Unlocking DevOps Secuirty :Vault & Keylock

DevOps iş təhlükəsizliyi sizi maraqlandırır? İstər developer, istər təhlükəsizlik mühəndisi, istərsə də DevOps həvəskarı olun, bu tədbir şəbəkələşmək, biliklərinizi bölüşmək və DevSecOps sahəsində ən son təcrübələri öyrənmək üçün mükəmməl fürsətdir!

Bu workshopda DevOps infrastrukturlarının təhlükəsizliyini necə artırmaq barədə danışacayıq. DevOps sistemləri qurularkən avtomatlaşdırılmış, yüksək əlçatan və etibarlı olması ilə yanaşı, həm də təhlükəsizlik məsələləri nəzərə alınmalıdır. Bu səbəbdən, DevOps komandolarının təhlükəsizliyə yönəlmiş praktikalara riayət etməsi vacibdir.

1. Unlocking DevOps Security Here is where your presentation begins

2. 01 02 03 04 Table of contents Kubernetes Security CI/CD Pipeline Security Infrastructure Security IAM in DevOps (Keycloak)

3. Infrastructure security involves protecting a company's physical and virtual resources (servers, network devices, cloud environments, etc.). Infrastructure Security

4. Infrastructure Security WAF - Web Application Firewall PAM - Privileged Access Management Infrastructure as Code (Terraform, Cloudformation, Terrascan) NSX Vmware - Network and Security Virtualization Configuration Management Tools (Ansible, Saltstack) CIS Benchmarks Logging of the system (filebeat, winlogbeat) Secret Management Tools - (Vault, AWS Secret management ) Least Privilege Access Implementation, MFA Backup and Recovery (Implement backuping system and disaster recovery plan)

5. Infrastructure Security WAF (Web Application Firewall) - Protects web applications from variety of application layer attacks, such as XSS(cross-site-scripting), SQL Injection.

6. Infrastructure Security PAM (Privileged Access Management) - Security tool for controlling and monitoring activity of privileged users. Example: Cyberark PAM, BeyondTrust

7. Infrastructure Security IaC (Infrastructure as Code)- the ability to provision and support your computing infrastructure using code instead of manual processes and settings Example: Terraform, Terrascan

8. VMware NSX | Networking and Security Virtualization Infrastructure Security

9. Infrastructure Security Configuration management tools - automate configurations (storage, networking etc) of servers Example: Ansible, Saltstack, Chef

10. Infrastructure Security CIS Benchmarks (Center for Internet Security) - Best practices to implement security. Link: https://www.cisecurity.org/cis-benchmarks

11. Infrastructure Security Logging of the system (Filebeat , Winlogbeat)

12. Infrastructure Security Secret Management Tools Example: Vault, AWS Secret Manager

13. Infrastructure Security Least Privilege Access Management, MFA

14. Infrastructure Security Backup and Disaster Recovery

15. Container Isolation: Namespace () & cgroups () Network Policies (Calico, Cilium, NSX-T) RBAC on Kubernetes Upgrade Kube cluster ETCD encrypted Container Sandboxing mTLS/ ServiceMeshes - traffic between pods should be encrypted OPA - Open Policy Agent Falco AppArmor, Seccomp Kubernetes Security

16. Container Isolation: Namespace & cgroups Namespaces -> Other processes, users, filesystems Cgroups > RAM, Disk, CPU Kubernetes Security

17. Network Policies Kubernetes Security

18. RBAC on Kubernetes Combinations: Role - Rolebinding → user has permissions in single namespace ClusterRole - ClusterRoleBinding → user has same permissions in all namespaces ClusterRole - RoleBinding → user has same permissions in multiple namespace Kubernetes Security

19. Upgrading Kubernetes Cluster Kubernetes Security

20. Encryption at rest - Encrypt ETCD Key-Value DB Kubernetes Security

21. Container Sandboxing - Kata Containers Kubernetes Security

22. gVisor gVisor is also one of the Sandbox Runtime. It is user-space kernel for containers Kubernetes Security

23. mTLS, Service Mesh mTLS - mutual TLS Mutual authentication Two-way (bilateral) authentication Two parties authenticating each-other at the same time By default in kubernetes every pod can communicate with each-other and this is done unecrypted Kubernetes Security

24. OPA - Open Policy Agent OPA is an open-source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack. OPA Gatekeeper Kubernetes Security

25. Falco Falco is a cloud native runtime security, it provides deep kernel tracing built on the Linux kernel, it describe security rules against a system and detect unwanted behavior. Automated respond to a security violations Kubernetes Security

26. Apparmor Kubernetes Security Profile Modes: Unconfined → Process can escape Complain → Process can complain but it will be logged Enforce → Processes cannot escape

27. seccomp: Seccomp (Secure Computing Mode) is a Linux kernel security feature that restricts the system calls a process can make, significantly reducing the potential attack surface for a process Kubernetes Security

28. CI/CD Pipeline Gitlab Configuration, Access Management for Users, Ldap Authentication, Branch Protection Gitlab SAST, SCA, Defectojot, Sonarqube, Fortify Dependency checks Docker Images and Image Vulnerability Scanning (Trivy, Clair)

29. CI/CD Pipeline Gitlab Configuration Access Management for Users Ldap Authentication Branch Protection Do not use Hard Coded Values

30. CI/CD Pipeline Gitlab SAST, SCA, Fortify SAST/DAST Tool, Defectojo, Vulnerability Report, Sonarqube.

31. CI/CD Pipeline Dependency management Prevent Supply Chain Attacks Use trusted, verified sources for your dependencies Dependencies organize in a file, use dependency management tools maven, npm or gradle Use centralized artifact repo

32. CI/CD Pipeline Dockerfile Images: Reduce image size via applying multi-stage images Always mention proper version tag for image, do not use latest. Use specific package version Do not run as root Make filesystem read only → RUN chmod a-w /etc Remove shell access → RUN rm -rf /bin/* Store image in your own private registry

33. CI/CD Pipeline Image Vulnerability Scanning (Trivy, Clair) Dive Tool for Image Analysing

34. Keycloak (IAM) Authentication & Authorization (OpenID Connect & OAuth2) Single Sign-On (SSO) User federation (LDAP, AD. DB) Social Login (Google, Facebook) RBAC

35. Keycloak (IAM) As an Identity Provider in microservices

36. Keycloak (IAM) Keycloak + Gateway + APP

37. Keycloak Deployment on Kubernetes and Integration APP

38. Thanks!