Rootconf Pune edition

Rootconf Pune edition

On security, network engineering and distributed systems

Make a submission

Accepting submissions till 21 Aug 2019, 10:30 AM

St. Laurn Hotel, Pune

About Rootconf Pune:

Rootconf Pune is a conference for:

  1. DevOps engineers
  2. Site Reliability Engineers (SRE)
  3. Security and DevSecOps professionals
  4. Software engineers
  5. Network engineers

The Pune edition will cover talks on:

  1. InfoSec and application security for DevOps programmers
  2. DNS and TLS 1.3
  3. SRE and distributed systems
  4. Containers and scaling

Speakers from Flipkart, Hotstar, Red Hat, Trusting Social, Appsecco, InfraCloud Technologies, among others, will share case studies from their experiences of building security, SRE and Devops in their organizations.

Workshops:

Two workshops will be held before and after Rootconf Pune:

  1. Full-day Prometheus training workshop on 20 September, conducted by Goutham V, contributor to Prometheus and developer at Grafana Labs. Details about the workshop are available here: https://hasgeek.com/rootconf/2019-prometheus-training-pune/
  2. Full-day DNS deep dive workshop on 22 September by Ashwin Murali: https://hasgeek.com/rootconf/2019-dns-deep-dive-workshop-pune/

Event venue:

Rootconf Pune will be held on 21 September at St. Laurn Hotel, Koregaon Park, Pune-411001.

Sponsors:

Click here to view the Sponsorship Deck.
Email sales@hasgeek.com for bulk ticket purchases, and sponsoring the above Rootconf Series.


Rootconf Pune 2019 sponsors:


Platinum Sponsor

CloudCover

Bronze Sponsors

upcloud SumoLogic TrustingSocial

Community Partner

Shreshta IT Hotstar

To know more about Rootconf, check out the following resources:

  1. hasgeek.com/rootconf
  2. hasgeek.com/rootconf/2019
  3. https://hasgeek.tv/rootconf/2019

For information about the event, tickets (bulk discounts automatically apply on 5+ and 10+ tickets) and speaking, call Rootconf on 7676332020 or write to info@hasgeek.com

Hosted by

Rootconf is a forum for discussions about DevOps, infrastructure management, IT operations, systems engineering, SRE and security (from infrastructure defence perspective). more

Abhisek Datta

@abhisek

Application Security Workflow Automation using Docker and Kubernetes

Submitted Apr 5, 2019

We are in an age when there are just too many attacker tools, techniques and procedures (TTP). It is pointless to build automation that follow a fixed workflow — a fixed way or order of doing things, which may work for one but will not fit into the requirement of others.

This talk is about building security workflow automation in a distributed environment using free security tools, packaged as Docker containers and running on Kubernetes as the underlying platform for enabling the automation.

The key takeways for the talk are

  1. Creating a security workflow using 3rd party security tools
  2. Packaging 3rd party tools as Docker containers
  3. Connecting various tools through messaging service and object storage
  4. Running all of these in a Kubernetes cluster
  5. Challenges and constraints involved in such systems

The intended audience for this talk are

  1. Information security engineers looking to automate workflows
  2. DevOps engineers looking to build security scanning in their pipeline
  3. System Architects building security platforms
  4. Anyone who thinks repeatative tasks are boring and should be done by machines :)

Outline

  • An Application Security Workflow - How does it look like
  • Mapping an app sec workflow to 3rd party free security tools
  • Designing a Distributed System using Kubernetes to execute app sec workflows
    • Architecture diagram
    • High level overview of various components involved in the system
    • Producing and consuming events to drive the workflow
    • Adapter pattern for tool integration
  • Packaging 3rd party free security tools as docker containers
  • Deploying in Kubernetes
  • Demo

Requirements

  • Internet for demo

Speaker bio

An accomplished security professional with over a decade of experience in information security solution engineering, services, vulnerability research, reverse engineering and security tools development.

Experienced in security solution development using Cloud Native and Kubernetes Native technologies. Developed tools and technology to find vulnerabilities in web applications, network servers, client-side applications. Conducted product security audit of enterprise applications and credited with vulnerability discovery (CVE) for the same.

Credited with multiple vulnerability discovery across enterprise products with CVEs to his name such as CVE-2015-0085, CVE-2015-1650, CVE-2015-1682, CVE-2015-2376, CVE-2015-2555, CVE-2014-4117, CVE-2014-6113.

An active participant of NULL – India’s largest open security community as a core team member responsible for technology development.

As an open source software contributor, he has developed or contributed to multiple projects including:

  • Wireplay
  • Penovox
  • HiDump
  • RbWinDBG

He can be reached through:

Links

Slides

https://speakerdeck.com/abhisek/application-security-workflow-automation-using-docker-and-kubernetes

Comments

{{ gettext('Login to leave a comment') }}

{{ gettext('Post a comment…') }}
{{ gettext('New comment') }}
{{ formTitle }}

{{ errorMsg }}

{{ gettext('No comments posted yet') }}

Make a submission

Accepting submissions till 21 Aug 2019, 10:30 AM

St. Laurn Hotel, Pune

Hosted by

Rootconf is a forum for discussions about DevOps, infrastructure management, IT operations, systems engineering, SRE and security (from infrastructure defence perspective). more