Security as Code A SecDevOps Use Case
summary
Kenna documents security policy as executable cookbooks (Chef) and auto-tests them in CI (CircleCI) while feeding alerts into Slack/ELK and PagerDuty; open source cookbooks include mod_security, iptables, Nessus and Duo integrations. A lightweight asset fingerprinting tool called tattle queries package CPEs and maps to NVD CVEs instead of slow full scans; deployments are frequent and small, tests focus on changed code, and pull requests provide audit-friendly segregation of duties; goal for the toolchain iteration is about 3.14 days.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 1:23Agenda
- 3:13Shoutout
- 3:47Security in DevOps
- 5:08Patch forwarding
- 6:08Frequent Changes
- 7:45Static Requirements
- 8:30Security Cookbooks
- 11:19Testing Process
- 12:45Cookbooks
- 14:29APIs
- 17:07Vulnerability Scanning
- 19:38Log Stash
- 20:36Vulnerability List
- 21:06Know Your Assets
- 21:28Cake
- 21:46Assumptions
- 22:17Summary
- 23:41Questions
related talks
29mThe SecDevOpronomicon
45mDevSecOps : add Security to your DevOps!
33mSecurity as Code: A DevSecOps Approach
40mSecurity-as-Code to Accelerate DevSecOps, a Practical Guide to Get Started
31mDevSecOps, or How to Integrate Security into DevOps Practices
37mSecurity as Code: A DevSecOps Approach
32mHow to fit Sec into DevOps without Security team
59mSecurity as Code: A DevSecOps Approach