implementing a devsecops approach in cloud

24
Sumo Logic Confidential Implementing and Maintaining a DevSecOps Approach in the Cloud Operational and Security Tips, Tricks and Best Practices Wednesday January 25 10am PST / 12 noon CST

Upload: sumo-logic

Post on 08-Feb-2017

185 views

Category:

Software


3 download

TRANSCRIPT

Page 1: Implementing a DevSecOps Approach in Cloud

Sumo Logic Confidential

Implementing and Maintaining a DevSecOps Approach in the CloudOperational and Security Tips, Tricks and Best Practices

Wednesday January 2510am PST / 12 noon CST

Page 2: Implementing a DevSecOps Approach in Cloud

Sumo Logic Confidential

Today’s PresentersGeorge Gerchow, VP Security & Compliance As Sumo Logic's Vice President of Security and Compliance, George Gerchow brings 18 years of information technology and systems management expertise to the application of IT processes and disciplines. His expertise impacts the security, compliance, and operational status of complex, heterogeneous, virtual and cloud computing environments. Mr. Gerchow's practical experience and insight from managing the infrastructures of some of the world's largest corporate and government institutions, make him a highly regarded speaker and invited panelist on topics including cloud secure architecture design, virtualization, configuration management, operational security and compliance. George was one of the original founders of the VMware Center for Policy and Compliance and he holds CISSP, ITIL, Cisco, and Microsoft Certifications. Mr. Gerchow is also an active Board Member for several technology start ups and the coauthor of Center for Internet Security Quick Start Cloud Infrastructure Benchmark v1.0.0 and is a Faculty Member for IANS Institute of Applied Network Security.Mark Bloom, Dir. Product Marketing, Security & ComplianceMark has over 15 years of sales, marketing and business development experience in a variety of financial service and high-technology markets. Past clients/employers have included Ford, Motorola, United Technologies, Cisco, Chrysler, SonicWall/Dell, Trend Micro and Compuware.

Page 3: Implementing a DevSecOps Approach in Cloud

Sumo Logic Confidential

DevSecOps in the Cloud

Page 4: Implementing a DevSecOps Approach in Cloud

"Security must be more tightly integrated into the DevOps process to deliver a DevSecOps process that builds in security from the earliest stages of application design."

Gartner Top 10 Strategic Technology Trends for 2016: Adaptive Security Architecture

Gartner Top 10 Strategic Trend for 2016

http://www.gartner.com/document/3229017

Page 5: Implementing a DevSecOps Approach in Cloud

Sumo Logic Confidential

Challenges

Page 6: Implementing a DevSecOps Approach in Cloud

Sumo Logic Confidential

Security Challenges in Our Cloud Journey

• Starts simple, get more complex• CSP offerings are growing• Filling in the CSP offerings with 3rd party

solutions• Compliance, audit and more regulations are

coming• Attacks on the Cloud are increasing

Page 7: Implementing a DevSecOps Approach in Cloud

Sumo Logic Confidential

Sumo Logic’s AWS Footprint

Page 8: Implementing a DevSecOps Approach in Cloud

Sumo Logic Confidential

1,300+Customers in the cloud

100+ PBData Analyzed Daily

10M+Keys Under Management

Sumo Logic at Scale in the Cloud

SECURITY BAKED IN

10K+EC2 Instances

Page 9: Implementing a DevSecOps Approach in Cloud

Sumo Logic Confidential

Sumo Logic’s AWS Technology Stack

Page 10: Implementing a DevSecOps Approach in Cloud

Sumo Logic Confidential

The Sumo Logic Security Stack in AWS Cloud

Sharedresponsibility

Functional Areas:• Threat Intelligence• File Integrity

Monitoring• IDS / IPS• End Point Protection• Security Analytics

Page 11: Implementing a DevSecOps Approach in Cloud

Sumo Logic Confidential

Drinking Your Own Champagne

Page 12: Implementing a DevSecOps Approach in Cloud

Sumo Logic Confidential

AWS Operational and Security Visibility

Page 13: Implementing a DevSecOps Approach in Cloud

Sumo Logic Confidential

Regulatory Compliance

Page 14: Implementing a DevSecOps Approach in Cloud

Sumo Logic Confidential

Sumo Logic: Fully SecureProtecting Customer Data with Best-in-Class Security

• PCI/DSS 3.1 Service Provider Level 1 Certified• SOC 2 Type attestation• ISO 27001 certified• CSA Star certified• HIPAA-HITECH compliance• U.S. – EU Privacy Shield• AES 256-bit encryption at rest• TLS encryption in transit• FIPS 140-2 compliant

Industry’s Most Secure

Cloud-Native Analytics Service

Page 15: Implementing a DevSecOps Approach in Cloud

Sumo Logic Confidential

Sumo Logic PCI App for AWS CloudTrailProtecting Customer Data with Best-in-Class Security

Page 16: Implementing a DevSecOps Approach in Cloud

Sumo Logic Confidential

Security & Operational Excellence

Page 17: Implementing a DevSecOps Approach in Cloud

Sumo Logic Confidential

Security, Compliance & Operational Excellence

PLATFORM SECURITY

CONTINUOUS MONITORING

COMPLIANCE

END POINT PROTECTION

Page 18: Implementing a DevSecOps Approach in Cloud

Sumo Logic Confidential

Threat Landscape

Page 19: Implementing a DevSecOps Approach in Cloud

Sumo Logic Confidential

• Password Hygiene is still the #1 threat to security

• People who should be the most responsible are not

• Audit everything• BitCoin Miners

The Cloud Attack that never goes away

Page 20: Implementing a DevSecOps Approach in Cloud

Sumo Logic Confidential

Bitcoin mining in AWS

• Only 21 Million BitCoin Allowed to be Mined• International Non Regulated Currency• AWS GPU EC2 P2 Instances are perfect for mining Bitcoins• Use two-factor authentication.• Never hardcode your cloud computing credentials• Use Identity Access Management

Seeking Free Compute Power! please put your AWS credentials into a config file and upload to GitHub

“Don’t put your Amazon credentials into source code and then share that source code in a public place like GitHub!”

Page 21: Implementing a DevSecOps Approach in Cloud

Sumo Logic Confidential

• Recent DDoS attacks targeted Dynamic Network Services Inc., better known as Dyn• Dyn is one of many DNS providers to AWS• AWS has some services (Shield)in place to help, and we have 3rd party tools but…• Could AWS eat itself or be used to attack Azure in Mass?“Security may be  critical, but “agility is the single biggest reason enterprise are

moving to the cloud”

The latest Akamai security report highlights a 138 percent YoY increase in total DDoS attacks greater than 100 Gbps, with two record DDoS attacks caused by the Mirai Botnet

Page 22: Implementing a DevSecOps Approach in Cloud

Sumo Logic Confidential

Page 23: Implementing a DevSecOps Approach in Cloud

Sumo Logic Confidential

In Summary

Simplicity & visibility = scale

SecOps: Do more with less

Visibility & compliance

Page 24: Implementing a DevSecOps Approach in Cloud

Sumo Logic Confidential

Sign up for a free trial of Sumo Logic at:https://www.sumologic.com/signup-free