Presentation given at DevOps Days Mountain View, on June 29th, 2012. #devopsdays

1. PUTTING RUGGED INTO
YOUR DEVOPS TOOLCHAIN
JAMES WICKETT, @WICKETT

2. I WANT YOU TO BE
SUCCESSFUL AND
MAKE A DIFFERENCE

3. James Wickett
CISSP, GWAPT,
CCSK, GSEC, GCFW
@wickett
@RuggedDevOps
@gauntlt

4. HTTP://BIT.LY/RUGGED-DEVOPS

5. A BRIEF HISTORY OF
INFORMATION SECURITY

6. WE USED TO BE COOL

7. WE HAD
CINEMA

8. WE HAD
HEROES

9. WE MADE FREE
PHONE CALLS

10. WE WERE COOL

11. WE MADE IT INTO THE
ORGANIZATIONS
WE HAD PREVIOUSLY FOUGHT

12. WE HELD CONFERENCES
IN FANCY HOTELS
WHERE WE CLAIMED WE HAD
NO BUSINESS SUPPORT

13. WE HAVE BUSINESS CARDS
WITH TITLES LIKE
CISO ON THEM

14. ONCE IN THE ORG
INFOSEC MADE
BIG CLAIMS

15. WE COULDN’T STOP THE
VIRUSES AND WORMS

16. ENTER RISK
ASSESSMENT

17. INSTEAD OF ENGINEERING
INFOSEC BECAME ACTUARIES

18. WE BECAME EXPERTS
IN BUYING INSURANCE POLICIES

19. “[RISK ASSESSMENT] INTRODUCES A
DANGEROUS FALLACY: THAT
STRUCTURED INADEQUACY IS
ALMOST AS GOOD AS ADEQUACY
AND THAT UNDERFUNDED
SECURITY EFFORTS PLUS RISK
MANAGEMENT ARE ABOUT AS
GOOD AS PROPERLY FUNDED
SECURITY WORK” - MICHAL ZALEWSKI

20. WE MADE A
SIGNIFICANT
ERROR

21. WE THOUGHT THIS WAS TRUE:
EVERY SECURITY EVENT
RESULTS IN A FINANCIAL LOSS

22. TJX H@CK3D!

23. THE STOCK PRICE
DIDN’T DROP

24. OUR ASSUMPTION
WAS INCOMPLETE

25. INFOSEC ALSO MADE
A SECOND BIG MISTAKE

26. IT STAYED IN
INFORMATION
TECHNOLOGY

27. IT WAS A COST CENTER
AND NOT IN A POSITION
TO ADD VALUE

28. SOMETHING ELSE
HAPPENED GLOBALLY

29. DEVS BECAME COOL

30. CODE BECAME SOCIAL

31. “I DON’T WANT YOU
TO SEND ME AN
INSTALLATION DVD”

32. WE SELL TIME NOW

33. WE SELL SOCIAL
AND FRIENDSHIPS

35. “IS THIS SECURE?”
-YOUR CUSTOMER

36. “ITS CERTIFIED”- YOU

37. WHY CAN’T YOU
GIVE A BETTER ANSWER?

38. THE INEQUITABLE
DISTRIBUTION OF
LABOR IN SECURITY
MIMICS THAT IN DEV/OPS

39. source: Gene Kim, “When IT says No @SXSW 2012”

40. Security sees...
• They give advice that goes unheeded
• Business decisions made w/o regard of risk
• Irrelevancy in the organization
• Constant bearer of bad news
• Feels ignored by their peers (you know,
those devops guys)
• Inequitable distribution of labor

41. 2% OF AN ENGINEERING
DEV TEAM ARE WORKING
ON SECURITY
- BSIMM 2012 data, http://bsimm.com/

42. HOW DO WE FIX
THESE PROBLEMS?

43. -LEARNING FROM
(PREFERABLY OTHER
PEOPLE’S) MISTAKES
-DEVELOPING TOOLS TO
CORRECT PROBLEMS
- PLANNING TO HAVE
EVERYTHING
COMPROMISED

44. UNDERSTANDING
TOOLING
ARCHITECTURE

46. OPEN WEB APPLICATION
SECURITY PROJECT

49. Current Software

50. Rugged Software

51. Current Software

52. Rugged Software

53. Current Software

54. Rugged Software

55. ADVERSITY REQUIRES
RUGGED SOLUTIONS

56. ADVERSITY IS REAL OR
PERCEIVED NEGATIVE
ACTIONS AND EVENTS
THAT PROHIBIT NORMAL
FUNCTION AND OPERATION.

57. Building solutions to handle
adversity will cause
unintended, positive benefits
that will provide value that
would have been unrealized
otherwise.
RUGGEDIZATION
THEORY

58. NO PAIN, NO GAIN

59. "Secondly, our network
got a lot stronger as a
result of the LulzSec
attacks."
-Surviving Lulz: Behind the Scenes of LulzSec @SXSW 2012
by CloudFlare team

61. REPEATABLE – NO MANUAL STEPS
RELIABLE - NO DOS HERE
REVIEWABLE – AKA AUDIT
RAPID – FAST TO BUILD, DEPLOY, RESTORE
RESILIENT – AUTOMATED RECONFIGURATION
REDUCED - LIMITED ATTACK SURFACE

62. RUGGED BY DESIGN,
DEVOPS BY CULTURE

63. RUGGED DEVOPS

67. Put your code through
the gauntlt

68. GAUNTLET, N.
AN ATTACK FROM
ALL SIDES

69. custom attacks dirbuster
metasploit sqlmap
fuzzers nessus
w3af nmap
Your web app You

70. gauntlt is built for doing security
testing in a DevOps world

71. GAUNTLT IS

72. AN ALWAYS-
ATTACKING
ENVIRONMENT FOR
DEVELOPERS

73. WITH ATTACKS
WRITTEN IN
EASY-TO-READ
LANGUAGE

74. ACCESSIBLE TO
EVERYONE INVOLVED
IN DEV, OPS,
TESTING, SECURITY, ...

76. MEET THE GAUNTLT
TEAM

77. MANI
TADAYON
"SOFTWARE -
WAR = SOFTE"
@BWSR_SR

78. ROY
RAPOPORT
“I PICKED UP THE TEE
SHIRTS”
@ROYRAPOPORT

79. BILL BURNS
@X509V3
“SMITHERS,
RELEASE THE
MONKEYS!”

80. JOSHUA
CORMAN
@JOSHCORMAN
@RUGGEDSOFTWARE
“HONEY BADGER
DOES CARE”

81. JASON
CHAN
@CHANJBS

82. NOT PICTURED:
MATT TESAURO
TAREK MOUSSA

83. WHY GAUNTLT?
SECURITY DOMAIN
KNOWLEDGE IS GENERALLY
A MYSTERY TO DEV TEAMS

84. GAUNTLT ALLOWS DEV AND
OPS AND SECURITY TO
COMMUNICATE

85. GAUNTLT JOINS
THE PHILOSOPHY OF
RUGGED SOFTWARE
& CONTINUOUS INTEGRATION

86. HTTPS://GITHUB.COM/THEGAUNTLET/GAUNTLT

87. LETS LOOK INSIDE A
COUPLE OF THESE FILES

88. feature for nmap:
nmap.feature
@gauntlet @run
Feature: Run nmap against a target and pass the value of the hostname from the profile.xml.
Background:
Given nmap is installed
Scenario:Verify server is available on standard web ports
Given the hostname in the profile.xml
When I run nmap against the hostname in the profile on ports 80,443
Then the output should contain:
"""
80/tcp open http
443/tcp open https
"""

89. step definition for nmap:
nmap.rb
Given /^nmap is installed$/ do
steps %{
When I run `which nmap`
Then the output should contain:
"""
nmap
"""
}
end
When /^I run nmap against the hostname in the profile on ports (d+),(d+)$/ do |arg2, arg3|
steps %{
When I run `nmap "#{@hostname}" -p80,443`
}
end

90. running gauntlt with failing tests
wickett$ gauntlt
@gauntlet @run
Feature: Run nmap against a target and pass the value of the hostname from the profile.xml.
Background: # features/nmap/nmap.feature:5
Given nmap is installed # features/step_definitions/nmap.rb:2
Scenario:Verify server is available on standard web ports # features/nmap/nmap.feature:8
Given the hostname in the profile.xml # features/step_definitions/profile.rb:1
When I run nmap against the hostname in the profile on ports 8080,443 # features/step_definitions/nmap.rb:12
Then the output should contain: # aruba-0.4.11/lib/aruba/cucumber.rb:98
"""
8080/tcp open http
443/tcp open https
"""
...
Failing Scenarios:
cucumber features/nmap/nmap.feature:8 # Scenario:Verify server is available on standard web ports
1 scenario (1 failed)
4 steps (1 failed, 3 passed)
0m0.341s

91. running gauntlt with passing tests
wickett$ gauntlt
@gauntlet @run
Feature: Run nmap against a target and pass the value of the hostname from the profile.xml.
Background: # features/nmap/nmap.feature:5
Given nmap is installed # features/step_definitions/nmap.rb:2
Scenario:Verify server is available on standard web ports # features/nmap/nmap.feature:8
Given the hostname in the profile.xml # features/step_definitions/profile.rb:1
When I run nmap against the hostname in the profile on ports 80,443 # features/step_definitions/nmap.rb:12
Then the output should contain: # aruba-0.4.11/lib/aruba/cucumber.rb:98
"""
80/tcp open http
443/tcp open https
"""
1 scenario (1 passed)
4 steps (4 passed)
0m1.117s

93. RESOURCES

94. WANT TO JOIN THE
GAUNTLT TEAM?
EMAIL JAMES@RUGGEDDEVOPS.ORG

95. Please get in
touch with me:
@wickett
@RuggedDevOps
@gauntlt