Automating Security Policies, from deployment to auditing using Rudder
Speaker(s) : Jonathan Clarke
- Date : Wednesday 10 July 2013
- Schedule : 14h00
- Duration : 40 minutes
- Place : H 2215
Designing, applying and keeping track of security-oriented rules for your IT infrastructure can be a time-consuming, costly and approximate job. Whether you’re in charge of defining the policy, implementing it or checking for discrepencies, you’ll be aware that all of this takes time, often out-of-hours time, that there is a lot of room for error and usually a considerable gap between ideals and reality - just how big a gap may or may not be shared with everyone involved.
The underlying topics covered will include deploying identical settings everywhere, saving time for multiple changes, near real-time auditing of actual settings, gaining global overview to help analyze vulnerability impacts, and improved reactivity.
This talk will present my experience easing and improving on several of these issues. I will include real-life examples and feedback from several companies where this has been put into action, including benefits (of course) and shortcomings (because there are always some). Last but not least, I will show how Rudder, an open source stack for automating configuration and auditing, can be used to acheive these goals.
The aim of this session is to discuss methods and the approach of automation applied to this field, while demonstrating and giving feedback on some of the possibilities offered by Rudder. I hope to avoid being side-tracked into talking about detailed security recommendations, sticking to simple best practices for the sake of examples, thus focusing on the approach.
Jonathan Clarke is the CTO of Normation, a software company he co-founded in Paris in 2009.
He has been working in IT infrastructure, almost exclusively with open source tools, since his beginnings as a system administrator. His work is now focused around automation for configuration and compliance, in particular Rudder (http://www.rudder-project.org). He is also a contributor to several open source projects including CFEngine, LSC and OpenLDAP. In his spare time, he enjoys good food, real ale, cinema and cycling around Paris.