Presented at AutomaCon 2016 in Portland, OR on 9/28/2016.

1. The Psychology of Security
Automation
Jason Chan - Netflix
Automacon 2016
@chanjbs

2. History:
Developer - Security
Relationship

11. Opportunities for Developers
are
Opportunities for Security Teams

12. Opportunities + History =
Powerful Tools to Improve
Security and Relationships!

13. Types of Security Automation

14. Types of Security Automation
1. Developer-Facing Tools

15. Types of Security Automation
1. Developer-Facing Tools
2. Developer-Security Collaboration

16. Types of Security Automation
1. Developer-Facing Tools
2. Developer-Security Collaboration
3. Internal Security Tools

17. Developer-Facing
Tools

18. SSL/TLS!

22. Lemur

23. Lemur

24. Lemur
• One-stop shop for SSL certificate management

25. Lemur
• One-stop shop for SSL certificate management
• Request, provision, deploy, monitor

26. Lemur
• One-stop shop for SSL certificate management
• Request, provision, deploy, monitor
• Plugin architecture for certificate authorities, endpoints, etc.

29. Lemur and SSL Management
Takeaways

30. Lemur and SSL Management
Takeaways
• APIs = Opportunities

31. Lemur and SSL Management
Takeaways
• APIs = Opportunities
• Solves persistent, difficult, common problem

32. Lemur and SSL Management
Takeaways
• APIs = Opportunities
• Solves persistent, difficult, common problem
• Security++

33. Lemur and SSL Management
Takeaways
• APIs = Opportunities
• Solves persistent, difficult, common problem
• Security++
• Reliability++

34. Dev-Sec Collaboration

35. Old Ways of “Collaborating”

36. Old Ways of “Collaborating”
• Skirmishes

37. Old Ways of “Collaborating”
• Skirmishes
• Meetings

38. Old Ways of “Collaborating”
• Skirmishes
• Meetings
• Brouhahas

39. Old Ways of “Collaborating”
• Skirmishes
• Meetings
• Brouhahas
• Change review boards

40. Old Ways of “Collaborating”
• Skirmishes
• Meetings
• Brouhahas
• Change review boards
• Fisticuffs

41. Old Ways of “Collaborating”
• Skirmishes
• Meetings
• Brouhahas
• Change review boards
• Fisticuffs
• Tickets

42. Case Study:
Permissions Management in AWS

43. Permissions Management in AWS

44. Permissions Management in AWS
• Innovation is enabled by composition of multiple services,
but . . .

45. Permissions Management in AWS
• Innovation is enabled by composition of multiple services,
but . . .
• Complex and sophisticated policy language with many
conditions

46. Permissions Management in AWS
• Innovation is enabled by composition of multiple services,
but . . .
• Complex and sophisticated policy language with many
conditions
• 2500+ individual API calls

47. Permissions Management in AWS
• Innovation is enabled by composition of multiple services,
but . . .
• Complex and sophisticated policy language with many
conditions
• 2500+ individual API calls
• New services/features released weekly

49. Rollie Pollie
Permissions Management via
ChatOps

51. Rollie Pollie Benefits

52. Rollie Pollie Benefits
• Transparent decisions

53. Rollie Pollie Benefits
• Transparent decisions
• Eng-native workflows

54. Rollie Pollie Benefits
• Transparent decisions
• Eng-native workflows
• Automated, secure, consistent

55. Internal Tooling

57. Application Security
Automation with
Dirty Laundry

58. Dirty Laundry’s Approach

59. Dirty Laundry’s Approach
• Unix-like philosophy - execute task, return results, process,
iterate

60. Dirty Laundry’s Approach
• Unix-like philosophy - execute task, return results, process,
iterate
• Example: find all new ELBs, run a basic security scan
against them, return results

61. Dirty Laundry’s Approach
• Unix-like philosophy - execute task, return results, process,
iterate
• Example: find all new ELBs, run a basic security scan
against them, return results
• Example: for all Netflix employees with GitHub accounts,
search their public repos for security issues, return results

62. Current Support

63. Current Support
• Dynamic analysis - AppSpider, Arachni, Detectify

64. Current Support
• Dynamic analysis - AppSpider, Arachni, Detectify
• Static analysis - Bandit, Brakeman, FindSecBugs, Custom

65. Current Support
• Dynamic analysis - AppSpider, Arachni, Detectify
• Static analysis - Bandit, Brakeman, FindSecBugs, Custom
• Others - curl, GitHub, OpenGrok

68. Dirty Laundry Benefits

69. Dirty Laundry Benefits
• Embraces continuous deployment, self-service

70. Dirty Laundry Benefits
• Embraces continuous deployment, self-service
• Supports safe, high velocity development

71. Dirty Laundry Benefits
• Embraces continuous deployment, self-service
• Supports safe, high velocity development
• Decouples push schedule from security team bandwidth

72. Takeaways

73. Takeaways
• Security teams can leverage the high-velocity development
ecosystem

74. Takeaways
• Security teams can leverage the high-velocity development
ecosystem
• Shared history provides both lessons and input to
development

75. Takeaways
• Security teams can leverage the high-velocity development
ecosystem
• Shared history provides both lessons and input to
development
• Use engineering native workflows

76. Takeaways
• Security teams can leverage the high-velocity development
ecosystem
• Shared history provides both lessons and input to
development
• Use engineering native workflows
• Strive to make security more integrated and ubiquitous
while also improving other system characteristics

77. Thanks!
@chanjbs