implementing a devsecops approach in cloud
TRANSCRIPT
Sumo Logic Confidential
Implementing and Maintaining a DevSecOps Approach in the CloudOperational and Security Tips, Tricks and Best Practices
Wednesday January 2510am PST / 12 noon CST
Sumo Logic Confidential
Today’s PresentersGeorge Gerchow, VP Security & Compliance As Sumo Logic's Vice President of Security and Compliance, George Gerchow brings 18 years of information technology and systems management expertise to the application of IT processes and disciplines. His expertise impacts the security, compliance, and operational status of complex, heterogeneous, virtual and cloud computing environments. Mr. Gerchow's practical experience and insight from managing the infrastructures of some of the world's largest corporate and government institutions, make him a highly regarded speaker and invited panelist on topics including cloud secure architecture design, virtualization, configuration management, operational security and compliance. George was one of the original founders of the VMware Center for Policy and Compliance and he holds CISSP, ITIL, Cisco, and Microsoft Certifications. Mr. Gerchow is also an active Board Member for several technology start ups and the coauthor of Center for Internet Security Quick Start Cloud Infrastructure Benchmark v1.0.0 and is a Faculty Member for IANS Institute of Applied Network Security.Mark Bloom, Dir. Product Marketing, Security & ComplianceMark has over 15 years of sales, marketing and business development experience in a variety of financial service and high-technology markets. Past clients/employers have included Ford, Motorola, United Technologies, Cisco, Chrysler, SonicWall/Dell, Trend Micro and Compuware.
Sumo Logic Confidential
DevSecOps in the Cloud
"Security must be more tightly integrated into the DevOps process to deliver a DevSecOps process that builds in security from the earliest stages of application design."
Gartner Top 10 Strategic Technology Trends for 2016: Adaptive Security Architecture
Gartner Top 10 Strategic Trend for 2016
http://www.gartner.com/document/3229017
Sumo Logic Confidential
Challenges
Sumo Logic Confidential
Security Challenges in Our Cloud Journey
• Starts simple, get more complex• CSP offerings are growing• Filling in the CSP offerings with 3rd party
solutions• Compliance, audit and more regulations are
coming• Attacks on the Cloud are increasing
Sumo Logic Confidential
Sumo Logic’s AWS Footprint
Sumo Logic Confidential
1,300+Customers in the cloud
100+ PBData Analyzed Daily
10M+Keys Under Management
Sumo Logic at Scale in the Cloud
SECURITY BAKED IN
10K+EC2 Instances
Sumo Logic Confidential
Sumo Logic’s AWS Technology Stack
Sumo Logic Confidential
The Sumo Logic Security Stack in AWS Cloud
Sharedresponsibility
Functional Areas:• Threat Intelligence• File Integrity
Monitoring• IDS / IPS• End Point Protection• Security Analytics
Sumo Logic Confidential
Drinking Your Own Champagne
Sumo Logic Confidential
AWS Operational and Security Visibility
Sumo Logic Confidential
Regulatory Compliance
Sumo Logic Confidential
Sumo Logic: Fully SecureProtecting Customer Data with Best-in-Class Security
• PCI/DSS 3.1 Service Provider Level 1 Certified• SOC 2 Type attestation• ISO 27001 certified• CSA Star certified• HIPAA-HITECH compliance• U.S. – EU Privacy Shield• AES 256-bit encryption at rest• TLS encryption in transit• FIPS 140-2 compliant
Industry’s Most Secure
Cloud-Native Analytics Service
Sumo Logic Confidential
Sumo Logic PCI App for AWS CloudTrailProtecting Customer Data with Best-in-Class Security
Sumo Logic Confidential
Security & Operational Excellence
Sumo Logic Confidential
Security, Compliance & Operational Excellence
PLATFORM SECURITY
CONTINUOUS MONITORING
COMPLIANCE
END POINT PROTECTION
Sumo Logic Confidential
Threat Landscape
Sumo Logic Confidential
• Password Hygiene is still the #1 threat to security
• People who should be the most responsible are not
• Audit everything• BitCoin Miners
The Cloud Attack that never goes away
Sumo Logic Confidential
Bitcoin mining in AWS
• Only 21 Million BitCoin Allowed to be Mined• International Non Regulated Currency• AWS GPU EC2 P2 Instances are perfect for mining Bitcoins• Use two-factor authentication.• Never hardcode your cloud computing credentials• Use Identity Access Management
Seeking Free Compute Power! please put your AWS credentials into a config file and upload to GitHub
“Don’t put your Amazon credentials into source code and then share that source code in a public place like GitHub!”
Sumo Logic Confidential
• Recent DDoS attacks targeted Dynamic Network Services Inc., better known as Dyn• Dyn is one of many DNS providers to AWS• AWS has some services (Shield)in place to help, and we have 3rd party tools but…• Could AWS eat itself or be used to attack Azure in Mass?“Security may be critical, but “agility is the single biggest reason enterprise are
moving to the cloud”
The latest Akamai security report highlights a 138 percent YoY increase in total DDoS attacks greater than 100 Gbps, with two record DDoS attacks caused by the Mirai Botnet
Sumo Logic Confidential
Sumo Logic Confidential
In Summary
Simplicity & visibility = scale
SecOps: Do more with less
Visibility & compliance
Sumo Logic Confidential
Sign up for a free trial of Sumo Logic at:https://www.sumologic.com/signup-free