Security as Code

Table of contents

1. Preface
   1. Who Is This Book For?
   2. What Do You Need To Get Started?
   3. What's in This Book?
   4. Conventions Used in This Book
   5. Using Code Examples
   6. O'Reilly Online Learning
   7. How to Contact Us
   8. Acknowledgments
2. 1. Introduction to DevSecOps
   1. Before DevOps: The Software Development Life Cycle
   2. What Is DevSecOps?
   3. Introducing Automatoonz
   4. Cloud Infrastructure: Secure by Default
   5. Move Fast, Secure Fast: The Importance of Automation
   6. DevSecOps Culture
   7. Summary
3. 2. Setting Up Your Environment
   1. What You'll Need
   2. Installing and Verifying Your Setup
      1. Installing the AWS CLI
      2. Installing the Docker Engine
      3. Checking Your Python Version
      4. Installing Git
      5. Installing Kubernetes
   3. Creating Your First Bare-Bones Pipeline
   4. Summary
4. 3. Securing Your Infrastructure
   1. What Makes Infrastructure Secure?
   2. Hands Off! Preventing Unwanted Access with IAM Permissions
   3. Detecting Misconfigurations
      1. Identifying a Standard
      2. Threat Modeling
      3. Security Controls
   4. Better Than a Cure: Implementing Preventive Controls
   5. Implementation
   6. Summary
5. 4. Logging and Monitoring
   1. What Are Logging and Monitoring—and Why Do They Matter?
   2. Attack Styles
      1. Advanced Persistent Threat Attacks
      2. Ransomware Strains
      3. Passive and Active Attacks
   3. Log Types
   4. Log Storage
   5. Detecting Anomalies
   6. Remediation with AWS Config
   7. Correlating User Activity with CloudTrail
   8. Network Monitoring with an Amazon VPC
   9. Summary
6. 5. Controlling Access Through Automation
   1. The Principle of Least Privilege
   2. Fine-Tuning Access Controls
      1. Use a Tagging System
      2. Clarify Team Responsibilities
      3. Prevent and Detect
   3. The IAM Pipeline
   4. Summary
7. 6. Fault Injection Test
   1. Distributed Systems
      1. Adaptive Security Controls
      2. The True Cost of Downtime
   2. Methods for Minimizing Downtime
   3. Chaos Engineering
      1. Basic Principles
      2. Advanced Principles
   4. Chaos Engineering in AWS Environments
   5. Chaos Engineering at Automatoonz
   6. AWS Fault Injection Simulator Experiment Examples
      1. Kubernetes Pod Stress Testing
      2. Throttling EC2 API Calls
      3. Stress Testing the CPU on an EC2 Instance
      4. Terminating an EC2 Instance
      5. Removing Ingress and Egress Rules from a Security Group
      6. Detaching an EBS Volume from an EC2 Instance
   7. Summary
8. 7. People and Processes
   1. People: Team Structures and Roles
      1. Security Engineers
      2. Developers
      3. Compliance Team
      4. Product Manager
      5. Team Structure
   2. Processes: Practices and Communication
      1. Communicate to the Right People, Consistently
      2. Make Product Owners Accountable for Their Security Findings
      3. Build Threat Modeling into Your Processes
      4. Build Roadmaps to Reach Your DevSecOps Goals
   3. What Next?
   4. Summary
9. Index
10. About the Authors