WEBVTT

00:00:00.640 --> 00:00:04.240
So let's talk about the NIST Cybersecurity Framework a little bit.

00:00:04.510 --> 00:00:07.710
One of the ways that Terrascan can help you implement this

00:00:07.710 --> 00:00:11.000
framework within your organization is it addresses a couple

00:00:11.000 --> 00:00:12.990
of the areas in this framework.

00:00:12.990 --> 00:00:13.750
For example,

00:00:14.140 --> 00:00:17.890
under the Identify framework there's a module called risk

00:00:17.890 --> 00:00:22.440
assessment. And Terrascan can help you meet this goal,

00:00:22.440 --> 00:00:24.420
specifically these two points here,

00:00:24.420 --> 00:00:28.640
the ID.RA‑1: Asset vulnerabilities are identified and

00:00:28.640 --> 00:00:32.890
documented, and the ID.RA‑5: Threats, vulnerabilities,

00:00:32.890 --> 00:00:35.520
likelihoods, and impacts are used to determine risk.

00:00:35.530 --> 00:00:40.380
So if you incorporate Terrascan into your CI/CD pipeline for your

00:00:40.390 --> 00:00:43.890
infrastructure code, you can absolutely identify different

00:00:43.890 --> 00:00:46.080
vulnerabilities and document them for you.

00:00:46.080 --> 00:00:48.840
There's a feature that I'll go into a little bit later where

00:00:48.840 --> 00:00:53.620
Terrascan can automatically open up GitHub issues in a repository

00:00:53.620 --> 00:00:56.560
based on what the vulnerabilities it finds are.

00:00:56.840 --> 00:01:00.180
And then each vulnerability in Terrascan is categorized

00:01:00.180 --> 00:01:02.860
from low, medium, high to critical,

00:01:03.140 --> 00:01:06.740
which can give you an idea of how to prioritize remediating

00:01:06.740 --> 00:01:10.410
those in your infrastructure code. Terrascan also covers a

00:01:10.410 --> 00:01:14.260
little bit of the protect domain, specifically identity management,

00:01:14.270 --> 00:01:19.510
authentication, and access control. Under PR.AC‑4: Access permissions

00:01:19.510 --> 00:01:22.770
and authorizations are managed, incorporating the principles of least

00:01:22.770 --> 00:01:24.620
privilege and separation of duties.

00:01:24.840 --> 00:01:30.620
Terrascan has some pre‑written rules for things like AWS IAM policies or roles

00:01:30.630 --> 00:01:36.200
that will enforce least privilege in user and group credentials, and I'll go

00:01:36.200 --> 00:01:38.860
into a little bit more of that in the demo as well.

00:01:38.980 --> 00:01:40.920
For now, let's dive into the demo here.

00:01:40.930 --> 00:01:44.440
We're going to install Terrascan and then scan some

00:01:44.440 --> 00:01:46.620
Terraform code for vulnerabilities.

00:01:46.840 --> 00:01:47.830
And then finally,

00:01:48.030 --> 00:01:52.860
we'll go over skipping rules and additional implementations of Terrascan.

00:01:53.840 --> 00:01:54.650
Let's get started.