Compliance != Security - USENIX · Compliance != Security but we used it anyway and improved the...
56
Compliance != Security Robert Clark, IBM Cloud
Transcript of Compliance != Security - USENIX · Compliance != Security but we used it anyway and improved the...
Compliance != Security
Robert Clark, IBM Cloud
Compliance != Security but we used it anyway
Robert Clark, IBM Cloud
Compliance != Security but we used it anyway and improved the way we deliver devops security for agile teams at scaleRobert Clark, IBM Cloud
Conversations
My service is ready for production, where do I get my compliance certifications ?
Conversations
My service is ready for production, where do I get my compliance certifications ?
That depends, is it secure ?
Conversations
My service is ready for production, where do I get my compliance certifications ?
That depends, is it secure ?
Probably!? Isn’t that what certifications are for ?
Conversations
EverySecurityPerson
Our Transformation
Transformation
Challenges
Acquisition Maturity
Compliance Limitations
DevOps Security
How we BuildHow we Staff
Our Cloud Agility Model
Similarities with the “Spotify Model”
DevOps - Design, Build, Ship, Maintain
Self sufficient squads
Squads grouped into tribes
Acquisition Maturity
Acquisition Maturity
Solo Security Engineer Fully Staffed Security Team
Anatomy of a Squad
Developer Systems Engineer
AutomationEngineer
Offering Manager
Security Engineer
Experience Assurance
Tribe Leader
Good Examples
Service Security Squads
Mature / Stable
Development
Developer Systems Engineer
AutomationEngineer
Offering Manager
Security Engineer
Experience Assurance
Tribe Leader
Less Good Examples
Developer Systems Engineer
AutomationEngineer
Offering Manager
Security Engineer
Experience Assurance
New ProductTeams
New Acquisitions
Tribe Leader
Challenges
VS How do we enable small squads to deliver security?
Compliance != Security
Compliance
How do we make IT less scary?
Compliance
How do we make IT less scary?
Prove we know what we’re doing?
Demonstrate safety and best practice?
Compliance
COMPLIANCE
Prove we know what we’re doing?
Demonstrate safety and best practice?
Compliance
Will COMPLIANCE save us ?
Compliance
Let's get our squads doing compliance!
Compliance
Indifference
Imagine Communications https://flic.kr/p/e8CvVF
Anger
Bernard Dupont https://flic.kr/p/Nx8eAe
Denial
By Rexness from Melbourne, Australia (Meerkat digging) [CC BY-SA 2.0 (https://creativecommons.org/licenses/by-sa/2.0)], via Wikimedia Commons
Exodus
Challenges
How do we make compliance accessible?
COMPLIANCE
INDUSTRY POP QUIZ
COMPLIANCE
TOP BREACHES 2016-2017
Compliance Misconceptions
Compliance Misconceptions
COMPLIANCE
Controls Based Planning
Evidence Driven Documentation
Enforcement of Security
Technical Innovations
Defining Processes
GOOD FOR
BAD FOR
Challenges
Understand the limitations of compliance
DevOps / Building for Security
How do we build for security in a cloud native world...
… if “compliance” isn’t the answer?
Changes
Optional Services
How we BuildHow we Staff
Measurable Controls
800-53
CommonControl
AlignmentIntegrated Tools
Oriented to ControlsCentralized Expertise
Distributed Security Function
NIST Alignment
800-53 Security & Privacy Controlsand
Cyber Security Framework
Recover Respond Detect Protect Identify
Strong Privacy Controls (R5)Federal BedrockSignificant Internal Alignment
Superset of Common Controls
CustomizableVariable Maturity Model
BUILD A CENTRAL TEAM OF TALENT
Service Security Squads
Security Talent
Aligning Talent
FAMILY
Access Control
Awareness & Training
Audit and Accountability
Assessment, Authorization and Monitoring
Configuration Management
Contingency Planning
Identification and Authentication
Individual Participation
Incident Response
… [11 more control families]
Aligning Talent
FAMILY
Access Control
Awareness & Training
Audit and Accountability
Assessment, Authorization and Monitoring
Configuration Management
Contingency Planning
Identification and Authentication
Individual Participation
Incident Response
… [11 more control families]
Aligning Talent with NIST
Functional DeliveryThings we do and deliver to benefit cloud services and engineers
Control ExpertiseThings we have strong opinions about and know how to measure
Security Focal Program
SF SF
Attend NIST Aligned Security Training
Role:
Participation:
Security Focal
Part Time
Responsibilities:
Participate in Security Reviews
Know enough to ask for help
Support their Security Focals
Role:
Participation:
Tribe Security Leader
Full Time
Responsibilities:
Escalation point for service / tribe issues
Owner of local security budget
Security of portfolio segment
Support IR and Vulnerability Management
TSLSFSF
Tribe Security Leader
SF SF
Security Focal Program
TSLThis person *owns*
security for their tribe
These people deliver security for their
services
TribeLeader
Tribe Security Leader
SF SF SF
NIST Aligned Security
Org
Security Focal Program
TSL
Lessons Learned
Not every squad has an aspiring security ninja
Focus must always be on developers
NIST is a really big standard!
Secure the path of least resistance
Our Results
Enhanced Service Delivery
Consolidation
Incident Response
Centralized Talent
Security Career Path
Better Communications
Enabled Developers
Best-in-Breed Tooling
Clearer Positioning
Accelerated Penetration Testing
Scaled Threat Modelling
Happy Developers
Happy Security Focals
Malcolm Manners https://flic.kr/p/5bD6hX
Happy Security Team
© Wayne [wrokicki] https://flic.kr/p/8eaFPK
What’s Next
© Wayne [wrokicki] https://flic.kr/p/8eaFPK
Which other standards would work?
How much can we really measure?
Where are the DevOps Security tools?
Questions
Our Results
Enhanced Service Delivery
Consolidation
Incident Response
Centralized Talent
Security Career Path
Better Communications
Enabled Developers
Best-in-Breed Tooling
Clearer Positioning
Accelerated Penetration Testing
Scaled Threat Modelling
How we build
AGILE DevOps
SECURITY
