Wow, what an amazing week! While it’s still fresh in my head, I thought I’d write about something that I witnessed at EMCworld. I’ll do another post on the sessions I gave later.
Automation and Security?
“Ok, what’s this “auto-mation” thing of which you speak Mike? And why, as a security guy, should I care?”
Razor
Well, the coolest thing was a project known as “Razor”. It was done by EMC’s Nick Weaver. Nick, also known as @lynxbat on Twitter, works in the EMC Office of the CTO. Nick is one of those guys that you show a new programming language to and after the weekend, he’s written something in it that blows your mind. All us geeks aspire to having those kinds of chops.
So, Nick worked with Puppet Labs on a project called Razor. The one sentence/paragraph description is “A tool that can, from bare metal, provision an OS” Honestly, that’s about the lamest description ever of what it can do! You NEED to read up on it here then come back to finish what I wrote… I’ll wait……
Ok, you’re back. Now why is this important to security? Well, Chuck Hollis (@chuckhollis), the EMC CTO of Marketing, hit the nail on the head in his blog on the Puppet and Razor stuff when he said
It doesn’t take to long to realize that there are some interesting areas where this could potentially go over time. Obviously, what’s been done for server resources could also be applied to storage and perhaps network. And, of course, EMC has some nice upper level IT governance management framework tools (e.g. Archer, Ionix) where policy can be specified and reported on.
Archer? RSA Archer? Yea, that Archer. Imagine if you will the ability to attest (there’s a big security word) to the validity of a server from the point of powering on to the system running and serving up what it serves up? You know how it was built, what was installed on it, who did what, when, where and how. Now, feed all that information into an eGRC solution like Archer and when the auditors come calling, you have a record and that record lines up with the security policies that are in effect. Need to build a server to handle PCI stuff? Here’s the record of how it was built and it’s mapped to all the PCI compliance regs. All in an automated fashion.
Combine that with a SIEM solution that can take in events that change the configuration and now you’re cooking with gas. You can attest to every change from creation to destruction. And map it all to policy.
It was a VERY insightful post Chuck made. When I saw Razor in action, that’s exactly what I thought. I ran into Chuck one evening at EMCworld and told him so.
Security at Scale
THIS is part of the “security at scale” issue that we as an industry are facing. The old ways of managing security just won’t scale to the levels of “cloud” (there I go, saying that word. For me, cloud = scale. ‘nuff said) You NEED to leverage automation. There’s just too many moving parts to keep track of manually. (more on that one in a later post!)
So for you IT guys who are wondering about security in a virtual environment, run over and start playing with Razor (did I mention it’s Open Sourced??????!!!!) and think about how you can help the security guy by giving him measurable results in a consistent fashion.
For you security folks, guess what, it’s time you look at all the cool tools that are available to the IT folks that can help you measure compliance. The depth of these tools is amazing. And the ability to pump it all into Archer to map it to the compliance policies makes your job infinitely easier.
I’m heading into Boston in a couple of weeks to learn more about Puppet and about Razor. Hopefully I’ll have more to talk about then!
Let me know what you think!
thanks for reading,
mike