Securing Devops: Safe Services in the Cloud

401 Pages·2018·12.23 MB·English

by  Julien Vehent

Security in the cloud
Julien Vehent
M A N N I N G

Securing DevOps
Security in the Cloud
JULIEN VEHENT
MANNING
Shelter ISland
For online information and ordering of this and other Manning books, please visit www.manning.com.
The publisher offers discounts on this book when ordered in quantity.
For more information, please contact
Special Sales Department
Manning Publications Co.
20 Baldwin Road
PO Box 761
Shelter Island, NY 11964
Email: [email protected]
©2018 by Manning Publications Co. All rights reserved.
No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form
or by means electronic, mechanical, photocopying, or otherwise, without prior written permission of the
publisher.
Many of the designations used by manufacturers and sellers to distinguish their products are claimed
as trademarks. Where those designations appear in the book, and Manning Publications was aware of a
trademark claim, the designations have been printed in initial caps or all caps.
∞Recognizing the importance of preserving what has been written, it is Manning’s policy to have the books
we publish printed on acid-f ree paper, and we exert our best efforts to that end. Recognizing also our
responsibility to conserve the resources of our planet, Manning books are printed on paper that is at
least 15 percent recycled and processed without the use of elemental chlorine.
Manning Publications Co. Development editors: Dan Maharry and Toni Arritola
20 Baldwin Road Technical development editor: Luis Atencio
PO Box 761 Project manager: Janet Vail
Shelter Island, NY 11964 Proofreader: Katie Tennant
Technical proofreader: Andrew Bovill
Typesetter: Happenstance Type-o-Rama
Cover designer: Marija Tudor
ISBN 9781617294136
Printed in the United States of America
1 2 3 4 5 6 7 8 9 10 – DP – 23 22 21 20 19 18
To my wife, Bogdana
To all the folks at Mozilla who keep the web secure and open

brief contents
1 ■ Securing DevOps 1
Part 1 Case study: applying layers of security
to a simple DevOps pipeline ...................................19
2 ■ Building a barebones DevOps pipeline 21
3 ■ Security layer 1: protecting web applications 45
4 ■ Security layer 2: protecting cloud infrastructures 78
5 ■ Security layer 3: securing communications 119
6 ■ Security layer 4: securing the delivery pipeline 148
Part 2 Watching for anomalies and protecting
services against attacks ......................................177
7 ■ Collecting and storing logs 179
8 ■ Analyzing logs for fraud and attacks 208
9 ■ Detecting intrusions 240
10 ■ The Caribbean breach: a case study in incident response 275
Part 3 Maturing DevOps security ..................................299
11 ■ Assessing risks 301
12 ■ Testing security 329
13 ■ Continuous security 354
v

contents
preface xiii
acknowledgments xvi
about this book xviii
about the author xxi
about the cover illustration xxii
1 Securing DevOps 1
1.1 The DevOps approach 2
Continuous integration 4 ■ Continuous delivery 4
Infrastructure as a service 5 ■ Culture and trust 6
1.2 Security in DevOps 7
1.3 Continuous security 8
Test-driven security 10 ■ Monitoring and responding to
attacks 12 ■ Assessing risks and maturing security 16
Part 1 Case study: applying layers of
security to a simple DevOps pipeline ... 19
2 Building a barebones DevOps pipeline 21
2.1 Implementation roadmap 22
2.2 The code repository: GitHub 24
2.3 The CI platform: CircleCI 24
vii
vviiiiii contents
2.4 The container repository: Docker Hub 28
2.5 The production infrastructure: Amazon Web Services 30
Three-tier architecture 31 ■ Configuring access to
AWS 32 ■ Virtual Private Cloud 33 ■ Creating the
database tier 34 ■ Creating the first two tiers with Elastic
Beanstalk 36 ■ Deploying the container onto your systems 40
2.6 A rapid security audit 43
3 Security layer 1: protecting web applications 45
3.1 Securing and testing web apps 46
3.2 Website attacks and content security 50
Cross-site scripting and Content-Security Policy 51 ■ Cross-site
request forgery 57 ■ Clickjacking and IFrames protection 62
3.3 Methods for authenticating users 63
HTTP basic authentication 63 ■ Password management 65
Identity providers 67 ■ Sessions and cookie security 71 ■ Testing
authentication 72
3.4 Managing dependencies 72
Golang vendoring 73 ■ Node.js package
management 74 ■ Python requirements 76
4 Security layer 2: protecting cloud infrastructures 78
4.1 Securing and testing cloud infrastructure: the
deployer app 79
Setting up the deployer 80 ■ Configuration notifications between
Docker Hub and the deployer 81 ■ Running tests against the
infrastructure 81 ■ Updating the invoicer environment 82
4.2 Restricting network access 83
Testing security groups 84 ■ Opening access between security
groups 86
4.3 Building a secure entry point 88
Generating SSH keys 89 ■ Creating a bastion host in
EC2 91 ■ Enabling two-factor authentication with
SSH 92 ■ Sending notifications on accesses 98 ■ General
security considerations 100 ■ Opening access between security
groups 106