution specific accounts/groups on a subscription. Ability to specify and remove deprecated accounts. Alerts setup Configure insights-based alerts for important activities. Runbooks for critical alerts to send SMS with key alert body info. ARM policy setup Deploy and enable ARM policy definitions (e.g., audit/deny use of ASM/v1 resources) ASC setup Configure Azure Security Center by enabling policies, setting security POCs, etc. Resource Locks Ensure that critical enterprise resources have locks deployed on them. Health Check More than a dozen subscription hygiene security checks, including proper provisioning
- 13. SUBSCRIPTION HEALTH SCAN Select-AzureRmSubscription-SubscriptionId $subscriptionId # Sub health scan Get-AzSKSubscriptionSecurityStatus -SubscriptionId $subscriptionId -GeneratePDF Portrait
- 15. DEVELOP SECURELY Feature Scenarios/Details Development Security IntelliSense •Get inline support for secure coding right at the point of code creation. • Checks on Azure Best practices, ADAL and common crypto • VS plug-in for C#. • Security IntelliSense extension works on Visual Studio 2015 Update 3 or later.
- 16.
- 17. “UNIT TEST” AZURESECURITY Feature Scenarios/Details Development Security IntelliSense • Get inline support for secure coding right at the point of code creation. • Checks on Azure Best practices, ADAL and Crypto • VS plug-in for C#. Security Verification Tests • Scan cloud solutions during early dev and prototyping stages. • Provides a variety of options to define scan targets. • Easy, intuitive reports and detailed logs. Support for 25+ Azure IaaS and PaaS service types.
- 18. SECURITY VERIFICATION TESTS Select-AzureRmSubscription-SubscriptionId $subscriptionId # Security Verification Test Get-AzSKAzureServicesSecurityStatus -SubscriptionId $subscriptionId -GeneratePDF Portrait
- 19.
- 20. DEVOPS • Security VerificationTests (SVTs) in VSTS / on-prem TFS pipeline • SVTs in Jenkins pipeline • AzSK ARM Template Checker
- 21. CONTINUOUS ASSURANCE • RunAzSK tests periodically using Azure Automation • Write to Log Analytics • Query with Gusto Query Language • Integrate with your existing systems, such as your SIEM
- 22. #### Deploy theAzSK view in the OMS workspace #### Install-AzSKOMSSolution -OMSSubscriptionId $subscriptionId ` -OMSResourceGroup $omsRGName ` -OMSWorkspaceId $omsWSId ` -ViewName $azSkViewName #### Setup AzSK scan data to OMS #### Set-AzSKOMSSettings -OMSWorkspaceID $omsWSId -OMSSharedKey $omskey #### Run AzSK scripts per usual #### Get-AzSKSubscriptionSecurityStatus -SubscriptionId $subscriptionId #### Run AzSK SVT scan #### Get-AzSKAzureServicesSecurityStatus -SubscriptionId $subscriptionId SETTING UP CONTINUOUS ASSURANCE
- 25. ADVANCED FEATURES • GeneratePDF Report • Generate AutoFix Script • AzSK ARM Templates • Customizing the security policies for your organization
- 26. DISCUSSION • AzSK isnot your magic bullet to tick the security box o AzSK mostly covers “administrative access” in traditional threat models, some “application access” as well o You still have to worry about users, external threats and more o Threat modeling and Defense in Depth approach are your friends! • Carefully analyze the results in the scope of your application – are the recommended controls right for your app?
- 27. RESOURCES • Try outthe Secure DevOps Kit for Azure! • Installation guide, docs: https://github.com/azsk/DevOpsKit -docs • Controls coverage: http://aka.ms/AzSKosstcp • IT Showcase: http://aka.ms/AzSK/itshowcase • Support: [email protected]
- 28. 36 Azure Saturday2018 Azure Saturday 2018 We appreciate your feedback! SLIDESHARE.NET/KARLOTS
- 29. KOMPOZURE WE ROAR ATCHALLENGE