Security + DevOps + Azure = Awesomeness
Download as PDF, PPTX1 like469 views
The Secure DevOps Kit for Azure (azsdk) aims to enhance cloud security by utilizing existing Azure features and ensuring controlled adoption of Azure services. It provides tools for security checks, inline support for secure coding, and monitoring of subscription health for various Azure resources. The kit is designed to help teams implement security best practices in their development and operations workflow, facilitating a comprehensive approach to cloud security.
More Related Content
Similar to Security + DevOps + Azure = Awesomeness(20)
![Strategic Picks — Prioritising the Right Agentic Use Cases [2/6]](https://cdn.slidesharecdn.com/ss_thumbnails/session-2-250902135931-4c97717a-thumbnail.jpg?width=560&fit=bounds)
Security + DevOps + Azure = Awesomeness
- 1. SECURE DEVOPS KITFOR AZURE CLOUDBURST 6.10.2017
- 2.
- 3. KARL OTS @KOMPOZURE • Co-organizer of Finland Azure User Group and IglooConf • Working on Azure since 2011 • Patented inventor • Worked with tens of different customers on full-scale Azure projects, from startups to Fortune 500 enterprises Managing Consultant, Kompozure Ltd [email protected]
- 6. WHY AZSDK • Cloudsecurity is hard. • Knowledge of Azure security controls is not widespread. • MS IT wanted to accelerate internal Azure adoption in a controlled way • Vision: avoid reinventing the wheel o Use as much out-of-the-box Azure features as possible o For example: outsource VM controls to Security Center
- 8.
- 9.
- 10. SUBSCRIPTION SECURITYSubscription RBAC provisioning Deploy mandatoryand scenario/solution specific accounts/groups on a subscription. Ability to specify and remove deprecated accounts. Alerts setup Configure insights-based alerts for important activities. Runbooks for critical alerts to send SMS with key alert body info. ARM policy setup Deploy and enable ARM policy definitions (e.g., audit/deny use of ASM/v1 resources) ASC setup Configure Azure Security Center by enabling policies, setting security POCs, etc. Resource Locks Ensure that critical enterprise resources have locks deployed on them. Health Check More than a dozen subscription hygiene security checks, including proper provisioning
- 12. DEVELOP SECURELY Feature Scenarios/Details Development Security IntelliSense •Get inline support for secure coding right at the point of code creation. • Checks on Azure Best practices, ADAL and common crypto • VS plug-in for C#. • Security IntelliSense extension works on Visual Studio 2015 Update 3 or later.
- 14. SPOT CHECK SECURITY FeatureScenarios/Details Development Security IntelliSense • Get inline support for secure coding right at the point of code creation. • Checks on Azure Best practices, ADAL and Crypto • VS plug-in for C#. Security Verification Tests • Scan cloud solutions during early dev and prototyping stages. • Provides a variety of options to define scan targets. • Easy, intuitive reports and detailed logs. Support for 25+ Azure IaaS and PaaS service types.
- 17.
- 18.
- 23. DISCUSSION • AzSDK isnot your magic bullet to tick the security box o AzSDK mostly covers “administrative access” in traditional threat models, some “application access” as well o You still have to worry about users, external threats and more o Threat modeling and Defense in Depth approach are your friends! • Carefully analyze the results in the scope of your application – are the recommended controls right for your app? • New in 2.6.1 o Generate PDF Report o Generate Fix Script
- 24. Role How touse AzSDK Subscription Owner • Check the overall security health of your Azure subscription. • Ensure that AzSDK artifacts are properly provisioned. Developer Team • Get inline support with security tips and corrections while writing code for Azure apps (and also standard web applications in general). • Test that Azure resources you are using for your application/solutions are configured and deployed securely. • Enable security in CICD by including various security tests in the build/release pipelines Deployment Team • Control deployment workflows according to outcomes of security checks. Operations Team • Observe the security state with subscription health checks and SVT’s. • Track security state in a 'continuous' manner • Provide support and templates for frequently failing operational security activities such as key rotation, access reviews, public ips, etc.
- 25. RESOURCES • Try outthe Secure DevOps Kit for Azure! • Installation guide, docs: http://aka.ms/azsdkossdocs • Controls coverage: http://aka.ms/azsdkosstcp • IT Showcase: http://aka.ms/azsdk/itshowcase • Support: [email protected]