Modern application build-and-deploy workflows are creating new challenges for traditional security models. Traditional workflows need to be recast in new datasets, and new workflows need to be added to cover the expanding threat surface area. In this session, we explore the security challenges created by modern application build-and-deploy pipelines. We also discuss basic considerations for security defense, example use cases, and a customer case study to illustrate the concepts. This session is brought to you by AWS partner, Sumo Logic.

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security Challenges and Use Cases in
the Modern Application Build-and-
Deploy Pipeline
Dave Frampton, VP
Security Solutions,
Sumo Logic
Olaf Stein, Sr. Security
Architect, Sumo Logic
Brad Segobiano, Sr.
Software Engineer,
Genesys
A N T 2 0 9 - S

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Today’s build & deploy models provide new
challenges for security
● Distributed tools
● New perimeters
● Microservices, containers,
service chaining
● Fragmented, diverse context
● Lack of holistic view
● Production security data
volumes
● New DevSecOps workflows

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Maintaining security insight & posture across the
tool sprawl is a significant challenge

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
People & process many-to-many mappings compound
the problem
Cloud
Chenges
● Tools and tech stacks vary by team
● Many owners and stakeholders for each process
● Dozens of AWS accounts, no standards, different owners
● Churn in accounts, tools, software, libraries
● Unpredictable scale demands
QA
Development
IT
DevOps SRE
Security
Operations
Version
control
Coding
Monitoring
& alerting
CI/CD
Project
mgt
Config
mgt
Testing
Pen
testing
Vuln
scan
Access
control

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Four attributes of emerging solutions
Current disruptions Emerging
Democratization of
security analytics
Close the loop
between
DevSecOps &
SOC
Cloud & App Stack
Integration
Accelerate
workflow

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS
Depth
Code Build DeployTest
dev
prod

8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS
Breadth
Code Build DeployTest
dev
prod
Corporate tools Security tools

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Risk of compromise
• Risks of compromise
Data leaks
Loss of intellectual property
Compromise of infrastructure
Loss of compliance
Aid further reconnaissance/attack

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Depth
• Indicators of compromise
Anomalous behavior by users
Anomalous behavior by origin
Anomalous behavior by timing
Activity from known bad actors
• Who & how to monitor
IT
Dev(Ops)
SRE
App security

11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Depth
• Indicators of compromise
Authentication events
Privileged activity
Account management events
System/config changes
Who & how to monitor
IT
Dev(Ops)
SRE
App security

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Breadth
• Indicators of compromise
Correlate across all activity by origin or time
Volume analysis
Unusual sequences
Correlate with corporate or security tools
Who & how to monitor
Corporate security
Production security
App security

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Automate everything DevSecOps with
Genesys

14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Genesys platforms

15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Infrastructure scale
•200+ Microservices
•10 AWS Accounts
•5 AWS Regions
•Noc-less
•Immutable
•DevOps

16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Deployments per week

17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
19
Genesys build pipeline
+
Build
Base AMI
Build artifactSCM

18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
20
Genesys build pipeline & security
+
AMI creation
Centralized
reporting
Security workflow Amazon EC2 + Amazon Inspector

19. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
21
Genesys deploy pipeline
Across account orchestration tool
Dev deploy Integration test Promotion Prod deploy
Failed
Success

20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
22
Genesys deploy pipeline & security
Across account orchestration tool
Application security
audit tools
Centralized
reporting

21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
23
Genesys infrastructure security monitoring
Examples
•AWS “root” login attempts
•Open security groups
•Failed AWS login attempts
•Instance age
•Amazon Simple Storage
Service (Amazon S3)
bucket permissions

22. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
24
Genesys host security monitoring
+
Build
Base AMI
Examples
● Whoami, id, nc, nmap, tcpdump, curl,
wget, yum, rpm, and others
● File transfers

23. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Genesys application monitoring
Examples
•Anomalous spikes (for
example, expect “x”, alert
when “y”)
•Recon (directory
enumeration, and so on)
•Attacks (XSS, SQLi, and
so on)

24. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
E-mail notifications
Also used for routine
success/failure/problem
e-mail notifications in the
CI/CD pipeline (or other
areas)
← Recent unsuccessful promotions
Recent ACL changes →

25. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
+
Application security
audit tools
Centralized
reporting

26. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Use cases span both old and new
Cloud
Chenges
Coding
Authentication
MfA
Geography
Origin
VPN Failed
Successful
Brute Force
Embargoed Country
Bastion
Public Key
Age of Creds
SAML
Spike
First Usage
Accounts/permissions/other
System changes
Threat Actor
Locked
Out
Terminated
New
Shortlived
No CR
Privileged
Logging
Stopped
Age of Creds
Unlocked
Disabled
Enabled
Never Used
Used Once
Permit Any SG
Password Policies
MfA
Remote root
Network traffic
Enabled Service
Disabled Service
IAM
Security
Groupsusermod
Audit Policy
ChangeLog Cleared
Bucket Permissions
change
EC2
Scans Undocumented
Ports
Long connections
Data Exfiltration
Denied Spikes
New DestinationsLateral Movement
Subnets
Threat Actors

27. Thank you!
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
dframpton@sumologic.com
olaf@sumologic.com

28. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.