Compliance and auditing with Puppet

Compliance and auditing with Puppet@petersouter
Peter Souter
Senior Professional Services Engineer | Puppet
@petersouter
Compliance and auditing
with Puppet

2
Who
am I?
@petersouter
Senior Professional
Services Engineer
5 years using Puppet
2 years @ Puppet Inc
Help customers deploy
Puppet
Teach Puppet classes
Contribute to the
community and
open-source
petems
IRC/Slack/GitHub

Warning: I speak quickly
And I have a different accent...
3

Warning: I am not a lawyer or auditor
Always go speak to one of them before implementing
some of the stuff I’m talking about!
4

So, why are we here?
(This room specifically, listening to this talk...)
5

Show of hands in the room
Who has to deal with IT compliance or auditing in their
current role?
6

What does it mean?
So what is compliance?
7

“Many organisations in the public sector and the regulated
industries, such as utilities and legal or financial services,
have to demonstrate an information security policy that
proves they have a range of steps and measures in
place...If these policies are not adhered to, the
regulators reserve the right to prosecute”
- http://www.computerweekly.com/feature/Information-security-The-route-to-compliance
8

Compliance is not security!
Sidebar: Important distinction
9

It’s the ops equivalent of planning permission, zoning laws,
building guidelines etc.
“Compliance is the discipline of
verification at scale”
10

How could you ever check every single one of them, and
what should you be prioritising?
Think about how many files, scripts,
artifacts and services make up your estate
11

● Who’s responsible?
● Who runs the scans?
● Who fixes things when they go wrong?
This means compliance straddles an
awkward organisational line
12

Regardless: Someone has told you you
need to follow the rules
Either for best practise or legal reasons...
13

Alphabet Soup
Control Objectives for Information and related Technology (COBIT)
Defense Information Systems Agency (DISA) STIGs
Federal Information Security Management Act (FISMA)
Federal Desktop Core Configuration (FDCC)
Gramm-Leach-Bliley Act (GLBA)
Health Insurance Portability and Accountability Act (HIPAA)
ISO 27002/17799 Security Standards
Information Technology Information Library (ITIL)
National Institute of Standards (NIST) configuration guidelines
National Security Agency (NSA) configuration guidelines
Payment Card Industry Data Security Standards (PCI DSS)
Sarbanes-Oxley (SOX)
Site Data Protection (SDP)
United States Government Configuration Baseline (USGCB)
California’s Security Breach Notification Act - SB 1386
14

You might have your own hardening policies
Removing non-essential users etc.
15

16
● Founded in October, 2000
● It is composed of roughly 180
members from 17 different countries.
● Wide range of entities, including
academia and the government
● Kind of a non-government fork of the
STIG standards
“Enhance the cyber security readiness and response of public and private sector entities, with a
commitment to excellence through collaboration”
Center for Internet Security (CIS)

17
CIS standard exist for a lot of applications and tools:
Amazon Linux, Amazon Web Services
Apache Tomcat, Apache HTTP Server Assessment Tool
Apple iOS, Apple OSX, Apple Safari, Benchmark Mappings: Medical Device Security Standards
CentOS Linux, CheckPoint Firewall, Cisco Device
Debian Linux, Distribution Independent Linux, Docker, FreeBSD, FreeRadius, Google Android,
Google Chrome, HP-UX, IBM AIX, IBM DB2, IBM DB2 Benchmark Archive
ISC BIND, Juniper Device, Kerberos, LDAP, Microsoft Exchange Server, Microsoft IIS, Microsoft
Internet Explorer, Microsoft MS SQL Server, Microsoft Office, Microsoft SharePoint Server,
Microsoft Windows 10, Microsoft Windows 7, Microsoft Windows 8, Microsoft Windows NT,
Microsoft Windows Server 2000, Microsoft Windows Server 2003, Microsoft Windows Server
2008, Microsoft Windows Server 2012, Microsoft Windows XP, Mozilla Firefox, MySQL
Novell Netware, Opera, Oracle Database Server, Oracle Database Server Assessment Tool
Oracle Linux, Oracle Solaris, Red Hat Linux, Slackware Linux, SuSE Linux, Sybase ASE, Ubuntu
VMware, Wireless Network Devices, Xen

A lot of the time, you have to dig through a lot of
legalese to get to an engineerable problem
18
And whether your engineering solution actually succeeds
in it’s goal is entirely up to the discretion of your auditor

An example: HIPAA
Health Insurance Portability and Accountability Act of 1996
19

The HIPAA Security Rule establishes national standards to
protect individuals’ electronic personal health information
that is created, received, used, or maintained by a covered
entity. The Security Rule requires appropriate
administrative, physical and technical safeguards to ensure
the confidentiality, integrity, and security of electronic
protected health information.
The Security Rule is located at 45 CFR Part 160 and
Subparts A and C of Part 164.
- https://www.hhs.gov/hipaa/for-professionals/security/index.html
20

Ok, let's go digging
Let's look for 45 CFR Part 160 and Subparts A and C of 164
21

PART 160—GENERAL ADMINISTRATIVE REQUIREMENTS
Contents
Subpart A—General Provisions
§160.101 Statutory basis and purpose.
§160.102 Applicability.
§160.103 Definitions.
§160.104 Modifications.
§160.105 Compliance dates for implementation of new or modified standards and implementation
specifications.
Subpart B—Preemption of State Law
§160.201 Statutory basis.
§160.203 General rule and exceptions.
§160.204 Process for requesting exception determinations.
§160.205 Duration of effectiveness of exception determinations.
Subpart C—Compliance and Investigations
§160.302 [Reserved]
§160.304 Principles for achieving compliance.
§160.306 Complaints to the Secretary.
§160.308 Compliance reviews.
§160.310 Responsibilities of covered entities and business associates.
§160.312 Secretarial action regarding complaints and compliance reviews.
§160.314 Investigational subpoenas and inquiries.
§160.316 Refraining from intimidation or retaliation.
Subpart D—Imposition of Civil Money Penalties
§160.402 Basis for a civil money penalty.
§160.404 Amount of a civil money penalty.
§160.406 Violations of an identical requirement or prohibition.
§160.408 Factors considered in determining the amount of a civil money penalty.
§160.410 Affirmative defenses.
§160.412 Waiver.
§160.414 Limitations.
§160.416 Authority to settle.
§160.418 Penalty not exclusive.
§160.420 Notice of proposed determination.
§160.422 Failure to request a hearing.
§160.424 Collection of penalty.
§160.426 Notification of the public and other agencies.
Subpart E—Procedures for Hearings
45 CFR Part 164, Subpart C - Security
Standards for the Protection of Electronic
Protected Health Information
§ 164.302 — Applicability.
§ 164.304 — Definitions.
§ 164.306 — Security standards: General
rules.
§ 164.308 — Administrative safeguards.
§ 164.310 — Physical safeguards.
§ 164.312 — Technical safeguards.
§ 164.314 — Organizational requirements.
§ 164.316 — Policies and procedures and
documentation requirements.
§ 164.318 — Compliance dates for the initial
implementation of the security standards.
22

PART 160—GENERAL ADMINISTRATIVE REQUIREMENTS
Contents
Subpart A—General Provisions
§160.101 Statutory basis and purpose.
§160.104 Modifications.
§160.105 Compliance dates for implementation of new or modified standards and implementation
specifications.
Subpart B—Preemption of State Law
§160.201 Statutory basis.
§160.203 General rule and exceptions.
§160.204 Process for requesting exception determinations.
§160.205 Duration of effectiveness of exception determinations.
Subpart C—Compliance and Investigations
§160.302 [Reserved]
§160.304 Principles for achieving compliance.
§160.306 Complaints to the Secretary.
§160.308 Compliance reviews.
§160.310 Responsibilities of covered entities and business associates.
§160.312 Secretarial action regarding complaints and compliance reviews.
§160.314 Investigational subpoenas and inquiries.
§160.316 Refraining from intimidation or retaliation.
Subpart D—Imposition of Civil Money Penalties
§160.402 Basis for a civil money penalty.
§160.404 Amount of a civil money penalty.
§160.406 Violations of an identical requirement or prohibition.
§160.408 Factors considered in determining the amount of a civil money penalty.
§160.410 Affirmative defenses.
§160.412 Waiver.
§160.414 Limitations.
§160.416 Authority to settle.
§160.418 Penalty not exclusive.
§160.420 Notice of proposed determination.
§160.422 Failure to request a hearing.
§160.424 Collection of penalty.
§160.426 Notification of the public and other agencies.
Subpart E—Procedures for Hearings
45 CFR Part 164, Subpart C - Security
Standards for the Protection of Electronic
Protected Health Information
§ 164.302 — Applicability.
§ 164.304 — Definitions.
§ 164.306 — Security standards: General
rules.
§ 164.308 — Administrative safeguards.
§ 164.310 — Physical safeguards.
§ 164.312 — Technical safeguards.
§ 164.314 — Organizational requirements.
§ 164.316 — Policies and procedures and
documentation requirements.
§ 164.318 — Compliance dates for the initial
implementation of the security standards.
23

Technical Safeguards!
Finally we’re getting somewhere...
24

§ 164.312 Technical safeguards.
A covered entity or business associate must, in accordance with § 164.306:
(a)
(1) Standard: Access control. Implement technical policies and procedures for electronic information systems that maintain
electronic protected health information to allow access only to those persons or software programs that have been granted access
rights as specified in § 164.308(a)(4).
(2) Implementation specifications:
(i) Unique user identification (Required). Assign a unique name and/or number for identifying and tracking user identity.
(ii) Emergency access procedure (Required). Establish (and implement as needed) procedures for obtaining necessary
electronic protected health information during an emergency.
(iii) Automatic logoff (Addressable). Implement electronic procedures that terminate an electronic session after a
predetermined time of inactivity.
(iv) Encryption and decryption (Addressable). Implement a mechanism to encrypt and decrypt electronic protected health
information.
(b) Standard: Audit controls. Implement hardware, software, and/or procedural mechanisms that record and examine activity in
information systems that contain or use electronic protected health information.
25

The pain of compliance will be directly correlated
to the relationship with your auditors
Ultimately, they are the ones that you need to prove that
you are in compliance too
26

● Emails
● PDFs
● Dead trees
● Humans
27
Unfortunately, this is often a manual process

There’s got to be a better way!
If only there was something better...
28

A series of rules for systems that need to
be enforced and reported on
What is IT compliance?
29

A series of rules for systems that need to
be enforced and reported on
What is Puppet?
30

Great, let's use Puppet!
31
But...what’s so great about using Puppet to enforce these
standards?

Reduce cost and time per release
32
Pre-existing code for known standards often available

Potential for sharing and reuse
33
Share within your company or with the public

Single Source of Truth
34
Your infrastructure as code repository becomes your one
place to look for compliance code

Less arguments about semantics
35
Agreed upon Puppet DSL means closer collaboration
between policymakers and practitioners

Make time for the things that can’t be automated
36
Not everything can be automated, like physical safeguards

Let’s pick a really basic example
How does this look like in action?
37

38
- https://benchmarks.cisecurity.org/tools2/linux/CIS_CentOS_Linux_7_Benchmark_v1.1.0.pdf

1.2.3 Verify that gpgcheck is Globally Activated
- Profile Applicability: Level 1
- Description: The gpgcheck option, found in the main section of the /etc/yum.conf file
determines if an RPM package's signature is always checked prior to its installation.
- Rationale: It is important to ensure that an RPM's package signature is always checked
prior to installation to ensure that the software is obtained from a trusted source.
- Audit: Run the following command to verify that gpgcheck is set to 1 in all occurrences
of the /etc/yum.conf file:
$ grep gpgcheck /etc/yum.conf gpgcheck=1
- Remediation: Edit the /etc/yum.conf file and set the gpgcheck to 1 as follows:
gpgcheck=1
An example from CIS CentOS 7 Standards
39

Reflected in Puppet
# 1.2.3 - Verify that gpgcheck is globally Activated (Scored)
file { '/etc/yum.conf':
ensure => file,
owner => 'root',
group => 'root',
mode => '0644',
}
file_line { '(1.2.3) /etc/yum.conf contains gpgcheck=1':
ensure => present,
path => '/etc/yum.conf',
line => 'gpgcheck=1',
}
40

Dedicated modules for compliance?
Use existing code and enforce standards?
Dry run modes when silo’d or change frozen?
A few different design approaches
available here...
41

Dedicated modules for compliance
42
class cis_rhel7::rule::rule_1_2_3 {
# includes Rules:
# 1.2.3 - Verify that gpgcheck is Globally Activated (Scored)
file { '/etc/yum.conf':
ensure => file,
owner => 'root',
group => 'root',
mode => '0644',
}
file_line { '(1.2.3) /etc/yum.conf contains gpgcheck=1':
ensure => present,
path => '/etc/yum.conf',
line => 'gpgcheck=1',
}
} #EOF
https://forge.puppet.com/perfecto25/cis_rhel7

Use existing module and enforce standards
43
class { 'yum':
gpgcheck => true,
}

Personally, I think you should use existing modules
44
However: dedicated compliance modules can work if
compliance is the primary use case or you have silo’d
teams

baseline_compliance
45
- https://forge.puppet.com/ccaum/baseline_compliance

Baseline compliance example
46
Info: Using configured environment 'production'
Info: Retrieving pluginfacts
Info: Retrieving plugin
Notice: Compiled catalog for master.vm in environment production in 8.78 seconds
Notice: Compiled catalog for master.vm in environment baseline in 0.03 seconds
Info: Adding baseline Notify[message] resource to catalog
Warning: Resource File[/tmp/example]'s parameter 'group' value of 'pe-puppet' is overwriting baseline value of
'0'
Info: Adding baseline parameter 'mode' with value '0755' to resource File[/tmp/example]
Info: Caching catalog for master.vm
Info: Applying configuration version '1468390945'

There’s a lot of prior art for this work
Remember when we talked about
sharing and reuse?
47

DEV-SEC.IO
48

SIMP - System Integrity Management Platform
49
- https://simp-project.com/

SIMP - Compliance Mapper
50
- https://github.com/simp/pupmod-simp-compliance_markup

Puppet Forge and Github
Check the community hubs
51

52

However there are two parts to IT compliance
53
1. Enforcement
2. Reporting

Custom facts can be used to show compliance
54
They’re generally better at the enforcing bit

Custom facts for compliance checking
55
Facter.add(:cis) do
confine :osfamily => "RedHat"
confine :operatingsystemmajrelease => '7'
cishash = {}
setcode do
returnval = Facter::Core::Execution.exec('egrep
'^[[:space:]]*[^#]*[[:space:]]*gpgcheck[[:space:]]*=[[:space:]]*1' /etc/yum.conf')
if returnval.include? 'gpgcheck'
cishash['1.2.3'] = true
else
cishash['1.2.3'] = false
end
cishash
end
end

There’s normally an approval process or tool to
get something signed off as a scanner for a
particular standard
56
eg. PCI, there are ASV (Approved Scanning Vendors)

There’s a bunch of scanning tools out there
57
Nessus, QualysGuard, Nexpose etc

You want to ensure correctness is part of your
processes
58
You want multiple levels of checking

● SCAP is U.S. standard maintained
by National Institute of Standards
and Technology (NIST)
● The OpenSCAP project is a
collection of open source tools for
implementing and enforcing the
standard
● Lots of existing profiles for various
OS’s and compliance standards (PCI
DSS, FISMA)
● Existing integrations with various
tools and projects
OpenSCAP
59

oscap
60
$ yum install openscap-utils scap-security-guide -y
$ oscap xccdf eval --profile common --report
/vagrant/report.html --results /vagrant/results.xml
--cpe /usr/share/xml/scap/ssg/content/ssg-rhel6-cpe-dictionary.xml
/usr/share/xml/scap/ssg/content/ssg-rhel6-xccdf.xml

61

Lets see it in action
62
And hope the live demo fairies are nice!

SCAP Workbench
- https://www.open-scap.org/resources/documentation/make-a-rhel7-server-compliant-with-pci-dss/
63

Foreman/Satellite Integration
- https://www.theforeman.org/plugins/foreman_openscap/0.6/
64

● Hashicorp tool
● Image management
● Provisioners for config management
tools and shell scripts
● Some compliance steps can be hard
to change on a running system
● Werner Buck had a great talk about
compliance standards with Packer:
http://wernerb.github.io/hashiconf-har
dening/
Bake your compliance steps into your base images
Packer
65

Domain Specific Languages to test system correctness
System Testing DSL’s
66

Serverspec
67

Serverspec
describe 'cis_level_1' do
describe file('/etc/yum.conf') do
it { should be_file }
its(:content) { should match /*gpgcheck=1/ }
it { should be_file }
it { should be_mode 644 }
it { should be_owned_by 'root' }
it { should be_grouped_into 'root' }
end
end
68

● goss - https://github.com/aelsabbahy/goss - Inspired by serverspec,
but written in golang
● infrataster - http://infrataster.net/ - Has specific methods and
keywords for http, mysql etc
● testinfra - https://github.com/philpep/testinfra - Python version of
serverspec
● gauntlt - http://gauntlt.org/ - BDD wrappers around common security
tools (nmap, sslyze etc)
● bddsecurity - http://bbdsecurity.com - Similar BDD focussed security
tool
A number of similar and inspired projects
69

Summary
70
What have we learnt?

Compliance is enforcement of standards
71
It’s not security, it’s standards for scaling security

Compliance responsibility can be tricky
72
Try to bring into teams if possible, move security left!

Puppet is a great fit for compliance
73
It fits the model of enforcing rules in a defined way

There’s lots of pre-existing work
74
“Stand on the shoulders of giants”

Enforcement is just one part of the puzzle
75
Reporting is the other half

Want to know more?
76
● A Year in Open Source Automated Compliance With Puppet – Trevor Vaughan at
PuppetConf 2016
https://www.youtube.com/watch?v=a270uDh8muE
● Compliance Is Not Security. Compliance Scales Security.
https://medium.com/compliance-at-velocity/compliance-is-not-security-compliance-scal
es-security-50846e7a47c2#.k63bpravl
● Prove it! The Last Mile for DevOps in Regulated Organizations - DOES15 - Bill
Shinn
https://www.youtube.com/watch?v=gg8gGisl4zM
● The Technical Practises of Integrating Information Security, Change Management
and Compliance
Kim, Gene. 2016. The Devops Handbook: How to Create World-Class Agility,
Reliability, and Security in Technology Organizations. Portland: IT Revolution Press

Q&A
77

Compliance and auditing with Puppet

More Related Content

What's hot (20)

Similar to Compliance and auditing with Puppet (20)

More from Peter Souter (11)

Recently uploaded (20)

Compliance and auditing with Puppet