AutomatingSecurity

Let the pipeline do the checking, so people can do the thinking.

Blocked Commit Scan Build Deploy Blocked Commit Scan Build Deploy

Two words,one idea.

Security

Keeping systems, data, and access away from the wrong hands.

Automating

Teaching a machine to do the repeatable work, the same way, every time.

Automating security

Writing the checks as code, so they run on every change without anyone having to remember.

Hi, I'mEbrahim.

  • DevSecOps Engineer at Skill Rank.
  • B.E. Computer Science and Engineering, Francis Xavier Engineering College, class of 2024.
  • Day to day: PCI DSS compliance, least-privilege IAM, Terraform, CI/CD pipelines, and cloud security on AWS.
AWS Certified Solutions Architect, AssociateSAA-C03
Red Hat Certified EngineerRHCE
Red Hat Certified System AdministratorRHCSA
Red Hat Certified Specialist in Containers

How manyDevOps rolescan you name?

Think cloud operations, SRE, DevSecOps, and beyond. Count quietly, then raise your hand when I call your number.

1 to 2
3 to 4
5 to 6
7 or more

ThreeFiveNine roles,one big family.

DevOps Engineer

Connects development and operations, and builds the delivery pipeline.

Cloud Operations

Runs and monitors cloud infrastructure day to day.

Site Reliability Engineer

Uses software engineering to keep services reliable.

Where I work

DevSecOps Engineer

Builds security into every step of delivery.

Platform Engineer

Builds the internal tools other engineers deploy with.

Release Engineer

Owns how and when code reaches production.

Cloud Security Engineer

Protects cloud accounts, identities, and data.

FinOps Practitioner

Keeps cloud spending visible and under control.

MLOps Engineer

Ships and monitors machine-learning models.

A day inDevSecOps.

Open

Open the security dashboard. The latest alerts are waiting.

Read

Go through the reports: sign-ins, access changes, blocked traffic.

Spot

Look for anything abnormal: a spike, a new location, a rule that changed.

Report

Tell my colleagues what I found and what needs a fix.

That is not all I do.

What is networksegmentation?

Every client network connects to our central VPC through a Transit Gateway. Segmentation means no client can reach another client's resources.

A, B, and C are client networks. It also shrinks what an audit has to cover, for example under PCI DSS.

Central VPC Central VPC A B C A B C Blocked TGW TGW Without segmentation With segmentation

How isolationis kept in place.

Transit Gateway

The hub every client network attaches to.

Separate route tables

Each client attachment gets its own.

Only shared routes

A client can route to the central VPC, never to another client.

Terraform

Writes the attachments and route tables as code.

What we verify

✓Every client attachment has its own route table.
✓No client route table contains another client's address range.
✓Each client can reach the central VPC, and nothing else.
✓A test from one client network to another is blocked.

40+ clients.Same rules.Every change.

Every client is another attachment and another route table. One wrong association or route, and a client can reach its neighbours. Checking by hand means reading 40+ route tables, again and again, while changes keep arriving.

Isolated Leaking, nobody noticed

How Iautomated it.

Trigger

A schedule, or any change to the Transit Gateway code, starts the job.

Collect

Read every attachment, route table, association, and route from AWS.

Map

Work out which address range belongs to which client.

Check

Confirm no client route table can reach another client.

Report

One report for all 40+ clients. Any leak alerts the team.

Same steps for every client. Nobody opens a console.

Rules written once.Run for every client.

  • One rule: no client may reach another client's network.
  • The same check for all 40+ clients.
  • Add a new client and it is checked automatically.
  • Improve a rule once and every client benefits.

Put yourselfin an awkwardposition.

Pick the task you don't know how to do yet. That is where you learn the most, and where the creative side of infrastructure work shows up.

Comfort zone Stretch Awkward where you learn

My awkwardpositionright now.

A secrets manager, OpenBao, running on free tiers only. It has to cost nothing.

The catch: after every restart, OpenBao wakes up sealed. A sealed vault hands out nothing.

Render, free web service

Runs OpenBao
  • Sleeps after 15 minutes without traffic
  • 750 free hours a month
  • Can restart at any time
  • Files don't survive a restart
stores its data in

Neon, free Postgres

Stores everything
  • Pauses after 5 minutes idle
  • 0.5 GB of storage
  • 100 compute hours a month

How I planto solve it.

Keep state in Neon

All data lives in Postgres, so a Render restart loses nothing. Secrets are tiny, so 0.5 GB goes a long way.

Let Neon sleep

Neon can suspend compute after inactivity and resume when accessed. The first request may wait for it to wake.

Handle cold starts

The first request after inactivity may be slower while Neon resumes. Clients should tolerate the delay or retry with backoff.

Protect the keys

Keep a safe copy of the seal and recovery keys, and back up the database on a schedule. Lose the keys and the secrets are gone.

Awkward, yes. But I will remember every one of these decisions for years.

xkcd comic 221: a programmer returns 4 as a random number, claiming it was chosen by a fair dice roll and is guaranteed to be random.
xkcd #221 by Randall Munroe
Meme titled The internet this week, listing critical security problems: a PHP remote code execution flaw with a possibly incomplete patch, urgent Node.js patches, a GitLab CVSS 10.0 unauthenticated RCE, malware shipped in a LiteLLM release, leaked API keys from OpenCode Console, and a certificate authority private key that was literally 4. Below it, SpongeBob in an armchair captioned Ight imma head out.

Thank you.Questions?

Automating security starts with one awkward first step.

Ebrahim Sickkander Nihal, DevSecOps Engineer

1 / 17
Arrow keys or swipe