Compliance, security automation, and remediation with Red Hat

hi everyone thanks so much for coming to our session today how you guys having fun at Summit this week so I am super excited to be presenting to you guys today this is my second time at Summit and my first time presenting so I'm really super excited to be here my name is Lucy Carter and I am a senior cloud Solutions Architect at Red Hat's North North America public sector team and so in this role I support and provide a domain expertise in Red Hat cloud products and our management products for a wide range of public sector customers and with me is my esteemed co-presenter Matt Matheny afternoon I am a solution architect with a partner of red hats TLT solutions I support Lucy I support customers doing all sorts of things everything platform all the way down up through OpenStack open ships and all those sorts of good things and without any further ado let's go ahead and get started with today's talk about how we can start automating compliance remediation and security automation in general with various different write out products okay so what are we going to talk about today I am going to show you how you can use that has management products I'm talking cloud forms I'm talking anvil tower Red Hat satellite Red Hat insights so how are these tools going to help you with compliance security automation and remediation specifically we're going to focus on two use cases number one I am going to show we're going to show you how to create a compliant host at provisioning time two different ways maybe you're a satellite customer you don't have cloud forms you don't have the ansible Tower you don't have any of our management products but you have satellite and you have satellite sticks we're going to show you how to create that secured a compliant host at provisioning time now for those of you who don't have satellite six no worries you can still create that security compliant host at provisioning time using our management product our other management products so once you've provisioned this security compliant host how are you going to do that continual automating of that automating of your security remediation your compliance for the life cycle of that via the entire lifecycle how are you going to provide that ongoing compliance so we're going to talk about how you can do that with our management products so first of all why do you want to automate compliance let me ask you this why would you want to do this manually why would you want to do security checks manually it's very time-consuming it is prone to error it is going to want to make you about all your hair so so the thing is doing these security checks and remediation it is very repetitive and it is a perfect candidate for automating and when you automate security checks and remediation what you've done is you now have security as code now you can not only not only is it repeatable now it's shareable put that bad boy on github and share it with your friends and family you know put that link on Christmas cards the cards to your anniversary card to your wife whatever so why do you think we should automate compliance map well I think that the repeatability is key right we're talking not just about infrastructure is code here where yes absolutely we need our systems look like but now we're talking about security right we're talking about compliance and we're talking about audits so we need something that is reliable repeatable and non repudiate a bowl as far as what are we actually doing on all of these systems security is code gets us that much farther that we can apply this now across multiple baselines with single sets of tools and know and understand and aversion and twelve matter exactly what sort of remediation what sorts of scams what sorts of compliance are available for multiple different environments that we're trying to manage and that's really important because like what is compliance before anyway right it's just a whole bunch of PDFs and checklists and you know Excel spreadsheets that we do once a year because we have to write know it really should be part of a larger security framework right compliance is not secure we all know that right yes but compliance is a security activity and we all have the environments right PCI compliance HIPPA compliance FISMA FedRAMP and in fact we're getting the places where now we see those sorts of compliance regimes applying to single environments right where we have to comply with three or four different regimes for our audits California state of California Department of Justice published their brief report this year and their breach report actually stated that they're recommending recommending that in cases of law where a reasonableness standard must be met and there is no governing compliance in place they will apply CIF CSV for you as in that's what you have to comply with post if you have an issue when you're reporting a breach in California so now we have sources that we might not even know about until it's too late right so we've got lots of different sources lots of different regimes and they're now starting to overlap where we used to have very clear lines that this was only a PCI environment now it might have to be a PCI environment that's also FISMA right and of course this quote from doctors dropping is actually fairly old but it still holds through automation and patch management vulnerability scanning compliance is a major issue because our environment for security is really different than it was a long time ago right we're not the first ones to hear about these things on security focus on bug tracking on dark reading right our bosses are coming in 24 hours after heartbleed going so I read this thing in the New York Times the New York Times is two and a half pages long online and really really accurate and really really scary right and Ken Weston made this last year I use it again last year you know these are coming out with better marketing slicks than some startups I know you guys see what the one that like affected 1% of 1% of people because of the possibility of having a floppy drive in a virtual machine did you see their launch right so the things that were actually up against right as users as security admins as compliance managers right most of all of these days have a we'll call it average 45 to 60 to exploit window but time to remediate is 120 days on average tells you something right the other thing that also we missed out on the we don't remediate and we'll manage it on a lifecycle sort of environment is that we've have things that have been out there for 10 years that are still racking up 70 80 90 source violations in some of these both at DB are from from California also Verizon on what are still actively exploited as part of these breaches right so s cap s cap is a beautiful wonderful horrible thing it's a protocol security compliant automation protocol it's really umbrella for I think we're up to nine ten different things right at some of them are evaluation languages some of them are enumerations that tell you what things are some of them are measures most folks here are probably fairly familiar with CBS and CBS s right the common vulnerability language that we all use to describe what does this vulnerability do and how do we measure risk most of what we'll talk about today in s cap we're really talking about two things x CCDF which is the checklist that's the thing that replaces all of our nice Excel spreadsheets also allows us to set some variables and tell us what we are trying to set and then oval oval is the actual machine-readable functionality that allows us to how do we actually check a system and what are we actually doing on that system to say yes we passed and that we have to pass the one thing that's interesting here to note is that while most of what you see in s cap content generated by vendors and generated by people our benchmarks for compliance that's not the only thing you can do with s cap you can automate any sort of security check right so this should and can be part of again a larger effort the other thing you'll need is a validated scanner and read Hecht gives you one for free right this is included in rel it's been validated by NIST which means it's right up there on the validated list with all sorts of really really really expensive tools that most people wind up having to buy this is really good again when you're talking about audits audits want something that has been tested and proven to be appropriate accurate and then again right non-repeatable as far as what are we doing and open s cap the scanner itself part of your product and this is what we'll use to actually scan systems we talked about the first set with satellite six and with also rel seven to write satellite six hopefully most people here are familiar with it Red Hat's satellite product for design deploy and managing your full lifecycle of your virtual machines physical machines bare metal what have you anything well what you may not know is in rel seven - we got a new feature in anaconda of all places we have now the ability to remediate security policy during time installation that's really cool right so you get this nice little GUI button that's a security you click on that in the in the hub and you get the list of things that are available built into the iconic ionic on I so you get the various lists of profiles that are available we can actually pull content from other locations so if you have an HTTP source you can actually do that during built which is great but show a hands real quick how many people here still build systems using GUI click-throughs on a daily basis yeah that's kind of what I thought right so good thing though is anything we can do it in akanda we can kick-start it alright so this is what the kickstart snippet looks like for the add-on very simple very straightforward where's our content coming from what profile will be using we've got all sorts of things to make sure that we've got the right data streams we can finger print these things it supports different kinds of content types and then that's the kind of fol basis and then the most simple version of that is the one in the lower corner right you have content here's a profile boom do it so how do we do this right the first thing we need to do and this is P in any satellite but especially when you talk about policies here we need to create a new host group this group is what's going to carry along with us the new form and s gap client content this is going to make sure that not only will we be able to mediate at boot time but also on an ongoing basis this will now be part of our daily scheduled weekly scheduled ongoing remediation and that s cap client is what drives the openness gap scanner remediation and reporting back to centralizing in ASCAP re and satellite so first we need to create a new content upload one important thing here to note is the file type right so satellite six likes to see data streams data streams are not all that difficult they are specially packaged XML files that contain multiple different of those ASCAP objects in a single file right so you get the machine readable stuff you get the human readable stuff and maybe get some platform enumeration stuff but all lays out in one easy-to-use file for scanners and then things along these lines they're not they're not really anything special to distinguish I containing both right once we have a new content we can go ahead and create a new policy for this example we're using the PCI baseline that's actually included with the rel content for all this I'm just using the SSG package that they included in well seven but you can use your own packages you can get content from various different vendors and where whatnot once you've actually created it that actually should give profile you see that's automatically selected based on what content you provided however many profiles are there show up and drop down box wait I said we can go ahead and we can schedule it weekly Tuesday right get these things up and running all the time pick locations those sorts of things and then we're going to go ahead and we're going to apply it to that particular post group recreated right this is why we associate hosts with scans this means that on going once the system is up and running we're a boot into that post group we will automatically get weekly scans on Tuesdays for radiation cool right so we don't need to update that host creep we're going to go through this kind of quickly that a lot of the things that we're doing here is all fairly straightforward in the interface and there's some things and might get hub repo for some of those later stuff so don't worry if I'm going too fast and you're not getting all so one minor issue at this point in time and I'm speaking today actually again with the with the folks downstairs for the satellite team because of the way that we store that content it's not really accessible directly from within puppet because of some security reasons awesome so we need to go ahead we need to make sure that we publish it somewhere right now I'm just tossing it into the pub directory satellite automatically always comes with a pub directories you can put things in there and SSL assurance is usually what standard would land there I'm going talking to rich today rich arena was one of the TMS for satellite and he actually said with six to there are some new things with file repost that might make this easier to distribute so keep an eye out for 62 there might be an easier way to do this but we need to make it available so that during kick start anaconda action to reach out somewhere over HTTP and actually find it then we need to tell the host group where we put it all right so we're going to create a new global parameter and I call it something if you like download path and then we'll tell it what that full path to that satellite via the directory and the name of the content we created you'll also notice that the s cap client itself like actually two laser pointer didn't lose use on that s cap client comes along with its own global parameter that will actually use with some Ruby code to actually see what policy we have actually applied to this system when we're trying to kickstart kickstart templates so satellite six creates has a full er be based templating system that uses those full templates and things called snippets to create and cobble together full-blown text art templates based on host parameters and all sorts of other sorts of different things so the very first thing we're going to do is going to create a brand new snippet again this is on my github repo so I need to know D just try to interpret Ruby on-the-fly we've got a probably fairly bad I'm not already got policy at the top that actually just says hey if we we have that policy set and there's something in that value so the s cap client has attached a policy to this post group and we're kick-starting a system go ahead and pull out what that that policy name is and then we're gonna go ahead and populate some known variables right so we get that we build that content URL based on the information that we've got from satellite and what profile ID we're going to use the other thing that we need to do because at this point in time pre-installation remediation is not possible that's a fancy word for saying things that you need to do before you actually start laying down packages like partition tables those still need to be done by hand here it's also very simple because partition tables or something you can natively do inside the satellite section you I this is a very simple one I literally copy and paste it into a box can't get much simpler than that right there is a way that you can see hopefully I can't really come from here there is a way to you evaluated bash grips you can actually get fairly complicated with what you need to do you need to do particular things on particular classes of devices are all sorts of various other things you can actually make dynamically generated partition tables as well as just flat simple hey this is what I always want the partition table to look like and use LVM and do auto rail and those sorts of things those are pretty much the only two things that we need to do for pre remediation in most environments if you do have other things that you need to do for specific remediation around things like partition tables or things that wouldn't normally get caught by the O's cap remediation you can also do it again in snippets or as a partition table or something along those parts and the bottom link down there is actually the particular repo that these files are actually added once we have the snippet in we need to actually tell the kick-starting template that we actually want to use it and it's extremely complicated one line right there use the snippet just copy the existing template stick it in nice thing about the way that I authored that particular one is that the snippet ated itself actually checks to see whether or not it has a policy if it doesn't nothing happens you get a blank line and that kickstart template so it's safe to use it broadly and again depending on what you guys want to do with your particular snippets you can make it just as simple and once that new template is created we need to associate it with an operating system so that an operating system actually use it final things we also have to associate it the opposite direction we can associate the kickstart with an operating system but we then actually have to go back to the operating system definition in in satellite under content and actually tell it that we want to use this new provisioning template and that we want to make that partition table available to users now this is interesting because it means you can actually start defining SOS based on things like this is a PCI based on SOE and therefore most always use a PCI provisioning setup you can remove the default text arts you do a lot of various different things by changing how you're representing an operating system in satellite six gives you a lot of flexibility to use this stuff during kick start so how do we put together you actually you actually use this again fairly simple we create a new host all we have to do is select that host group that we've associated our particular scan with and our particular policy it will automatically drag along the puppet as cap class that we need we tell it the operating system we select our partition table from the drop-down and then we've got our global variable there right so if for example we do need or we do have for some reason a different set of content for this particular host we can override it on this particular host but the group in general leave it as the upstream defined there's a nice little button within that once the host of define it tells you how you can show us what it looks like and this is the built kick-start template once you provision the host with this template you'll go ahead and remediate and you can see that it actually it's building all the appropriate things the profile ID it knows where to pull content from and it's about our name example as soon as this host builds as soon as it goes through its now compliant we can do an immediate scan as soon as it comes up it'll report itself all the way through and some of the new and interesting things there's actually in 6 - I just thought the reporting is actually much nicer and it is laid out a little bit easier but this then L will be in our weekly updates and apply it out of the box with rel 6-hour sorry rel seven - and later and satellite X but Lucy what happens if we don't have satellite six or rel seven - you're gone just kidding you don't have a satellite six or l7 - no problem you don't even have satellite no problem you can use the rest of our cloud management products to help you with with this part with this solution so how do I create a compliant host if I don't have any of first of all what is cloud forms cloud forms provides unified management for your entire infrastructure I don't care if it's for actual infrastructure private clouds such as OpenStack public clouds Amazon or Azure of Google compute engine even your container environment cloud forms can see that even your networking environment classrooms can see that and in the future we're gonna be able to see the storage and even your middleware environments so conferences seeing all this environment and he's collecting all this information about the environment and then now I know data that I don't have all this data about your environment and you know the phrase knowledge is power right I have this data in my environment use it as the foundation of cloud forms and now I can use it to create reports show me all the VMS that are failing as barreling on shellshock it's vulnerable to shell shock I can do compliance and governance I can do comparators catalog that I want to offer to my users cloud forms has a very powerful and very flexible automate engine that it can talk to anything that has an API including our own products satellite ansible tower in fact in for one's classrooms 4.1 which 3G 8 about two days ago we built that integration into class forms meaning you don't have to worry how you're going to talk to ansible cloud forms took care of that for you you don't have to worry like you don't have to worry how am I going to talk to my you know Google environment my Google compute engine or how we're going to talk to my Amazon environment cloud forms took care of that for you so I can launch ansible playbooks right from cloud forms in my next in this demo what I'm going to show you is how am I going to create this compliant host at provisioning time using cloud forms using satellite using ansible tower without writing a single line of code and having multi-tenancy so a user comes into cloud form and he's going to push an order button and when I push that order button behind the scenes the user has no clue that it's provisioning the vCenter VM it's going to register with satellite and it's going to do all these securities remediations on it for example the Defense Information Systems agency the actual security implementation guide the DISA stick it's you there's a playbook out there and it's going to do all those radiations for you there you don't have to use that playbook maybe you want to use the Center for information security center for internet security and you want to use that playbook instead so you are compliant against those benchmarks so let's see that in action so as I mentioned there is a playbook out there but that was written by mine point group and ansible for the rl6 business stick and there are some default variables like such as maybe how hard you know block down do you want this do you want to cat one cat two cats three cats three is complete lockdown maybe you want to change some other default variables you want to use DHCP is ipv6 in use these are variables that you can overwrite from the default now if I look inside Tower I'm going to see these job templates so I can see here's my actual stick job template where I'm up using the inventory the vCenter vm inventory i'm going to run that playbook use these credentials and so now when I go into cloud forms into the self-service you I'm going to log in as the admin the admin has set up various different service catalogs for example we have our discus our all the catalyst that I set up as the admin but also that my child tenant have set up I can see all of that you know maybe I have a package install that I want to do here's my actual rl6 distinct a service catalog so when I push that now the user is going to say okay well this is going when you press the order this is going to provision well 60mm visa it's going to register it with satellite five seven and then run the rel six statistic playbook on top of the newly provision VM so that's the push of a button literally you have a security secure a compliant VM and the user has some options to change those default variables like the cat one cat two cats three etc or using DHCP whatever you want to provide that this is completely customizable this is completely configurable so now you've asked the user the question that user has answered and now all he does is press the order button add it to a cart like Amazon press order and now magic happens behind it for cloud forms calls from says okay now I'm going to launch the provisioning state machine a state machine you know like a honey-do list you want to you have this to do than this to do than this to do and you need to do it in that order right and because it's just let's say you pick up the babysitter before you are you drop off the babysitter before getting the kids you're like you know you have hell to pay later right so you want a state machine you do are doing it in order and so first step provision of the M&V Center the user has doing nothing this is happening behind the scenes classrooms is doing this work for you so this VM is actually getting provision and beast in in um in the center and so we're waiting for to get provision we're waiting waiting and then here we go admin rl6 seven six zero zero four it gets provision in V Center and now we just wait for it to power up it's going to power up and then and then we're waiting for it to power up and we're waiting for to get the IP address as soon as it gets the IP address step number two ticks in cloud form says interval it's your job now your job is could launch the rustic launch the registering with satellite playbook go into like okay boss you're my boss because conferences the ball so I will launch that playbook and I'm going to register it with satellite five seven okay here we go and it says then that now that playbook all the steps in that playbook are getting executed now registering it with satellite maybe there's some packages you want to install afterwards all of that getting done right now so next once that's done and once you're actually registered with satellite see here successful here I'm actually register with satellite and here I can see it in satellite being registered now and now conferences okay next next step in my state machine is to run my next playbook which is making sure doing in my district stays on us so that it's going to be compliant on across the for the district and the ansible says okay I'm going to run that next playbook and here it is running it for that newly provision VM which is the admin rl6 of a stick and all those variables you saw from the service dialogue get passed to ansible tower so that it can overwrite these default variables extra variables so here you see that it's successful now I have a different user he is not the admin he is in a child tenant in the DevOps Kenneth his name is Peter Gibbons anyone know the reference so he is developer and he wants his own catalogs that is not seen by any other department his parent tenant can see it but the other departments can't seen his catalog though he logs in and then he gets presented with his catalog and here we go there's a DevOps deployer l6c is no variable and this is seen by the admin but it's also seen by everybody in that tenant in his DevOps tenant so when he actually goes ahead and then he goes as presses that or abun what's happening and look at the service dialogue member I told you it's completely configurable completely customizable the admin is in tight control over the environment because member I said knowledge is power I have this control over my entire environment and now I can say all right I am NOT going to tell you user what infrastructure I am provisioning all you know is that you are provisioning a rl6 VM that's registered with satellite and that passes the Center for Internet Security benchmark that is all you know you have no clue living in the center you have no clue that's living an Amazon you have no clue about Education Red Hat Enterprise virtualization frankly you don't care as a user right as a developer but the advent you better believe he cares because how about how about if I'm running out of space in V Center do I really want you to provision there if this guy Peter Gibbons is infamous for provisioning VMs in Amazon do I really want to like rack up my Amazon bill no I want tight control over that environment and that is why classrooms can provide that and said you know what you are Peter Gibbons from the DevOps department you are not going to provision insight anywhere except my VM my machines here that is Red Hat Enterprise virtualization so all of the choices he has literally is to say yes I want it you can't even set variable you can't do anything so you completely lock this guy down so he says ok well I will go ahead and provision my VM and then again guess what the honey-do list comes again the step by step that you have to do right and then entering the provisioning state machine once again and then once the VM is actually provisioned which is Right coming coming coming here it is now the DevOps well 60 is no VARs is being provisioned once this provision it's going to net and it's going to boot up right and then it's going to get an IP address IP address is there now guess what step number 2 of the state machine kicks in that number two is coliforms is the orchestra he's like the conductor right he's like the boss thing go do this go do that go do that right and he's going to say ok next step I want you to launch this registering it sound like this after that's done here we go the next step is to actually launch the Rolph sticks dig on it or that in this case actually Center for Internet Security benchmark that you're going to live on on top of it so here the registering set with satellite is that now being complete is being run for this particular VM and then after that once that's registered what's going to happen next is okay we're going to register a satellite it's done now what I'm going to do is I'm going to go to my next state machine which I told you before that it's going to launch automatically without me doing a thing except pushing the button it has out of matically now launched that playbook for doing my center Jennifer Internet security remediation making sure that it has this VM passive so now what I'm going to do is second user is going to log in checking user's name is Susie vamp Upington and she is from a different department completely different Department and she is from the security team now she is not going to see this catalog that you saw earlier because they're in completely different tenants they have completely different environments that they have visibility to including the catalogs that they can start pressing order from so she goes in and she goes to her service catalog and then when she goes to her service catalog she sees she sees the catalogs from the parent tenant but she doesn't see the DevOps see how that's missing she doesn't see that because she's not part of that tenant so she doesn't see that catalog but here we go we see the security team the security team has their catalog and it's to deploy a relic stick and symbol playbook that's modified that's specific to this security team that you want to have for this particular team and so you've modified it and then you've presented to the users as the catalog that they can order and you've customized this dialog so that you can say okay I'm only going to let you modify three variables that you can overwrite I'm going to let you tell you tell me like do you want cat one do you want ipv6 so you need all this cuz this is very specific oceans for that particular tenant that you've presented to them so that's the first demo now how do I keep automating like how do i do automate it ongoing remediation for my not only my existing my newly provisioned VM instance this but also my existing so I want to be able to automate and provide that lifecycle remediation for my new VM and all my existing vans and how do I do that well you can do that using our cloud manage or management products so in this next demo what I'm going to show you is how do you do maybe I want to do very specific scans and remediation open s cap scans and remediation on a per VM basis why would I want to do that well maybe you're super cautious and you don't want to be like remediating in remediating like thousands of VM that wants without trying on trying it once first right so maybe you want to say create a custom button that it might integration what I did was I created a custom button that the user can come in he sees his VM he clicks the button scan and when he presses it cloud forms again number I told you he's the boss so he's going to say hey satellite wake up you have a scan to do I want you to go ahead and scan that tell me if it passes or if it doesn't pass if it passes just you know put a towel on it I don't care if it doesn't pass I need to keep all kinds of records of it and notify everyone about it I want you to impact fails I want you to tag it if it fails I want you to open up a ticket and sell and remedy in service now if it fails I want you to email that person who's BM who is the owner of that VM because coliforms has again has this data about your environment even cool logs into cloud forms that's the Ruby object that you can access in your automation and you can say oh who logged in that person is going to get this email because his VM is like messed up here so we're going to have to notify him so let's go see that in action actually before that the other thing is classes can do it maybe you want to launch specific playbooks on a VM you want to be your nice admin you want to make these users life easier you want to say okay I want to create some button and I'm going to say okay for this button I'm going to let you launch a playbook that read that lets you install some packages custom packages I'm going to make another button for you that will let's say launch the rl6 statistic or the launch the playbook for the Center for Internet Security but on a per VM basis but what's happening is when you push that button it's going to launch the playbook for ended england do all these tasks in the playbook now what if i don't want to do it on a per VM basis now I feel okay that I tested this on one or two VM I want to match do this across my 1000 host and be Center how can you do that well how you do that is you create a service catalog then that service catalog is tied to a ansible job template which is tied to an inventory it can be let's say your V Center right your V Center inventory or your V Center has let's say 1000 VM okay so when I push that fun guess what happens you have you whatever that job template let's say doing the rel successive sticks all 1000 of them is going to get that applied to them so let's see this in action so I'm gonna log in right now into the admin portal of cloud forms I'm going to log in as admin and then what I'm going to do next is I'm going to go into my environment I'm going to look at my infrastructure I'm going to say ok let's go look at my VMs here so I'm going to look at my VM and I'm going to say oh my environment I have to read environments read higher-priced virtualization it's one in cs1 and volley I also have to be Center environs one in Raleigh one in Phoenix and here we go this is the VM that I just provisioned as admin role six big zero zero four you can get a rough idea now about the kind of data that Clarence is collecting not only IP address you know container level operation but relationship info such as okay well tell me what clusters there what host is a part of all these kinds of information and so then call forms does then what you want what we want to do is one actually SSH into that VM and then look at this X CCDF file that we were talking about earlier because that's where all the profiles are and that's where all the security checklist starts so I'm going to SSH into that VM and you can see here that there's a bunch of profile to profile IDs common server whatever each of them have different lists of security checks right so you see here partition four tabs and all of these different security checks by profile ID so what you can do now is on the cloud form side why don't you create a button create a button called SCAP that is scan and remediate that is going to look at that file so I press that button the Scan button and what's happening is Constance okay let me look at that file I am going to dynamically populate in a service catalog I'm sorry I'm going to dynamically populate in a dynamic drop-down and I'm going to say first of all when did you last scan this VM so give me the give me the last scan date and time also show me all your profiles in a dynamic drop it's going to look in that XP CDL fall and pull out other profile IDs and then put and put it in a dynamic drop-down so here's a dynamic drop-down but not only that remember I said you we tagged it was in sales or passes now with that tag I can say hey when you let there's these profiles here to see - as common all those other profiles that I got from deskpdf I'm going to tell you when you last scanned it I mean I'm gonna tell you if it failed when you last scan that did it pass or did it fail okay and so and also did you know were there some that you never scanned so now with that information you can make an intelligent choice if you can say okay well this one I never scan so I probably should scan this so now the user decides okay I'm going to scan the seat as to profile now what's happening is Constance okay satellite wake up we need to use your open s cap tool here to do the actual scanning and tell and you need to tell me what which if it fails or not and if even one of them fails I want you to immediately tell me because I'm going to mark that as failure in my eyes if one of them fails that's failure in my eyes so I'm now waiting for satellite to get that result from open s cap so then I say okay let's come back with the result here we go the CS - you can see that 124 path or 153 fails - guess what that's failure in our eyes so when I go back into the VM I can see more detail about which which passed and which failed which checks failed or which checks passed and then I get an email I get an email saying hey look you have an open s cab failure and this is your VM name and this is your actual pro policy that you failed on I'm going to say I'm going to email the person who logged into cloud form so this is the admin in this case hey hey admin you just failed on this particular this VM failed and on this particular profile and you better fix it in for 48 hours I'm going to fix it for you and then what happens next is service now is also going to get notified columns is going to stay service now wake up you to open up a ticket and this is what the tickets going to say so then ServiceNow consents okay let me open up the ticket tell me what you want me to put on the ticket okay you need to put the name of the VM that failed the owner of the Vienna well policy did he fail but not only that causes those all this information about your VM I'm going to I want to also give the ticket information such as I want to tell you the host may IP address whatever you want to send service now to open up the ticket you send all of that to it now the tickets been created again without the user ever knowing it got created so then now I can tag the VM so I can keep track of which ones are failed and which ones passed right so now I come in and I can see look at my tags and then of course it's going to be non-compliant on that profile you can see here these tag categories here at Cal compliant as kept occupied in it so here is Kemal compliant on the cs2 profile so now I can use those tags for reporting I can use it for automation I can say hey I don't care what environment is show me every one that has failed on the common profile show me every one of them are not pass the Corbett core OS profile whatever right you can do that now this remember is a B Center VM now you can say well Lucy why don't you show me the what if well you're like okay well that's nice it's a visa interview but can you or you say your hybrid cloud proved to me okay well there's a VM in Red Hat Enterprise virtualization we're going to go and look at that VM it's this this VM right here that I'm pointing to and I'm going to look inside that VM and I'm going to look inside that XD CDF file and I'll notice that inside that X CCDF file is a custom profile that I made called core based OS now core based OS does one thing and one thing only and that is is this package aid installed that's all I care about do you pass that is all I care about so then I'm going to say okay well let's let's check is it installed it was in fact installed so what I did here is that you've removed it I just yum removed it so guess what's going to happen now when I scan it it's going to fail so first of all we can see here when I last checked it it did fail of course if I check it again it's going to fail again so what I'm going to do is I'm going to scan it I'm going to look in satellite to give me the results scatter lights going to stay yeah you failed just satisfied one and then satellites going to say give that result to coliform and cloud forms is going to say ok I better generate some emails I'm going to generate the email to the person who this VM belongs to and I'm going to tell them that this VM with this is failing on this profile I'm also going to notify ServiceNow because I need to open up a ticket to a service now so he opened up and he's opening up the ticket with all the information that that ticket needs and then I'm going to tag it appropriately I'm going to say you're eska non-compliant on that core based OS profile then when I I want to fix it I'm gonna say you know what cloud forms I really want you to fix that for me there's a remediate button and so when you push that remediate button I'm going to install that package for you so then I'm going to pick that core base OS profile then what I'm going to do is I'm going to check to see what it gets installed so you can see here I was doing RPM - QA just to check when it gets installed just a matter of seconds when I'm looking at that VM in a matter of seconds I will see it get installed so you can see it's not installed not installed not installed and then installed so now what I can do is I can scan it again and now when I scan it again guess what's going to happen of course it's going to pass right so I'm going to here I'm going to scan it again and then pass it passes satisfied one it passes and then so now what's going to happen is number I said if it passes what I'm going to do is I'm going to actually update my tags to stay compliant now if I go back and look down here compliant on the core based OS profile and then he passes so I really don't care about email or opening up a ticket so when I go check my email here he's not going to have any kind of email so the other thing is that you can actually have the user be able to launch different types of automation so for example like you can give the user the ability to launch playbook so for example he has this please play books right here which is launching of all six DISA stig or installing custom packages you can create these custom buttons for the user so he's going to launch a relic business take a modified version of fig.2 for this particular VM so when he launches that platform is going to say okay well it looks like you want to launch this launch these remediations I'm going to top tell ansible that he has a job to do he needs to do these particular tasks in the playbook so ansible says okay I'm going to go and I'm going to actually do this for you then he comes in and can see that that's big play book on being pending that it's about to run and now it's running and then it's successful so what if you wanted to do this across multiple VMs like you're comfortable now you're ready to do it across all your hosts in vCenter how would you do that you would do it via Service Catalog so then what you can do is you can have the user come in press an order button on the Service Catalog and what's the conference we'll do this okay this job templates actually associated with these embedded inventory which is your 1000 VMs and vCenter so it's going to come in here and you're going to press order again and then what's going to happen it enters the approval state machine so maybe you have multiple levels of approvals that you need to end to have before you actually can do this order the service and the next thing you know what's going to happen is that job will actually get lon by ansible and then you can see here that when I look at the details you can see that there is no limit here which means that before you sell limit with a particular name of the VM he had here we don't have a limit which means that it's going to do it for all of your inventory all your vCenter VMs in Phoenix are going to have get this playbook of applied to them and so here you can see the whole inventory here how was the second demo now the conference also has in the GUI of conference itself there's a very robust and flexible control engine and so with that control engine I can do things like this I can in the GUI of class form say hey I want to know whether or not you know I have shellshock what you call from has knows about your what packages are installed what versions of package that can use that information as to say ok if you find this version of package and release number I know it's a shell shock so what I want you to do is this following action email the security team you know shut it off maybe you want to mark it as not compliant generator log much you can do that all in the GUI what you do is you wire it up and then you you apply that to a single VM or maybe all VMs in V Center or you know whatever your criteria may be we also can have control policies for containers itself classrooms can look inside the container image and look inside the packages in that container image and do an open s cap of the container images and know the results now that you know the results guess what use the number my phrase knowledge is power you know the results so make a control policy say if any of these image checks comes out as very high I know that that means that I need to take some immediate action mark that as non-compliant when a new container image comes into my environment I wanted you to immediately scan it so I know the results I know what packages are there I know if the open s kept results pass the severity of it all of that Wow Red Hat insight is also integrate integrated with column so you can do proactive distance management with Red Hat insight so what I mean by that is okay well tell me is the MC kernel panic is happening and what - what host is happening at so the minute we find out about it we RedHat find out about it you will know about it as well through Red Hat insights so in summary we showed you how you can use Red Hat's management products to do create secure security compliant host app provisioning time without making you have certain things you don't have to if you don't have satellite six no problems you don't have satellite no problem using a combination and a mix of our Red Hat management products you can achieve these goals of creating a compliant host and at doing that automated ongoing security remediation compliance with that so with that you have security in terms of up you can ensure security literal at the push of a button and you save time and money but let me leave you with one more final thought you know you our talk definitely was about automating security and compliance but guess what remember I told you that cloud forms has can talk to anything that has an API you have your not ansible shop no problem Coughlin's can talk to puppet or chef-y api and civil has over 500 modules and all thousands of ansible roles on ansible galaxy that is the community hub for sharing roles so really we can satisfy your use case with your with Red Hat management products the only limitation is your imagination so I want to thank you for your time and take your questions other touch could you walk the room please first question understood you mentioned the cloud forms has visibility into the networking as well could you instead of just alerting people about a security violation actually move that machine into like a quarantine Network that VM into quarantine network until it's been remediated and then move it back yeah exactly that you can do that through automation yeah and as a broad comment you know we showed some very specific use cases and some very particular patterns but pretty much like Lucy said anything you can possibly think of doing in any combination like some of those scans remediation that we actually did we're done with openness cap remediation some we're done with ant or remediation so we can you can stack it and chain these things together do a lot of different things and and as far as the actions that cloud forms can take is almost mind-boggling unlimited question we just dazzled you all and there's no possible way you can put career and thoughts together I thought you guys had a CIS playbook did you guys custom make that or where where'd that come from I'm serious yeah that's majors yes so major haven from Rackspace he just released that the latest version a couple weeks ago actually but he's been working on that particular one the realistic Stig from my point I think I saw Jonathan walk in areas in the back Jonathan's actually doing the ansible - lock down in the back corner so if you want to chase you can correct me but this is basically curated security ansible roles and whatnot in bin one one space to try to hold a lot of informations you have running all over the place trying to find it but that was that's a community one I think we should we have an annotation flood that has oh yeah all those things yeah there is so that's on majors github page and that one in particular is yet he he did that himself as part of was also into open he's got a OpenStack and whole security guide to that does Stegen NCIS instead said rather front when you're doing an open s gap and you're actually scanning the system how does it handle tailoring files how's the hotel about so open s gap panel tailoring files great yeah so there's just a it's just a - - tailoring you can tell where it is now satellite six is opinionated right now and wants data streams so if you have a tailoring file it's really really really complicated if they just do a file yet another generated data stream so if you don't have to do that if you have a tailor involved because the tailoring file is technically just an inherited profile it really doesn't have anything else you can just copy and paste that into your profile but there actually is an RFP to get tailoring support directly in the satellite six so you don't have to do that okay and just that in question suicide note of the integration that you had you had integration between cloud forms and ServiceNow yeah one of the things I'd be looking at is the other way around we have this service now somebody submits or exactly ever whatever yes can it be bi-directional yeah cloud form 2008 pi/2 so you can do by directional integration so some customers actually say I don't even want to use cloud forms as my user interface that order from cloud for up from ServiceNow and then columns will do all the backend provisioning world that's a very common use case you're really a formative or just yeah and we have an essential here so feel free to email us if you want to get our business cards afterwards feel free to take that and would love to hear from you I'm with any questions you have and in the survey remember to stay lucy and matt rocks thank you very much early hi thank you you

Channel: Red Hat Summit

Views: 2,406

Rating: 4.5999999 out of 5

Keywords: Red Hat, Summit, 2016, Res Hat Summit, CloudForms, RedHat Satellite, Ansible Tower, Ansible Tower by Red Hat, Compliance, security, security automation

Id: 1VhEPmo5jiU

Length: 57min 36sec (3456 seconds)

Published: Thu Dec 22 2016