Enabling multicloud in the enterprise with DevSecOps

Enabling multicloud in the enterprise with DevSecOps

• 1.
  ENABLING MULTICLOUD IN THE ENTERPRISEWITH DEVSECOPSJosh Boyd, Booz Allen Hamilton Steven Terrana, Booz Allen Hamilton MAY 2019
• 2.
  Why are organizationsembracing DevSecOps? Organizations embrace DevSecOps to continuously deliver high-quality and reliable software to their users. • Culture and teamwork evolves with the intent to build better quality software faster • High-performing teams are needed to maintain balance in the opposing forces of throughput and stability, while both are amplified • DevSecOps realizes the Agile benefits of reducing risk, increasing velocity, and improving quality, but scaled beyond the development lifecycle to the product lifecycle. It increases resiliency, reduces unplanned downtime, and provides production metrics to close the feedback loop to adapt to users and fix software hastily. What is DevSecOps? Encouraging behaviors and designing processes to optimize coordination of software development and IT operations teams. • Emphasis of a team-culture change is greater than that of any particular tool or framework • New approaches amplify teamwork to yield a high-rate of delivery of small-scoped features • Practicing new activities or performing them in new ways to eliminate waste DEVSECOPS IS AT THE HEART FOR ENABLING HIGH-PERFORMING IT TEAMS
• 3.
  TRUSTED SOFTWARE SUPPLYCHAIN BOOZ ALLEN DEVSECOPS PUTS THE SECURITY IN DEVOPS 2 • Shift-left many security and compliance activities as a shared responsibility of the whole team • Educate and automate security vigilance to establish early detection, confidence, and trust required for Continuous Delivery • Perform vulnerability and compliance inspection of dependencies, code, container images, and running applications ACCESSIBILITY ASSURANCE Crawl web pages for compliance with section 508 standards to give developers early warning and opportunity to improve the site while accelerating manual 508 testing. STATIC CODE ANALYSIS Analyze the code written by developers for inadvertent technical and logical flaws that make it vulnerable. CONTINUOUS COMPLIANCE Routinely scan the configuration of hosts or containers in their packaged image state or at runtime for compliance with security policy groups (NIST, CIS, FISMA, STIG, etc.), for required patches, or for configuration drift. DEPENDENCIES Prevent introduction of vulnerabilities from the outside. Scan libraries in dependency repos, source code repos, and on disk for known vulnerabilities. IMAGE SCANNING Unpack and scan dependencies and configuration of the image to be used at runtime for vulnerabilities, out-of-date patching, and to ensure a trusted pedigree. DYNAMIC APPLICATION SECURITY TESTING Perform automated penetration testing to see how your application will withstand common attacks at runtime. CONTINUOUS SECURITY & COMPLIANCE IS PERVASIVE IN OUR DEVOPS APPROACH. IT CROSS-CUTS EVERY PRACTICE AREA Security and compliance are indicative of the same software delivery sins that spawned the DevOps movement. Work piles up because it is tedious, foreign, or difficult. Security pros are alienated and left to burn down the pile in isolation, as an afterthought. True concerns then become hugely disruptive, which breeds further discontent within the team. AS WITH QUALITY ASSURANCE, SECURITY ASSURANCE AND COMPLIANCE CAN BE INTEGRATED INTO YOUR SOFTWARE DEVELOPMENT LIFECYCLE
• 4.
  Booz Allen Capabilities: •Solutions Delivery Platform – Booz Allen’s open source enterprise DevSecOps capability at scale • Virtual Cloud Defense (VCD) – Booz Allen’s capability for a common security framework across cloud service providers • Multi-Cloud – Booz Allen’s capability for achieving various levels of maturity Featured Concepts: • Multi-Region Databases • SDN Supported Network Partitioning • Accelerated Application Accreditation & ATO Multi-Cloud Capabilities: Centralized Management / Orchestration • Ability to manage provisioning, enforce policy and chargeback across multiple cloud service providers. • Scaling within cloud based on performance demands and resource limits Workload Optimization • Position applications within CSP providing necessary services Disaster Recovery / COOP • Application Replication and Data Synchronization across cloud services providers, Traffic Routing / Failover in the event of outage. High Availability (Active / Active) • Ability to simultaneously operate common application payloads across multiple cloud services providers • Multi-Cloud Data Persistence, Intelligent Traffic Load Balancing • Scaling across cloud service providers/CSP regions WHAT DOES MULTI-CLOUD MEAN TO US 3
• 5.
  MULTI-CLOUD/MULTI-TENANT LOGICAL ARCHITECTURE
• 6.
  MULTI CLOUD NETWORKTOPOLOGY • This used to be a lot harder before November: • And then you had to configure high availability VPNs in your hubs, now you can do this purely with AWS and Azure provided services. • AWS Transit Gateway was created to connect VPCs and on-prem networks with a single gateway, but it works great to connect to other CSPs too! 5
• 7.
  MULTI CLOUD PROVISIONINGDEMO 6Booz Allen Hamilton Internal
• 9.
  Security Profile Compliance THE DEVSECOPSPIPELINE IS A TRUSTED SOFTWARE SUPPLY CHAIN 8Booz Allen Hamilton Internal ENVIRONMENT PROMOTION Production Readiness / Maturity Select Story for Development Pull source code from SCM repo Unit Test Code Coverage Build Container Image CVEs Tag Image with Git SHA Publish Image Static Code Analysis Functional Testing Regression Testing Integration Testing Download Build Dependencies Generate BOM Sign Image Development Test / QA Staging Production Load Testing Soak Testing Validate Image Signature Validate Runtime Configs Validate Image Signature Validate Runtime Configs Validate Image Signature Validate Runtime Configs Log Aggregation Resource Utilization Continuous Runtime Security Scan Build Dependencies Accessibility Compliance Scan Penetration Testing ACAS & HBSS Scan Fuzzing DEPLOY TO PRODUCTION MONITORSYSTEM TESTINGDEPLOY TO STAGINGSYSTEM TESTINGDEPLOY TO TESTPUBLISH ARTIFACTSCAN ARTIFACTBUILD ARTIFACTTESTPLAN & DEVELOP Scan Image
• 10.
  THE SOLUTIONS DELIVERYPLATFORM (SDP) IS THE PURPOSE-BUILT SOLUTION THAT ENABLES OUR PHILOSOPHY AND PUTS PROCESSES AND PRACTICES INTO ACTION 9Booz Allen Hamilton Internal BENEFITS • End-to-end traceability of delivery • Real-time status at a glance • Single view of multiple apps/ components and teams • High-fidelity drill-down to activity-specific metrics • Automate delivery, and assurance of security & quality • Enable secure, on-demand flow of new features • Continuous, quantitative, and actionable feedback • Shifting-left security and streamlining activities mitigates risk by avoiding big and long releases • Productivity increase with self-service, homogenous IT • Scalable, resilient backbone • Environment parity • Improved resource utilization DevSecOps Dashboard Aggregate metrics for actionable insights to achieve continuous learning Pipeline Libraries Automated provenance with a trusted supply chain to production Jenkins Templating Engine Standardize your organization’s continuous delivery Secure Pipeline Framework Container Orchestration Platform Host the tooling in an elastic, portable environment REFERENCE MODEL FOR THE SOLUTIONS DELIVERY PLATFORM Continuous & Automated Security and Compliance Feature Feature Feature FeatureFeature
• 11.
  SOLIDIFYING THE BASE:RED HAT UNIVERSAL BASE IMAGE (UBI) UBI Attributes - Subset of RHEL content - Redistributable - Base and RHSCL images - Enabled yum repos - Microdnf - Supported - Cataloged - Updated - Tracked - Reusable Two Talks on UBI This Week - Choosing the right container base image for your application, Today, 1:30-2:15pm - Building production-ready containers, Wednesday, 3:30-4:15pm 10Booz Allen Hamilton Internal ü Jenkins ü SonarQube ü OWASP ZAP ü Nexus ü Helm ü The A11y Machine ü Twistlock ü OpenSCAP DevSecOps Platform Images
• 12.
  SOLIDIFYING THE BASE:RED HAT UNIVERSAL BASE IMAGE (UBI) 11Booz Allen Hamilton Internal Red Hat’s Universal Base Image adds a new layer of control inheritance when building security hardened PaaS Solutions ENTERPRISE INFRASTRUCTURE PLATFORM UBI APP UBI Attributes - Subset of RHEL content - Redistributable - Base and RHSCL images - Enabled yum repos - Microdnf Two Talks on UBI This Week Choosing the right container base image for your application, Today, 1:30-2:15pm Building production-ready containers, Wednesday, 3:30-4:15pm - Supported - Cataloged - Updated - Tracked - Reusable
• 13.
  THE SDP BUILDSTRUSTED SOFTWARE SUPPLY CHAINS 12Booz Allen Hamilton Internal The Solutions Delivery Platform allows you to build tool-agnostic, templated workflows to integrate security into every step of your software delivery lifecycle A containerized DevSecOps Platform, SDP leverages Red Hat’s Universal Base Image – meaning out-of-the-box security compliance within your organization Instead of building a pipeline per application – SDP lets you define the organizational quality and security gates that must be passed while affording teams the flexibility to choose the right tools for the job Leverage the same DevSecOps pipeline regardless of which cloud environment your application is targeting
• 14.
  BOOZ ALLEN’S SOLUTIONSDELIVERY PLATFORM 13Booz Allen Hamilton Internal APPLY ORGANIZATIONAL GOVERNANCE Standardize software delivery processes OPTIMIZE CODE REUSE Crowd source quality through common open source libraries SIMPLIFY PIPELINE MAINTAINABILITY Manage templates over application specific pipelines
• 15.
  DEMO LET’S SEE ITIN ACTION 14
• 17.
  OPEN SOURCE COMMUNITY 16BoozAllen Hamilton Internal The Solutions Delivery Platform components are open sourced under the Booz Allen Public License. Jenkins Templating Engine: https://github.com/boozallen/jenkins-templating-engine.git *Licensed under Apache 2.0 and released to the Jenkins Update Center https://gitter.im/jenkinsci/templating-engine-plugin SDP Pipeline Libraries: https://github.com/boozallen/sdp-libraries.git *Licensed under the Booz Allen Public License: http://boozallen.github.io/licenses/bapl Documentation: https://boozallen.github.io/sdp-docs/ Jenkins Pipeline Authoring SIG: https://jenkins.io/sigs/pipeline-authoring/ Jenkins World 2018: https://www.youtube.com/watch?v=BM9Vmsh2iMI
• 18.
  LEARN MORE ABOUTUS Josh Boyd @joshboyd boyd_joshua@bah.com Steven Terrana @steven_terrana terrana_steven@bah.com https://gitter.im/jenkinsci/templating-engine-plugin https://boozallen.github.io/sdp-docs/ devsecops@bah.com https://boozallen.com/apply