1. The Defense RESTs: Automation and APIs for Better Security September 26, 2012 David Mortman

2. Introduction

3. Want to get better at security?

4. Improve your operations

5. Improve your developement

6. The Problem

7. Huge % of incidents revolve around operational or coding issues

8. Why?

9. People Are Bad At Repeatable Tasks!

10. Centralization, automation & testing can address this

11. Use APIs and existing ops/dev tools!

12. Chef, Puppet, etc

13. Compliance & Change Control

14. Configuration Drift AKA Variation is Evil

15. Key Management

16. Auto-Scaling

17. Auto-scanning on VM launch

18. INSTANCE=`ec2-run-instances $AMI -t $TYPE -k $KEY | grep i- | cut -f 2`; until [ $IP ]; do sleep 15; IP=`ec2-describe- instances $INSTANCE | grep i- | cut -f 17`; done ; curl -H "X- Requested-With: DM Automation" -u $USER:$PASS "https://qualysapi.qualys.com/msp/asset_ip.php?action=add &host_ips=$IP"; curl -H "X-Requested-With: DM Automation" -u $USER:$PASS "https://qualysapi.qualys.com/msp/scan.php?ip=$IP&save_r eport=yes"

19. Jenkins

20. Findbugs et al. http://findbugs.sourceforge.net/

21. Functional and Unit Testing

22. Positive and Negative Testing

23. Gauntlt https://github.com/thegauntlet/gauntlt

24. Auto-code/site scanning on commit

25. PUT https://sentinel.whitehatsec.com/api/vul n/retest/

26. A Little DevOps

27. Woodward: Code Changes & Complexity

28. APIs: REST vs SOAP

29. Future Directions & Resources

30. iControl & Space

31. IF-MAP

32. Security Automation List SecurityAutomata.Com

33. IAM SCIM/XACML

34. Conclusion

35. Any questions? David Mortman Chief Security Architect david.mortman@enstratus.com @mortman david.mortman@enstratus.com