Security
Building a business with continuous delivery and Serverless
Hey – I’m back! I’ve been heads-down learning what Cloud teams need to deliver to AWS securely and make IAM usable, and building that into a business delivered via SaaS & infrastructure code libraries: k9 Security. I’d like to share my experience in how continuous delivery and serverless supported that endeavor. I hope this experience
Video: Secure an S3 Bucket
Last week I presented ‘Secure an S3 Bucket (and still use it)’ at the Phoenix DevOps meetup. I’m trying to help people understand why and how to protect every S3 bucket with data that needs to remain confidential. We hosted the meetup using Zoom. Attendee participation was strong and people said the content was on-target,
Why protecting data in S3 is hard and a least-privilege bucket policy to help
Securing data in S3 is a nightmare for many people. This post describes why it’s hard and a least-privilege bucket policy to help.
Guide to Tagging Cloud Deployments
Resource tagging is the primary context communication method in the Cloud but many organizations struggle to define the terms and a model to describe and analyze their Cloud deployments. The k9 Security guide to tagging cloud deployments will help you define your tagging standard and explain why it’s important.
RSA Conference 2020: A DevOps Perspective
I attended two and a half days of the RSA security conference last week and I’d like to share my first-timer perspective with you. Summary The opening keynote challenged Information Security to reorganize to collaborate better with users, business, risk, and IT teams. My post-conference perspective is that this challenge is largely ahead of us.
Modeling Risk in Cloud Deployments
Information Security risks are those risks “that arise from the loss of confidentiality, integrity, or availability of information or information systems and reflect the potential adverse impacts to organizational operations, organizational assets, individuals, other organizations, and the Nation (NIST 800-30).” Risk assessments should help people understand a given Cloud deployment’s information security risks and help
Modeling Security in Cloud Deployments
Cloud deployments often use tagging to describe the context of a compute or resource such as a who owns or what application a virtual machine or object storage bucket belongs to. However, the common resource tagging models in use don’t describe the context required for people or tools to assess security or manage risk easily.
Assessing and Managing Information Security Risks
Reading Time: 6 minutes The current crop of Best Practice tagging schemes and recommendations don’t describe the context required for people or tools to assess security or manage risk easily. But I never explained why risk management is important nor how to assess risk. Let’s start with an introduction to the process of managing risk
Research: Problems Engineers have Securing Cloud Deployments and ‘Shift Left’
I hit an obstacle on my way to extending the common resource tagging models with context to describe security and risk attributes. I couldn’t get past that while I feel this should be a settled engineering practice, it isn’t. Suspecting bad assumptions lurking around, I spoke to some engineers practicing DevOps with titles like DevOps
The context people and tools need to work with your Cloud
Operating applications involving more than a few components without explicitly modeled contextual clues is difficult for humans and might be impossible for tools. This is especially true when people are a couple steps removed such as is often the case when analyzing costs and/or assessing risk. Both people and tools rely on: identifying resources at
Research: Problems with top free security assessment tools (2020q1)
I’m researching how engineers assess the security posture of their Cloud deployments and evaluate risk to those deployments so they can improve it. Reading Time: 10 minutes The research starts with these questions: What’s the hardest part about assessing and improving the security of your Cloud deployments? When was the last time you tried or
Understanding risk using top free AWS Security tools
Most free security assessment tools for AWS will only go so far as to highlighting potential risk areas — assessing risk is up to you.
SPIFFE Service Meshes that manage application identity and access control
This post on service meshes and SPIFFE will wrap up the series on how application identity and access control is migrating from implicit identification by IP address to application-level authorization. Let’s start with an identity management technology that you may or may not have heard about: Secure Production Identity Framework for Everyone (SPIFFE). SPIFFE The
Cloud native application-level identity and access control
The proper way to provide identities to applications on Cloud and container platforms is for the compute platform to provide that identity to the application instance . I call this the Cloud native application identity. Once the application has received its identity from the compute platform along with an identity document or credential the application
Themes: Cloud Security and Containers
#NoDrama DevOps now has over 100 posts covering Cloud, DevOps, Security, Automation, AWS, and more. Cloud Security and Containers are two of the main themes I’ve written about this year. I’ve curated a guide to each of these themes in a new ‘Knowledge Base’ section of the website. These guides should help you find the
Zed, authorizing application access via network controls is (nearly) dead
One challenge many organizations face when migrating their applications to Cloud or container platforms is that identifying applications by their network address, either CIDR block (aka subnet) or IP address no longer “works.” Identifying application instances by their network address no longer works the way it used to because the compute instances are much more
Cloud Pattern: Secure Inbox using S3 and KMS
With the Secure Inbox pattern, organization A can store and deliver objects of arbitrary size to partners while narrowly scoping what partner data its own teams and applications have access to. Organization B can receive work generated by partners reliably and securely while maintaining tight control over who has access to that data via KMS encryption key and bucket policy.
Debugging AccessDenied in AWS IAM
Ugh… that looks like it could be the start of a two hour or two week long goose chase. Understanding why access was denied and implementing a secure solution can be complicated. Sometimes it’s not even clear where to start and what to do when you get stuck. Update: An improved version of this Debugging
Why is AWS IAM So Hard?
Why is AWS IAM so @!#^$!# hard? One of my favorite Directors of Cloud Platform AWS Identity and Access Management (IAM) is a security tool that controls access what AWS API actions that Principals (roles, users) are allowed to perform on which AWS resources: an S3 bucket, EC2 instance, DynamoDB table, etc. IAM is really
State of Application Secret Delivery and Audit Practices – 2019
The State of Application Secret Delivery and Audit Practices should help you explain to others why delivering application secrets is challenging, the risks of unsafe practices, and a general approach for improving your application secret delivery process.
Preventing 3rd-Parties from Leaking Data in Cloud – Attunity
Let’s examine three controls customers can adopt to help keep control of their data stored in S3 or another Cloud object store while still making it accessible or manageable by third parties.
Running Docker application containers more securely
This post describes easy to adopt practices for running Docker application containers more securely.
Should your Spidey sense tingle when discussing REDACTED?
There might be a relationship between an easy to measure factor that I’ll leave unnamed and Risk to your secrets. Please contribute your data.
Building Security Skills for an AWS Cloud Migration
The Security skills needed for a Cloud migration may be in shortest supply and the most difficult to acquire. This post describes resources you can use to build Security skills throughout your engineering team and to integrate your Security Engineers with greater leverage.
How to lose a secret
Quick tophat: If you have 8 minutes I’d really appreciate your support with my secret delivery and audit research, by completing this anonymous questionnaire: https://www.surveymonkey.com/r/BL7K385 Have you ever accidentally exposed a password, api key, or other secret? The romantic version of this is like putting a message in a bottle afloat on the sea. Will
Knocked out of orbit by Odlyzko’s ‘Cybersecurity is not very important’
When you enhance your build, delivery, deployment, and operational systems and processes with the capabilities above, you’re “Doing The (mundane) Work” to make your systems safer.
Delivering Secrets to Applications, Securely
I synthesized and expanded what I’ve been sharing about delivering secrets to applications into a 1 hour talk and presented it at the Phoenix DevOps meetup on Wednesday. This talk covers (Recording (YouTube), Slides (Google)): the fundamental challenges of handling secrets, including The First Secret Problem common ways you can lose control of them in
Heartbleed’s lesson about delivering change
Investing in robust delivery processes to lower the minimum time for an idea to go to concept to customer is not at odds with security, ‘stability’, and customer happiness. In fact, a robust delivery pipeline is a mechanism by which you can achieve all of these.
Let me tell you a secret
Secrets can be integrated into an automated application delivery process with the support of a tool that knows how to map and distribute secrets from a secure source vault to a secret store running in the target runtime environment.
The First Secret Problem
Your application’s compute execution role is its identity in the Cloud. Use it to bootstrap access to runtime secrets in addition to authenticating to other provider-managed services.
Mapping a Safer, Faster IAM Development and Review Process
I used Wardley mapping this morning to explore ideas I have for improving the development and review of AWS Identity and Access Management (IAM) policy changes. I’d like to share the internals of that mapping process with you to give you an illustrated example. The purpose of this process improvement effort is to help people
Recap: Going Fast, Safely
I’d like to recap why I’ve been discussing the nature of systems, isolation, and enterprise-level controls. It’s because I want you to: Go Fast, Safely I hope you recognize that the systems we build and work within are much more than the sum of a set of Obvious parts. The parts interact and we need
Starting Carefully with Service Control Policy
Let’s say you’re excited about using Service Control Policy to govern what goes on in your organization’s AWS accounts and improve compliance, but you don’t want to break the world when you roll it out. How do you do that? Start by identifying a single account that serves an active, but low risk use case
Improving Enterprise Security and Compliance with AWS Organizations
Let’s examine how AWS Organizations helps you manage and improve some aspects of Enterprise-wide security and compliance. This discussion builds on the previous post detailing how AWS Organizations help you manage many AWS accounts and their costs. AWS Organizations provide a number of additional security features, the one we’ll examine today is Service Control Policy.
How should I organize my AWS accounts?
Previously, I answered ‘How many AWS accounts do I need?’ with: Create however many accounts your organization needs to establish safe security and fault boundaries that enable your organization’s primary use cases and expected level of team/application autonomy. Today, we’ll explore the tradeoffs of AWS account organization methods using an example that covers one approach
How many AWS accounts do I need?
Today, I’d like to answer a common question people ask about AWS accounts: How many AWS accounts do we need? What’s an AWS Account? First let’s start with some background about what an AWS Account is and the features it provides. An AWS Account is a logical container that owns resources in the AWS Cloud.