►
Description
Don’t miss out! Join us at our upcoming hybrid event: KubeCon + CloudNativeCon North America 2022 from October 24-28 in Detroit (and online!). Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Fun with Continuous Compliance - Ann Wallace, Shopify & Zeal Somani, Google
Is it possible to make compliance fun and less stressful? The old way of doing things is to manually gather evidence once or twice a year and hope nothing bad is found during your audit. This is not fun. In this talk, we’ll go over the concepts of continuous compliance and how to apply this to your current DevSecOps program. Zeal will talk about how the Open Security Controls Assessment Language (OSCAL) can be used to create automated control based assessments. Lastly, Ann will walk through how Shopify uses OSS like Falco and Voucher to achieve continuous compliance at scale. You will walk away from this session with information on how you can make compliance fun or at least less painful.
A
A
And
then
I
will
talk
a
little
bit
about
how
we're
dealing
with
this
at
shopify
and
then
zeo
will
finish
up
with
oscal
and
a
little
bit
more
on
how
you
can
use
that
for
continuous
compliance,
so
this
photo
was
actually
taken
over
two
years
ago.
This
was
actually
the
last
time
zeal
and
I
saw
each
other
in
person.
We
were
speaking
at
a
conference
in
london,
so
hopefully
we'll
get
this
updated
with
pictures
from
here.
So
I
am
I'm
ann
wallace.
A
B
A
So,
let's
look
at
each
type
of
fund,
so
type
one
fun
is
simply
having
fun
so
good
fun.
This
is
like
hanging
out
with
friends
going
to
cubecon
drinking
sangrias
type.
2
fun
is
miserable
why
it's
happening
but
fun
in
retrospect,
so
this
type
of
fun
usually
begins
with
the
best
intentions,
but
things
get
carried
away,
so
this
might
be
like
friday
deployments
or
you
know,
doing
crazy.
Ultra
marathons
type
3
fun
is
just
miserable
when
it's
happening,
it's
not
even
fun.
In
retrospect,
this
is
something
like
you
think
what
the
hell
was.
A
A
Somebody
told
me
that
compliance
isn't
fun,
and
that
might
be
true
if
your
idea
of
compliance
is
manually,
gathering,
evidence,
yearly
and
hoping
nothing
bad
is
found.
This
is
definitely
not
fun,
but
if
you
think
of
compliance
as
a
set
of
requirements
that
you
as
a
developer,
a
security
engineer
and
it's
your
job
to
figure
out
how
to
meet
these
requirements
as
you
would
with
like
any
other
software
engineering
problem,
then
compliance
can
be
fun
in
this
presentation.
A
We
want
to
introduce
you
to
do
some
new
concepts
and
ways
of
thinking
and
looking
at
compliance
to
make
it
less
burdensome
and,
dare
I
say
fun,
I
do
need
to
make
a
confession.
I
run
ultra
marathon
so
like
100,
kilometers
or
longer
for
fun,
so
I
kind
of
have
a
warped
idea
of
what
fun
is:
there's
a
lot
of
type
2
fun
in
my
life.
So
maybe
this
is
why
I
enjoy
compliance.
I
don't
know
so.
I'm
going
to
hand
this
over
to
zeel
and
she's
going
to
get
into
the.
B
Okay,
so
let's
look
at
some
of
the
macro
indicators
in
the
industry
when
it
comes
to
compliance
and
the
future,
we
are
headed
towards
an
automated
compliance
future.
There
are
several
indicators
in
the
industry
that
point
towards
this.
We
see
that
security,
inclusive
of
risk
and
compliance
is
modernizing
itself
to
keep
up
with
the
modernization
with
the
overall
I.t.
B
So
a
couple
of
observations
on
the
left-hand
side
is
an
excerpt
from
an
article
that
mckenzie
came
out
in
summer
of
last
year,
where
cisos
from
all
major
cloud
providers,
including
phil
venables
from
our
side
at
google,
opined
on
using
or
leveraging
automation
and
code
to
express
security
requirements,
compliance
requirements
earlier
inside
your
development
life
cycle
and
then
number
two
on
the
right
hand
side
is
in
is
something
that
regulatory
body
nist
is
working
to
to
bring
this
to
fruition.
So
nist,
in
conjunction
with
industry,
peers
like
us
is,
has
developed.
B
Oscal
oscal
stands
for
open
security
controls
assessment
language,
so
what
askal
is
oscal
is
a
set
of
format
expressed
in
machine
readable
in
in
a
machine,
readable
format
like
xml,
json
and
yaml
that
allows
for
exchange
of
evidence
data.
So
these
formats
provide
machine,
readable
files
where
your
controls
are
your
controls
and
control
requirements.
B
So
when
it
comes
to
security
and
compliance,
there
is
a
thai
kotomi.
There
is
a
wishes
cycle
of
rework
caused
by
misalignment
amongst
teams
involved
in
demonstrating
compliance
requirements.
This
is
not
new
to
us.
Developers
are
often
left
to
interpret
arcane
compliance
requirements
that
don't
always
become
are
not
relevant
to
cloud
configurations.
B
The
security
op,
the
the
secops
teams.
They
work
with
many
tools
that
makes
that
you
know,
creates
a
lot
of
noise,
a
lot
of
fatigue,
making
it
difficult
to
evaluate
the
the
right
compliance
implication
of
an
alert
and
then
compliance
analysts.
They
tend
to
work
in
a
silo,
and
you
know
the
environment
is
getting
more
and
more
decentralized,
so
evidence
collection
becomes
cumbersome
or
becomes
hard.
B
So
with
that,
as
a
background,
this
is
why
compliance
is
scored
or
continuous
compliance
is
is,
is
relevant.
Continuous
compliance
is
about
having
a
right
balance
of
preventative
controls,
which
are
green
with
remedial
controls
when
detections
arise
from
your
from
your
from
your
cloud
environment,
there
are
obvious
benefits
or
merits
to
having
continuous
compliance,
but
what
I
really
want
to
emphasize
over
here
is
that
a
certification
or
an
audit
that
you
perform
yearly
is
not
sufficient
source
of
assurance
anymore.
Secondly,
going
through
a
point-in-time
audit
is
is
costly.
B
It
is
cumbersome,
it
taxes,
your
resources,
so
it's
time
to
move
from
point
in
time,
evidence,
collection
or
point-in-time
compliance
to
continuous
compliance,
and
obviously
you
know
this
change
requires
a
lot
of
cultural
change
that
needs
to
happen
within
an
organization
moving
on
with
you
know,
with
all
this
as
a
backdrop,
we
launched
risk
in
compliance
as
code,
our
our
solution
on
google
cloud.
I
can
speak
about
it.
A
Cool,
yes,
so
shopify
and
continuous
compliance
all
right.
So
if
you
don't
know
who
shopify
is
it's
very
likely
that
you
have
bought
or
purchased
something
from
one
of
the
millions
of
merchants
who
use
our
platform
so
we're
making
commerce
better
for
everyone?
We
offer
a
platform
so
folks,
small
medium
large
businesses
can
build
their
ecommerce
platform.
A
We
do
payments
and
you
know
everything's
done
in
a
compliant
secure
way.
So
those
are
some
big
numbers
on
the
last
slide
and
enable
to
support
that
amount
of
merchants.
These
are
some
of
the
statistics,
so
lots
of
gke
clusters
tons
and
thousands
of
kubernetes
services-
and
you
know
even
more
builds
a
month
and
gcp
projects,
and
this
is
a
couple
months
old.
A
So
this
is
probably
even
much
larger
now,
so
anyone
who's
a
part
of
a
compliance
team
or
audit
team
might
see
these
numbers,
and
you
know
that's
when
panic
might
set
in
so
just
a
level
set
on
the
compliance
programs
that
we
have
at
shopify,
so
pci
sarbanes-oxley,
soc2
and
swift,
just
one
more
slide
on
numbers.
So
and
again
you
can
imagine
managing
the
security
for
this
amount
of
containers.
Could
become
an
issue
and
then
thinking
about
compliance
as
well.
A
This
is
really
starting
to
sound
like
type
3
fun,
just
not
fun
at
all.
So
let's
look
at
how
we
build
these
containers,
so
these
on
this
particular
build
slide.
You
know
there's
some
specific
shopify
tools
in
lingo
in
here,
but
this
support
or
this
type
of
deployment
pipeline
is
probably
familiar
to
a
lot
of
folks,
and
this
is
I
what
I
would
call
type
one
fun.
So
it's
a
built
out
functioning
pipeline.
So
you
push
your
code,
all
the
checks
happen
and
boom
you're
in
production.
That's
fine!
A
A
Secondly,
build
kite,
so
this
is
our
container
builder.
Build
kite
is
used
to
create
docker
containers.
To
encapsulate
encapsulate
the
new
application
code
when
the
build
completes
successfully
build
kite
will
then
push
that
to
google
container
registry
or
gcr,
and
then
the
build
metadata
is
stored
in
container
analysis
or
the
open
source
version
of
that
is
graphas
and
then
voucher
scans.
The
images
in
the
registry
and
signs
those
images
if
they
meet
the
specific
voucher
policies
and
I'll
get
into
that
in
the
next
slide.
A
A
These
signatures
are
also
known
as
attestations,
so
we
use
vouchers
diy
check
so
which
is
used
to
ensure
that
only
images
built
by
shopify's
infrastructure
and
approved
third-party
images
can
be
run
in
our
clusters.
So
now,
let's
look
at
some
compliance
controls
and
see
how
we
can
leverage
our
current
security
tooling
to
meet
compliance
requirements.
A
A
A
How
do
we
make?
How
do
we
meet
this
compliance
control
so
again,
we're
kind
of
looking
what
comes
out
of
the
box
of
voucher?
We
have
the
snake
oil
check
so
which
voucher
can
make
sure
images
are
free
of
known
security
vulnerabilities
so
to
implement
this
in
our
current
environment.
What
we
need
to
do
is
edit
the
the
voucher
config
file
first
here
we
are
enabling
that
it
would
fail
on
anything
that
comes
back
with
a
high
ranking
and
then
we're
enabling
snake
oil
here
and
then.
A
Thirdly,
we
are
configuring,
the
keys,
in
this
case
it's
kms
that
will
sign
the
attestations
and
then
for
binary
authorization
or
credes.
We
create
a
policy
that
requires
the
testers
to
sign
before
deployment.
So
to
go
into
this.
We
have
a
default
rule
that
has
evaluation
mode
of
require
attestation,
which
binary
authorization
to
allow
the
images
it
has
to
be
assigned,
or
it
has
to
be
authorized
by
the
sign
of
testers,
which
is
in
the
required
attestation
by
it's
sorry.
A
So
again.
We
we
have
this
flow
here
and
let's
see
how
this
works
with
the
snake
oil
policy.
So
first
a
vulnerability
scan
is
ran
when
a
new
image
is
put
into
the
in
the
registry.
The
results
of
these
scans
are
stored
as
metadata,
then
the
voucher
policy
checks
to
make
sure
there
are
no
high
vulnerabilities.
A
A
If
there
is
a
signed
attestation,
if
not
the
deployment
is
stopped
and
an
audit
log
is
written,
see
again,
I
have
a
warp
sense
of
what's
fun,
but
I
we're
taking
something
we're
already
doing
and
just
with
a
couple
lines
of
code
we're
starting
to
meet
compliance
requirements,
and
not
only
did
we
did
that
we
did
it
with
little
effort
and
the
vulnerability
scanning
continually
happens.
So
anything
bad
is
found
in
logs
and
auditors
really
love
to
see
this,
especially
the
audit
logs
of
things
getting
blocked
all
right.
A
A
So
again
we
have
stuff
out
of
the
box
or
voucher
one
of
the
ways
that
we
can
satisfy
this
particular
control
is
making
sure
things
come
from
known
sources
and
are
built
by
trusted
sources
or
your
team.
So
luckily
voucher
has
checks
for
this
diy
in
providence.
So
this
is
really
a
two
for
one
so
again
similar
to
what
we
did
for
snake
oil.
The
diy
checks
here
are
in
green.
We
need
to
enable
them
and
then
the
valid
repo
option
and
the
configuration
is
used
to
limit
which
repositories
an
image
can
come
from.
A
The
option,
takes
a
list
of
repos
and
are
compared
against
the
repos
that
the
image
live
in.
If
the
image
the
image
will
pass
if
it
starts
with
any
of
these
items
and
then
the
providence
check,
which
is
in
blue,
works
by
attaining
a
build
from
the
build
information
from
the
metadata
and
the
image
from
from
graffias
and
then
verifying
that
both
come
from
a
trusted
project
and
is
built
by
a
trusted
builder.
A
So
in
this
example,
this
image
has
to
be
built
from
the
project,
compliance
images
and
either
built
by
anners
at
shopify
or
by
this
particular
service
account.
This
will
not
pass
if
it
doesn't
come
from
this
compliance
images
project,
regardless
of
who
built
it.
If
so
and
again,
just
like
snake
oil,
we
just
need
to
add
the
testers
to
binary
authorization.
A
A
In
this
case
we
want
to
make
sure
that
the
containers
are
being
run
by
a
unique
accounts
and
limited
and
not
as
root
so
yep.
We
have
a
check
for
that.
So
that's
the
nobody
check,
which
makes
sure
an
image
was
built
to
be
run
as
a
non-root
user
and
then
just
for
funsies.
Let's
do
one
more
so
this
is
a
sock
2
requirement
that
we
have.
That
makes
sure
that
ci
tests
are
run
to
cover
security
prior
to
deployments,
and
you
might
have
guessed
yes,
we
have
a
check
for
that.
It's
our
approved
check.
A
A
So,
let's
have
some
fun
together,
as
you've
noticed,
voucher
has
just
a
few
out
of
the
box
checks.
We
would
love
more,
so
please
contribute
to
making
compliance
more
fun
type
one
or
type
two
fun.
So
here
is
the
the
github
for
this.
So
now
I'm
going
to
hand
it
over
to
zeel
to
talk
about
oscar.
Yes,
thank.
B
You
so
you,
if
you
go
back
to
you,
know
the
the
talk
from
anne
and,
if
you
look
at
her
her
slides
most
of
the
evidence
that
was
collected
by
open
source
tool-
or
you
know,
if
you
most
of
the
evidence,
was
xml
or
yaml
based,
and
so
the
question
is:
can
we
take
this
and
convert
it
into
an
ascal
format
which
is
again
a
xml
or
yamo
based
and
you
know,
use
the
evidence
that
is
con?
That
is
collected
at
the
time
of
your
ci
cd
pipeline
and
use
it
to
push
it.
B
B
So
some
of
the
common
asks
from
our
customers
around
continuous
compliance
compliance
modernization,
you
know
as
they
as
they
transform
on
our
platform.
I'm
sure
you
know
everyone
would
recognize
this
there.
The
box
that
I
really
want
to
drive
your
attention
is
the
last
box
in
gray
how
to
decrease
compliance
paperwork.
B
Most
importantly,
you
know:
how
do
you
reduce
the
audit
fatigue?
How
do
you
generate
evidence
faster?
How
do
you
populate
certain
sections
of
an
audit
report
automatically
based
on
the
evidence
collected?
Is
there
a
way
where
you
can
exchange
data
with
your
grc
tools,
based
on
the
evidence
that
is
generated
inside
your
ci
cd
pipeline,
and
so
this
is
the
the
last
block
is
where
oscar
or
the
goal
of
oscar
is
to
help
out.
So
what
is
oscal
offscale
is
a
format,
as
I
mentioned
earlier.
B
B
B
Talk
to
you
know,
make
to
drive
awareness
about
oscar
and
you
know
have
have
people
contribute
to
it.
So
I
spoke
about
askal.
I
spoke
about
continuous
compliance
and
when
I
speak
to
customers,
the
natural
question
from
them
is
that
how
do
I
get
started?
What
sort
of
data
set
should
be
oscalized
or
you
know
what
should
be,
what
should
be
converted
into
an
oscal
format?
So
here's
a
reference
architecture
that
enables
you
to
develop
this
capability.
The
starting
point
of
this
architecture
is
a
directional
or
is
is
the
top
box.
B
The
directional
controls
are
directed
controls.
That
is
nothing
but
a
harmonized
controls,
library
and
the
control
requirements
can
come
from
a
number
of
sources.
You
know
your
threat,
landscape,
your
internal
governance
requirements,
your
internal
security
policies
and
procedures,
the
compliance
requirements
that
you
have
to
meet
externally.
So
when
you
harmonize
controls
across
these
different
areas,
you
get
to
a
technical
control
library,
which
is
the
red
box
in
between,
and
that
becomes
an
input
and
a
guide
guiding
principle
for
your
preventative
controls.
B
B
Now,
how
would
this
technical
control
library
work
with
engineers?
So,
let's
take
a
look
at
you
know.
Let's
look
at.
Let's
take
a
look
at
the
path
so
for
every
directive
control
in
your
control
library,
you
would
have
a
corresponding
preventative
control
and
to
stop
non-compliant
resources
from
getting
in
getting
into
your
environment.
Next,
you
have
detections
to
look
over
the
environment
to
constantly
scan
for
non-compliant
resources
and
then,
finally,
you
have
certain
responsive
controls
where
applicable,
so
you
know
bring
the
to.
B
You
know,
bring
the
drift
back
to
their
original
state,
so
every
policy
evil
evaluation
should
have
a
feedback
loop
with
to
the
engineers
you
know
to
their
to
the
people
who
write
the
code,
who
write
applications,
a
prompt
and
a
meaningful
feedback.
Loop
like
this
would
provide
better
engineering
experience
and
would
drive
down
the
velocity
or
sorry
would
increase
the
the
velocity
of
your
applications.
You'll
be
writing
faster
code
you'll,
be
shipping
faster
code
and
securely
sir,
and
talked
about
the
ci
cd
pipeline
and
devops
tooling
at
shopify.
This
is
something
similar.
B
And
with
that
I
wanted
to
drive
this
call
to
action
if
you
are
interested
in
contributing
more
to
oscar.
If
you
are
interested
in
you
know,
building
that
control
library.
There
is
a
kubernetes
policy
working
group
that
is
doing
that
has
started
mapping
out
technical.
You
know
technical
controls
from
853
that
library
can
guide
your
closed
loop
of
preventative
and
detective
controls
so
feel
free
to
you
know
catch
with
me.
A
C
D
A
A
E
E
E
B
To
auditors,
yeah
yeah,
so
coming
from
an
audit
background,
service
accounts
or
robo
accounts,
or
you
know
automatic
accounts,
you
would
have
to
spend
some
time.
You
know
explaining
them
how
they
get
created,
and
you
know
how
you're
restricting
them
once
they
have
an
idea
about
what
restrictions
you
have
around
service
accounts.
You
should
be
able
to
demonstrate
your
flow
of
one.
It
is,
you
know
you
have
the
you're
following
up
the
the
least
privilege
and
then
whatever
attestations
your
service
account
is,
is
signing.
A
C
A
A
F
Thanks
for
talking
a
question
for
ann
around
the
snake
oil
flow,
I
can
see
the
stuff
you're
doing
and
how
it
successfully
comply
well
ensures
compliance
for
new
images
going
into
the
into
the
environment.
I
was
wondering
if
what
your
flow
looks
like
for,
detecting
and
automatically
responding
to
if
vulnerability
gets
discovered.
The
next
day,
which
affects
the
same
image
in
particular,
I'd
be
interested
to
know
what
the
automatic
response
looks
like
because
pulling
it
obviously
isn't
isn't
going
to
be.
It
could
affect
your
service.
F
C
A
That's
that's
a
good
question,
so
images
that
are
currently
deployed
so
container
registry.
So
anything
that's
in
the
google
container
registry
are
continually
scanned
so
that
can
leverage
things
that
are.
You
know
if
they're
currently
deployed.
So
you
can
kind
of
map
that
to
one
to
another,
but
I
don't
yeah.
I
don't
have
a
good
answer
for
you.
I
can
follow
up
on
slack
on
how
we're
actually
doing
that.
C
Good
enough
all
right-
and
there
is
another
question
online
and
I'll
make
my
way
over
here.
The
one
online
is
very,
very
quick.
I
believe
it's
for
the
googler
on
the
stage,
which
is
why
do
you
use
pirates
as
the
persona
for
devs,
which
I
have
my
own
take
on?
Why
do
you
use
pirates
as
the
persona
for
devs.
C
A
C
A
G
Thank
you
very
much
for
the
talk
also
not
used
into
dci
and
fun
being
together,
so
your
advice
for
a
new
company
that
might
want
to
go
through
the
process
of
compliance,
because
I
know
that
the
pci
dss
is
not
exactly
up
to
date
with
cloud
providers.
Sometimes
yes,
so
what
would
you
I
advise
someone
that
maybe
wants
to
go
through
the
process
by
automating,
some
part
of
it,
but
maybe
not
being
prepared
for
questions
from
auditors?
That
might
not
understand
the
whole
concept
of
automation
in
compliance.
G
F
B
Awareness
and
education,
any
any
sort
of
new
change
will
drive.
You
wouldn't
need
to.
You
know,
drive
awareness
and
education
about
how
automation
actually
simplifies
and
makes
the
makes
the
code
more
secure
and
more
compliant.
Once
you
have
once
the
the
conversation
flips
in
that
direction.
Usually,
whoever
is
you
know
opposing
it
gets
on
board.
C
And
we're
a
couple
minutes
over,
but
I'll
ask
this
one
last
question
online
in
case
anyone
can
stick
around
for
it.
You're
welcome
to
go.
Of
course,
though.
The
continuous
compliancy
model
looks
really
great.
What
happens
when
deployments
do
not
meet
the
compliance
check,
but
you
do
need
to
fix
a
production
incident.
A
A
I
think
there's
always
exceptions
and
as
long
as
it's
documented
well
enough
and
why
that
happened,
and
then
you
know
you
go
back
and
fix
it,
so
it
does
meet
the
compliance
requirement.
You're,
probably
okay.
Hopefully
you
have
a
good
enough
relationship
with
your
auditor,
so
you
understand
what
their
tolerance
is
for
that
stuff.
But
yeah
I
mean
anything
you
just
like
document
the
hell
out
of
everything
when
it
comes
to
these
sort
of
things
I
mean
anyone.
Who's
dealt
with.
Auditors
know
that
I
mean
it's
it's.