Apollo Clark apolloclark

"Official Docker Image" Base OS Support Matrix

Analysis was performced on Aug 11, 2019.

Support Matrix

https://www.linkedin.com/pulse/very-short-comparison-ansible-chef-puppet-saltstack-niels-goossens/

Analysis was performed on July 1st, 2019

Chef

https://www.chef.io/
https://docs.chef.io/chef_overview.html

Supermarket - role repo

Why Nobody Upgrades Servers Weekly in 2019

No one wants to run old software. We all appreciate using the latest stable version of a given piece of code, be it the OS, a service like Postgres, or an app on your phone. However, it's still difficult to accomplish that. Let's explore why and how to actually fix it.

Outdated Software is Easy to Find

After 40+ years of security product marketing, the common wisdom of doing security is to buy: anti-virus, firewall, vulnerability manager, and a static analyzer. The first two have their own limitations, so I'll be focusing on what happens after a vulnerability managers finds something, and how to actually fix it.

Nobody owns it

DevSecOps Maturity Model

DevSecOps has finally become popular within the wider IT industry in 2019. I started as a web developer in 2001, learned about testing automation, system deployment automation, and "infrastructure as code" in 2012, when DevOps was becoming a popular term. DevOps became common after the release of The Phoenix Project in Jan 2013. It has taken 7+ years for security to become integrated within the DevOps methodology. The following is a list of concepts I go through with project owners, project managers, operations, developers, and security teams, to help establish how mature their DevOps and security automation is, and to help them increase that maturity over time. This model is based on experience consulting with a variety of US Financial, Healthcare, and Department of Defense, organizations, and combines:

PCI DSS
NYDFS
[HITRUST CSF](https://hitrustalliance.net/product-tool/hitrus

Build Tools and Testing

Build Manager

Goal - centralized UI, and scheduler, for managing automated builds

Terraform Enterprise - HashiCorp
Jenkins - Cloudbees
TravisCI
CircleCI
Bamboo - Atlassian

SOC Team

Interview questions?

Attitude - What do you want to learn?
Knowledge - What do you read for books, blogs, podcasts, Twitter?
Skills - OSI model, nmap, aws-cli, Bash, Powershell, Python?
Tools - Do we have log monitor, alerts, reporting?
Training - Which certs?
Mentorship - How do you want to get trained internally?

Example SOC Alert Ticket

Summary

Load Balancers without TLS/SSL enabled.

Timeline of Response

alert detected on 2019-03-27
ticket opened on 2019-03-27
must be closed by 2019-04-03, per Company SLA

HTTP Security Headers

Overview

HTTP Security Headers do not prevent server-side attacks, but they do help mitigate some client-side attacks, within browsers that support the headers.

	### Keybase proof

	I hereby claim:

	* I am apolloclark on github.
	* I am apolloclark (https://keybase.io/apolloclark) on keybase.
	* I have a public key ASC2AayT4Qb7Hxt6BAgO_ocgIbKf0IsyhmdaIalmO43ivAo

	To claim this, I am signing this object:

	#!/usr/bin/python
	import skew, json, placebo, os, sys
	from pprint import pprint
	from datetime import datetime
	from elasticsearch import Elasticsearch

	# parse command line args
	arn_list = {

	# logging