WinOps in a Secure Environment
0 likes186 views
Dwight Bragdon, IT Security Engineer at Qualcomm: Do you work in a non-internet connected environment? Are your computers and users locked down using government security standards? See how our division in Qualcomm use WinOps to provide local admin and internet connected behaviors without either, using Chocolatey and Puppet.”
Ad
More Related Content
Similar to WinOps in a Secure Environment (20)
More from Chocolatey Software (13)
Ad
Recently uploaded (20)
Ad
WinOps in a Secure Environment
- 1. A sweet Conference focused on Windows Automation (WinOps)
- 2. WinOps in a Secure Environment Dwight Bragdon, IT Sec Engr, Sr Staff Qualcomm
- 3. Before we begin… ● Who am I? ○ Dwight Bragdon – IT Security Engineer, Sr. Staff ● What do I do? ○ Microsoft Stack, VMware, Citrix, Nutanix, etc… ● Why should you listen to me? ○ Great question!
- 4. Environment Overview • Network 1 “non-secure” • Internet Connected • Users are local admins • Corporate Business Productivity • “Wild West” • Network 2 “Secure Enclave” • Non-Internet Connected • Users are not local admins • Business/Mission Productivity • Windows Security Baselins/STIGs applied. • Carbon Black High Enforcement
- 5. Solutions Chocolatey for Business (C4B) Gerrit ● Honorable Mentions: ○ SCCM ○ GPO ○ Task Scheduler
- 6. Workflow Overview Gerrit List of packages to internalize Choco- Internalize PowerShell Script Jenkins Merged changes start internalization job. Internalization job also run on a schedule. (C4B) FileShare Pushes Internalized packages to file share after internalization job runs Jenkins Artifactory Custom Package Puppet Puppet Enforced settings Choco Packages AdHoc Chocolatey Packages Self-Service/Background Service (C4B) Pulls Internalized packages brought in from the outside , pushes packages to Artifactory Package Builder (C4B) FileShare Internet Connected Non-Internet/Secure Enclave
- 7. Gerrit/Source Control Choco-Internlize.ps1 foreach ($package in get-content choco-pkg-list.txt) { Write-Output "Internalizing $package" Write-Output "------------------------------------------------------------------------" C:ProgramDatachocolateybinchoco.exe download --internalize locale=en-US $package --no-progress Write-Output "------------------------------------------------------------------------" Write-Output "" } choco-pkg-list.txt chocolatey chocolatey-agent chocolatey-core.extension chocolateygui firefox googlechrome pester winscp etc… Gerrit List of packages to internalize Choco- Internalize PowerShell Script
- 8. Workflow Overview Gerrit List of packages to internalize Choco- Internalize PowerShell Script Jenkins Merged changes start internalization job. Internalization job also run on a schedule. (C4B) FileShare Pushes Internalized packages to file share after internalization job runs Jenkins Artifactory Custom Package Puppet Puppet Enforced settings Choco Packages AdHoc Chocolatey Packages Self-Service/Background Service (C4B) Pulls Internalized packages brought in from the outside , pushes packages to Artifactory Package Builder (C4B) FileShare Internet Connected Non-Internet/Secure Enclave
- 9. (external) ● Build Periodically – Daily, Weekly ● Build on Trigger – Gerrit Change Merged ● Build Step: ○ Run PowerShell command ○ Uploads choco packages to file share Gerrit Jenkins FileShare
- 10. Workflow Overview Gerrit List of packages to internalize Choco- Internalize PowerShell Script Jenkins Merged changes start internalization job. Internalization job also run on a schedule. (C4B) FileShare Pushes Internalized packages to file share after internalization job runs Jenkins Artifactory Custom Package Puppet Puppet Enforced settings Choco Packages AdHoc Chocolatey Packages Self-Service/Background Service (C4B) Pulls Internalized packages brought in from the outside , pushes packages to Artifactory Package Builder (C4B) FileShare Internet Connected Non-Internet/Secure Enclave
- 11. Package Transfer FileShare FileShare ● Transfer files from external file share to non-internet connected file share ● Can be automated: ○ One-way snapmirror (Netapp) ○ Secure one-way transfers using data diodes ○ Other ● Can be manual ○ Sneakernet
- 12. Workflow Overview Gerrit List of packages to internalize Choco- Internalize PowerShell Script Jenkins Merged changes start internalization job. Internalization job also run on a schedule. (C4B) FileShare Pushes Internalized packages to file share after internalization job runs Jenkins Artifactory Custom Package Puppet Puppet Enforced settings Choco Packages AdHoc Chocolatey Packages Self-Service/Background Service (C4B) Pulls Internalized packages brought in from the outside , pushes packages to Artifactory Package Builder (C4B) FileShare Internet Connected Non-Internet/Secure Enclave
- 13. (internal) ● Build Periodically – Daily, Weekly ● Build Step: ○ Upload choco packages from file share to Artifactory Jenkins Artifactory FileShare
- 14. Workflow Overview Gerrit List of packages to internalize Choco- Internalize PowerShell Script Jenkins Merged changes start internalization job. Internalization job also run on a schedule. (C4B) FileShare Pushes Internalized packages to file share after internalization job runs Jenkins Artifactory Custom Package Puppet Puppet Enforced settings Choco Packages AdHoc Chocolatey Packages Self-Service/Background Service (C4B) Pulls Internalized packages brought in from the outside , pushes packages to Artifactory Package Builder (C4B) FileShare Internet Connected Non-Internet/Secure Enclave
- 15. browsers.pp class profile::browsers { require profile::chocolatey # Ensures latest Firefox package { 'firefox': ensure => latest, } # Ensures latest Google Chrome package { 'googlechrome': ensure => latest, } } workstation.pp class role::workstation { include profile::browsers } Artifactory Puppet Puppet Enforced settings Choco Packages
- 16. Ad Hoc installs prereq ● Chocolatey Agent ● Background Service ○ Use Puppet!
- 17. Ad Hoc installs ● “Self-Service” choco installs ○ Chocolatey GUI ○ Command Line ○ Carbon Black approved!
- 18. Workflow Overview Gerrit List of packages to internalize Choco- Internalize PowerShell Script Jenkins Merged changes start internalization job. Internalization job also run on a schedule. (C4B) FileShare Pushes Internalized packages to file share after internalization job runs Jenkins Artifactory Custom Package Puppet Puppet Enforced settings Choco Packages AdHoc Chocolatey Packages Self-Service/Background Service (C4B) Pulls Internalized packages brought in from the outside , pushes packages to Artifactory Package Builder (C4B) FileShare Internet Connected Non-Internet/Secure Enclave
- 19. Custom Packages ● Custom packages ○ Custom application ○ Different install arguments ● Use Package Builder (C4B) ○ Command Line ○ GUI ● Non-Admins can create packages ○ C:ProgramdataChocolateytemplatesNewFileInstaller needs to be present Artifactory Custom Package
- 20. Workflow Overview Gerrit List of packages to internalize Choco- Internalize PowerShell Script Jenkins Merged changes start internalization job. Internalization job also run on a schedule. (C4B) FileShare Pushes Internalized packages to file share after internalization job runs Jenkins Artifactory Custom Package Puppet Puppet Enforced settings Choco Packages AdHoc Chocolatey Packages Self-Service/Background Service (C4B) Pulls Internalized packages brought in from the outside , pushes packages to Artifactory Package Builder (C4B) FileShare Internet Connected Non-Internet/Secure Enclave
- 21. Updates ● Puppet: ○ Ensure => latest ● Ad Hoc installs: ○ “cup all –y” scheduled task created via GPO or Puppet
- 22. Limitations ● If enforcing background service ○ Users and Puppet cannot call a custom source ● Ad-Hoc Installs: ○ Pinning versions ○ Uninstalling
- 23. Key Takeaways ● Use WinOps to enable everyone ● C4B enables users - without sacrificing security
- 24. Questions???