Deploying Cisco Secure Cloud Native Security using GitOps

[vinagend]

DevOps practices and tools help increase an organization’s ability to deliver reliable applications and services at rapid speed, and scale while supplying built in security controls and compliance. This article explores “GitOps and Infrastructure as Code”.

GitOps is an operational framework that takes DevOps best practices used for application development such as version control, collaboration, compliance, and CI/CD tooling, and applies them to infrastructure automation.

Let’s say you are going to deploy an application on AWS using services like a couple of EC2 instances and a VPC with public subnet. First EC2 instance will be like an Edge firewall and then will have some EKS worker nodes where micro services like Kubernetes can be setup. you will be using Jenkins and GitHub as the pipeline tools. Then, for most of the infrastructure as code application, we will be using Terraform which is super popular for config management. We’ll deploy the following application using the tools mentioned below:

• Security Analytics and Threat Detection
• Secure Cloud Analytics
• Secure Cloud Insights
• Workload Protection
• Secure Workload
• Cloud Native Application Protection
• Panoptica “The Secure Application Cloud”
• Application Security
• Secure Application (AppD)

For setting up the Development Environment what you need is a Source Code Repository with CI/CD Pipeline and Infrastructure as Code. The tools which we are going to use are mentioned below.

• Source Code Repository
• GitHub: Source Code Management and Version Control
• CI/CD Pipleline
• Jenkins Multibranch Pipeline Project
• •  Jenkins will automate and orchestrate the build and deployment of the environment
• Jenkinsfile (aka Pipeline as Code) – Select the Cloud Native Security Pipeline

This cloud Native Security is a multi-branch pipeline where all the branches are pulled in.

If we click on the Configure Button, we can see the GitHub repo URL.

If you scroll down can also see the interval which is been set to 1 minute duration.

• Infrastructure as Code
• Terraform Modules to provision infrastructure

Inside the infrastructure module you have a VPC, FTD, EKS and all these terraforms doing little things. The idea is to have the EC2 instance is install the image of terraform on it. Then link it to the subnet and VPC network we have.  That’s the Day-0 deployment.

Walking through the code can see the environmental setup.

If you navigate to main.tf file can see a bunch of modules. The idea is to pass all the variable into the module.

And you can see the provider details while scrolling down.

 

We also have a file “ftdv_ansible_deply.tf” which is going to check the firepower is talking to the management interface. If it’s a new deployment it will run all the initial stuffs.

• Ansible Playbooks and Docker Image to configure Policy

 If you navigate into Open Bule Ocean on Jenkins.

 A window as shown below will be opened

And once you click on Cloud Native Security, you can see a pipeline named as Infrastructure.

If you click and drill down into it, you can see a Build configuration where 48 resources are utilized to build the infrastructure.

As you got the infrastructure ready let’s see Security Analytics and Threat Detection.

Secure Cloud Insights gives us complete visibility into cloud security posture while continually monitoring, detecting policy violations and mapping relationships between all assets to understand the entire attack surface. What you are going to do is to:

• Deploy Cloud Native Application
• Deploy Cisco Secure Cloud Analytics
• Dive into visibility, threat detection and alerting

 Let’s dive into an already built Microservice Application named Yelb. Yelb allows users to vote on a set of alternatives (restaurants) and dynamically updates pie charts based on number of votes received.

You can deploy the application using the kubectl command

When you deploy an application then you need to consider the following:

• Identify all assets in cloud and on-prem
• Visibility into all flows and connections
• • Baseline normal activity
• Alert based of Anomalies
• Respond to threats quickly
• Deployed using Terraform

 You have all the tools that are needed for the above tasks installed on a Kubernetes cluster.

Here we are going for agentless which uses the service mesh. Similar to the deployment done for infrastructure we are going to do the same for Secure Cloud Analytics.

What you are doing here is you are using the Kubernetes provider and loading the modules mentioned below like Service Account, Cluster Role Binding, and Damen set which is going to install agent to the worker node.

 Once merging of the code is done you can see another pipeline named secure_cloud_analytics on Jenkins.

Once you click on the pipeline secure_cloud_analytics , the following page will be opened.

And once the terraform deployment is done, open the dashboard of the Secure Cloud Analytics.

It’s going to provide all the visibility needed as you scroll down the screen.

On scrolling down, select the Session Traffic

If will give the information of the cluster, as shown below.

 

Also, it provides alerts with some monitor tactics to analyze what happens based on the triggers that are being set.

If we click on Internal Connection Watchlist Hit, it will open up a window as shown below.

Once you have the visibility, the next agenda is you can load the workload protection using daemon set and provide Micro-segmentation between the pods for Microservice Applications. To achieve this, you are going to deploy policy as code which means Unified Policy across host, network and cloud.

AWS Connector consolidates: - VPC flow logs ingestion, Context gathering (AWS tags and labels), AWS cloud-managed Kubernetes orchestration (Kubernetes object labels and annotations), and Agentless Enforcement that Enforce segmentation using AWS Security Groups.

On Cisco Secure Workload Under Manage -> Agents we can see for EC2 instance on which an agent is deployed.

 

Also, if you click on connectors, you can see the options as shown below.

When you select AWS as the connector you pull in all VPC and EKS instance where all labels come from Kubernetes.

Your next step will be to find policies for those labels. But before that if you navigate to the code of Secure Workload module.

Navigate to the file secure_workload.tf under the secure_workload module

 

 You can see how policy as a code is going to work. Here everything in Cisco Secure Workload is a scope. For example, you can see how Yelb App Scope has been setup. Code is written as a simple query that whatever be the cluster name a label is going to be created for it.

The code will be having full Micro Segmentation in the cloud environment. Once the code is merged you will be able to see the pipeline on Jenkins.

Next you will be exploring the Kubernetes environment where you need to have the Cloud Native Application Protection by Securing Kubernetes, Containers, Pods and APIs. The steps followed to accomplish Cloud Native Application Protection are mentioned below.

• Deploy Panoptica
• Terraform – Istio Service Mesh and Secure App Cloud Controller

• CI/CD Plugins
• CI – Jenkins
• CD - Terraform
• Runtime Policies
• Deployment, Connection, Event, and API
• Risk Assessment
• K8Shield – Mapping to MITRE

 On code walkthrough you can find that first you have to deploy the cluster where the connection rules are coded.

If you navigate into Panoptica interface, you will see:

And navigate to Runtime so you can see the vulnerabilities related to the Yelb app by checking the Workloads, Connections, Events and Workspaces Menu.

Then under the Policies menu, you can see the rule which the Policy Adviser recommends.

Last but not the least, Deploy Cisco Secure Application (AppD) to secure applications at runtime:

Application Performance Monitor (APM) on Java Virtual Machine (JVM) 

• Security Visibility in Application Native Context
• • Full map of Application
• Vulnerability Assessment and Remediation
• • Vulnerable libraries and Remediation versions
• Policy rules to dynamically patch
• Attack Detection and Protection
• Attack types, Event triggers, Commands and Stack Traces

 Cisco Secure Application

If you think of security up the stack, Cisco has a cloud native platform with all the pieces in place and all you have to do is to bring it all together, with the features using the tools as mentioned below.

• Built cloud native infrastructure using GitOps
• DevOps tools – Jenkins, GitHub, Terraform, Ansible, Kubectl, AWS CLI
• Security Analytics and Threat Detection
• Cisco Secure Cloud Analytics – Visibility, detection and alerting
• Workload Protection
• Cisco Secure Workload – Micro-Segmentation and visibility
• Kubernetes and Container Security
• Cisco Secure Application Cloud – CI/CD integration, container and API policies
• Application Security
• Cisco Secure Application (AppD) – App visibility, vulnerabilities, attacks and events

 Resources

Github url :https://github.com/emcnicholas/BRKSEC-2353_Deploying_Cisco_Secure_Cloud_Native_Security_using_GitOps

• Cloud Native Security Blogs and Videos
• https://blogs.cisco.com/tag/cloud-native-security
• Secure Firewall AWS: https://aws.amazon.com/marketplace/pp/prodview-mpk3c2gkda3w4
• Cloud Analytics https://www.cisco.com/c/en/us/products/security/stealthwatch/stealthwatchcloud-free-offer.html
• Secure Workload Sandbox:https://devnetsandbox.cisco.com/RM/Diagram/Index/e95caf39-0b4a-45da-9305-49a65f8dce97?diagramType=Topology

• Panoptica: https://panoptica.app/
• Cisco AppDynamics: https://www.appdynamics.com/free-trial/