Cloud Security from an Orchestration Perspective: Shifting Left Jeroen van der Leer / Cheyenne Seur (ABN AMRO) Info Security Europe – CSA Summit – June 5th 2018

Introduction 1 2 3 History & Legacy Shifting Left & Orchestration Approach Jeroen van der Leer Product Development Manager ABN AMRO IT Services / I&PS Product Owner CBSP AWS 1 2 Cheyenne Seur Information Security Risk Analyst ABN AMRO CISO IT Wizard 3

History 1st workload live on AWS June 2017 “The cloud moves on” Nov 2015 AWS Enterprise Agreement Dec 2016 MT IT Decision Azure / AWS Sep 2016 TOPS2020 2013 AWS Sandboxes Feb 2017 Critical workload live on AWS Oct 2017

Not sufficiently agile Private Cloud Legacy Not sufficiently agile Slow delivery of a limited number of technologies Too many silos Building blocks delivered and approved by many API missing Legacy environments not exposed via APIs

Vision

Dutch Landscape (1)

Dutch Landscape (2)

Corporate Landscape

What is a silo? Definition:   Any management system that is unable to operate with any other system Issue: Silos do not share the goals and priorities of other departments Solution: Break down the silos by introducing DevOps or DevSecOps Of course Information Security or CISO is not a silo in most enterprises… Or is it? For instance: does Information Security have its own conferences? Actually, perhaps breaking down the silos has to be done before introducing DevOps

Silo examples – many perspectives IT as a silo Central IT is often busy keeping legacy systems running but the business is asking for agility. CISO as a silo CISO’s main focus can be Information Security and has selected tools and vendors to ensure systems are kept secure. Silos within IT Service Management would like you to place your offering in their service catalogue and deliver using their request fulfilment tool.

Shifting left What is it? Testing is performed earlier in the software development process An example: Penetration testing often takes place just before going live. What ABN AMRO has witnessed: CICD toolchains which are partially in the cloud DevOps teams want to collaborate with 3rd parties during development Chains may be distributed across multiple public clouds Challenge Connectivity requirements arise earlier, does shifting penetration testing left scale? Development such as cloud based toolchains require penetration testing to shift left as well. But does traditional delivery of such tests scale? Can it be done a different way? An example of a distributed chain is Tweadle: uses Salesforce and AWS

ABN AMRO’s Objectives for AWS PROVISIONING // DEVOPS TEAMS PROVISION OWN INFRASTRUCTURE FLEXIBLE // AVOID UNWANTED STANDARDS SECURE // COMPLIANT WITH STANDARDS FOR CLOUD RISK CONTROL API // EXPOSE ALL PLATFORM FUNCTIONALITY AS AN API AGILE // QUICKLY INTRODUCE AND ADOPT NEW AWS SERVICES Some of these objectives were not a choice ABN AMRO has a history of outsourcing with separate ADM and Infrastructure vendors (Silos!) Building an IT function to deliver public cloud to DevOps teams in a traditional way would have been expensive The only alterative: automate and orchestrate!

Automation and Orchestration Setting up a single task to run on its own. For instance: spinning up a server. Orchestration Automating a lot of things at once. For example: launching a 3-tier architecture, deploying software to it and provisioning a Web Application Firewall to monitor, filter and block traffic to it. Benefit Orchestration helps you maximize cloud investments Problem Automation and certainly Orchestration is impossible to achieve if you don’t break down the silos. Orchestration provides a single and centralized approach to provisioning resources and deploying software. What follows is efficient and more consistent repeatable deployements

Quick Summary ORCHESTRATION // TO MAXIMIZE CLOUD INVESTMENTS SHIFTING LEFT // TESTING TAKES PLACE EARLIER IN THE DEV LIFECYCLE SILOS // DEVOPS AND BREAKING DOWN SILOS GO HAND IN HAND Some of these objectives were not a choice ABN AMRO has a history of outsourcing with separate ADM and Infrastructure vendors (Silos!) Building an IT function to deliver public cloud to DevOps teams in a traditional way would have been expensive The only alterative: automate and orchestrate!

Standards for Cloud Risk Control Control routing path and monitor outbound traffic from CSP Private to CSP Public. Access will be managed based on patterns Control routing path and monitor traffic from CSP Public to AAB on-premises networks Allow only desired network protocols from Internet No direct inbound traffic from CSP Public and Internet (Perimeter Defense) Secure web publishing is handled by application, virtual appliance or cloud service Connectivity controls on AAB public end-point level Only ABN AMRO approved & authorized services can be deployed Periodic credential based vulnerability scanning Data Leakage must be prevented IAM on all accounts and resources Owner/cost tagging for all resources Platform Audit Logs & Platform Security Monitoring Monitor and assess updated CSP Service Terms and Audit Reports Virus/Malware protection Update 1.2: Flex-Zone is used to address the ‘playground’ environment, the old term ‘sandbox’ could easily be confused with a highly regulated and secured environment (https://en.wikipedia.org/wiki/Sandbox_(computer_security)) Update 1.2: Control A7 and S16 where introduced

Measureable Standards & Guidelines Standards for Cloud Risk Control F5 : Virus/Malware protection must be present CBSP AWS Standard for Amazon EC2 EC2_025: Ensure XXXXXXXXXX agent is installed and policy assigned Standards for Cloud Risk Control S13: Connectivity controls on AAB public end-point level CBSP AWS Standard for Amazon S3 S3_012: S3 buckets must XXXXXXXXXXXX Standards for Cloud Risk Control A8: Applications with availability ratings of 1 must be actively monitored for DDoS attacks CBSP Standard XXX_002: Create AWS CloudWatch alarm for XXXXXXXXXXXXXX ABN AMRO leverages AWS Config for this

Compliance Dashboard in Splunk

ABN AMRO’s Objectives for AWS PROVISIONING // DEVOPS TEAMS PROVISION OWN INFRASTRUCTURE FLEXIBLE // AVOID UNWANTED STANDARDS SECURE // COMPLIANT WITH STANDARDS FOR CLOUD RISK CONTROL API // EXPOSE ALL PLATFORM FUNCTIONALITY AS AN API AGILE // QUICKLY INTRODUCE AND ADOPT NEW AWS SERVICES Effectively we are delivering on all our objectives We’ve done this by breaking down silos which has enabled DevOps. IT, CISO and Business objectives have become aligned. The fact that IT and CISO stand here today is proof of that (the business has paid for our trip which is proof they’re aligned too!) DevOps teams are able to orchestrate their entire IT landscape using a native API which has significantly improved agility without a tradeoff to Security

Questions