THE DEVOPS OPPORTUNITY: BALANCING SECURITY AND VELOCITY INSIGHTS - PowerPoint PPT Presentation

THE DEVOPS OPPORTUNITY: BALANCING SECURITY AND VELOCITY INSIGHTS FROM RED HAT/CYBERARK DEPLOYMENTS AT SCALE Joe Garcia, CISSP - Principal Engineer, DevOps Security joe.garcia@cyberark.com @Joe_Garcia

David Federlein Joe Garcia Likes Coffee & Ansible Guru Likes Golfing & CyberArk Guru 2

APPLICATION IDENTITY MANAGER: HIGH LEVEL PERSPECTIVE Application Identity Manager Applications Application Servers (WebSphere, Weblogic, etc.) Secure Storage Security Databases Appliances ***** Applications Unix CyberArk Vault Password and SSH Servers Key Rotation Network Servers Devices Applications Windows “app” Username = GetUserName() Username = Servers “y7qeF$1” Password = GetPassword() Password = Host = GetHost() “10.10.3.56” Host = ConnectDatabase(Host, Username, Password) ConnectDatabase(Host, Username, Password) Cloud Websites/ Infrastructure Web Apps Applications Mainframe Servers Applications Desktops

https 1858 EXAMPLE: AUTOMATIC SECURE CREDENTIAL RETRIEVAL Centralized When Ansible Requires Privileged Vault Credential Provider Control Node Credentials: 1. Include the cyberark.modules role from Ansible Galaxy in the playbook. 2. Provide Application ID , Client 1 Certificate , Safe , and Username to cyberark_credential function imported from the cyberark.modules 2 role. Making sure to delegate_to: localhost if the Client Certificate is stored in Ansible Tower. 3 Ansible Playbook 3. Credential is register ed in the variable name provided and can be used throughout the playbook to access assets, APIs, configure systems, install applications, etc. Managed Nodes

LET’S DO IT LIVE! 5

WHERE TO LEARN MORE – www.cyberark.com/conjur ▪ Use CyberArk – Ansible plugin to secure your Ansible playbook Key ▪ Checkout CyberArk solutions for Ansible: Takeaways https://www.ansible.com/integrations/devops-tools/cyberark ▪ Visit www.cyberark.com/conjur Ansible ▪ Visit https://galaxy.ansible.com/cyberark/ Integrations: ▪ Download CyberArk AIM Module role from Where to https://galaxy.ansible.com/cyberark/modules/ Start ▪ CyberArk Conjur Ansible Role & Lookup Plug-in are available on GitHub and Ansible Galaxy. ▪ CyberArk Conjur Open Source – free and available at conjur.org or http://bit.ly/2HTyp2j (hosted trial), Slack channel for questions Other Useful ▪ CyberArk OpenShift/Kubernetes Integration Resources ▪ eBook – 6 Core Principles For Establishing DevOps Security at Scale ▪ Security Report - Unaware and Unprepared DevOps Security at Risk

Thank you! Joe Garcia, CISSP – Principal Engineer, DevOps Security joe.garcia@cyberark.com @Joe_Garcia 7