Compliance-As-Code For API Security by Kamalika Majumder #apidaysindia

Hello everyone, my name is Kamalika. I am an independent DevOps consultant and an infrastructure developer and I have an industry experience of like more than 15 years. So I literally started my career ah installing servers and networks and fire walls. And today we're going to talk about compliance code for API security and this will be a 50% off it. I will give the context and then another 50% of my income will show you some examples and demos from real life implementations ah for my client my own client projects in critical sectors where I had implemented ah civil compliances and how we did it using ah codifying their compliance controls into the infrastructure. So let's begin. First of all what are the compliances? So the general norm in the industry or in general when you ask people what are compliances and why people are so skeptical when they hear the word compliances is because ah everybody thinks these are like 10 page checklists ah which you should go and fulfill and ah you know ah you will have to certify and you know ah submit a bunch of documents and stuff like that. But in reality compliances are not actually that. Compliances Never Tell You How to Do It. They will tell you what to do with it. These are just frameworks which will guide you towards securing your information, your data, your infrastructure or whatever it is. Ah, there you will rarely find any compliance will tell you how to implement it. From late, am you have a late, from you are a small fintech company. [nasal sound] Now you're storing credit card data. Now compliance won't come and tell you that's okay, compliance will only tell you that you will have to secure your ah customer data in such a way that it does not leak out, but it will never come and tell you that okay, you will have to use this protocol, that protocol, or you know this tool, that tool. They will It's up to you. This is to you know this is a self ah assessment that you will have to do to comply to the compliance first. So these are also guidelines to secure your assets. So globally if you look at majority of compliances they are driven by a uniform ah agenda to secure your identity or I a no intellectual property or assets whatever you call it. So Di- They give you guidelines to follow it. Am now which sectors and why do we need compliances critical sectors like banks, insurance companies, fintex companies. Ah, offen need more than one compliances. And that's exactly the reason why I say that compliances are just frameworks. You know, there are not any hard and fast rules that you have to do this and have to do that. And you must have 50 documents, then only you can certify. No, you can even certify with 10 documents or you can even fail a certification with 50 documents. And More on Above All, Documentation Is Not the Only Thing. And sats why, you know, in some sectors you might need more than one compliance. Let's say, ISO 27001 is one ah compliance, global compliance for information security. But when you go to the countries like late South East Asia. Each country will have banks which will have their own compliances. When you come to India, India has RBI regulations, India has DPDP Act. So, it depends you will have to club them together sometimes. Ah and that is why ah the non compliance ah becomes you know you might face safety ah penalties if you are not complying to it especially when it comes to the government regulations. Ah now some people think that it is only the banks or you know fintech or lately insurance and stock exchange who needs compliances or certification. But that's not true. Software development companies especially the ones which are in a Sass format. And which are exposed to the public internet also need compliance. Because today ah with the advent of AI you know ah we are seeing more and more integration and ah talking between various companies ah providing services. So there you are actually storing critical assets which you have to protect. You're you're collecting a lot of data from people. Lots of personal data from people. You may not be a bank. You may not be a card industry, you may not be a payment gateway. You may not be an insurance company, but you're still collecting a lot of information which you're using, and if somebody gets hold of that data, that will, you know, bring in a lot of complications, and if you've seen in the recent last two to three years the kind of compromise that you've seen which has brought entire systems down, airports down, banks down, these are actually not very fancy attacks, these are very simple, very, you know, I can say like, ah, very simple day to day activities which people have somehow breached and they're able to get hold of this data, and most hackers do that. They Do Not Go and Try to Break a Very Fancy Authentication System. They actually try to see very you know ah usual human behavior and try to find fort lines on it and then try to get the data. So software come be it software companies ah be it banks and be it regulatory industries. If you are handling human data, you know personal information, you must at least follow the guidelines provided by the compliances. [nasal sound] So what are the baselines for these compliances. Ah there are a number of compliances in the world and we usually get very confused when we are especially for startups. When we are building an application. We do not think about security from day one. You Know. Day, From Day One, We Think How Soon Can We Get Our MBP Out? Now, unfortunately and fortunately, getting out an MVP can get you funding, can get you some customers. But then you kind of forget about the security aspect. And you think about the security aspect when you're on you know one or product one release and you 're on boarding customers and you know things like that. And then on the nth day, you finally you know your manager or whoever you are you hire a cso and you know you don't hire a cso on day one and security expert on day one you know ah then you count to know okay I need to get this approval I need to get this license let's say oh I need this certification. But then you know all the health breaks are lost. And now a days ah unfortunately what I have seen personally is that many companies rush towards getting fast certification. You know submit 50 documents get certification irrespective of what is there in their underlying infrastructure. So what happens is and that is why you will see why does a company like Oracle have its IDM database been breached. Because there is a faulty VM you know it it was attacked in 2025 early in March. They got like 5 billion user data out. It's it's really a baseline thing right. It's you shouldn't have , you shouldn't have faulty or unhardened systems in your infrastructure or in your clients. You should be able to identify it. Big Company Like That. You have you're saying you're having certification. So what is the baseline for come ah compliance. Every compliance that you see there is standardized by one thing which is securing your information. And they are widely distributed into three sections. Which is PCI, PII and PHI. PCI We Have Heard a Lot About It. Ah which is the card industry. If you are handling any credit card and you know ah debit card, any kind of card data that if if your application is storing that data you know in a in at rest or using that data you have to secure that data. And that's a mandatory thing by the governments world wide, you know, no matter which government it is. So, if you're developing something, where you 're building some kind of application, which you'll ask someone like. Even if you're you're selling like if you're a solopreneur selling a small, quick AI app on the internet and you're using Stripe. You will see that ah all this ah you no payment services. They ask you to you know check box these things like you know I follow the PCI guidelines and I am storing the data ah responsibly and there is no ah breach that will happen. Ah PII is Personal Identifiable Information. Now earlier than late, three years back, four years back, this used to be a name and date of birth and you know very minimal thing. But today even any ah und data like email ah ah has become a PII kind of data. So, ah and it will even keep evolving you know, the more accessible earlier email if you only few people used to have email, you know because email communication digitization was not that much. But today email has become like ah like your I would say identity and passport ID. It's as critical as your passport ID. Right? So ah it has evolved and industries are also recognizing that even email ID is a PII data and if you are storing PII data you will have to make sure that and PII data ah specifically now a days is ah also used are ah the governments are regulating where you store PII data the you know the citizens data it is it is considered as citizen data like ah in the eastern part of the world like India South East Asia when you go there and you will build building application before even go to PCI governments will tell that no matter what you do you will have to store PII data with in the country and we are seeing this you know India we are seeing it recently it used to be there for payment industries but now with the DPDP Act will see more of that and that's why many ah companies especially the AI ​​ones who are doing a Lot of data processing they will have to do to comply with it. Ah in Europe you have the GB GDPR Act. So there's also more about PII: Citizens' Information Should Not Leave the Country. If you are using Citizen Information, you will have to store it in these data centers. So, data localization is an aspect which is very closely related to PII data, even before you know you go to the money transaction part. So it personal ah ination of citizens has to be localized. Ah the other is then ah comes PHI which is a health related information. Health care services, insurances. Now Ah PC, PHI and PII Kind of Are Correlated. Sometimes PHI that is also considered as PII data. So, if you're ah a health ah provide, you know, kind of health services, health care service provider. Ah, you might have to comply with both. Like, first of all you are giving you have information regarding, people's health, blood group extra, extra. But you also have like email id and things like that. So one important thing is that services like logging and monitoring right now were not considered as critical services are like compliant, you know services which need to be compliant but they are also been considered as under the umbrella of regulated because while you are monitoring your application logging various stuff, you know correlation ID stuff like that. You will have that data like email IDs and you know it's easier people have found out way to capture the logs and breach your ah applications and that's why am for sass a providers like a late say splunk and am you know neural there also when you are going to such countries which have PCI PII regulation you will have to take care of that that data is to be sanitized and you are not exposing unnecessary and everything that lock4j capture to your thing. So these are aspects. Now what are the challenges of compliance? The biggest challenge that I have personally faced while implementing and while building infrastructure for compliance heavy industries is the interpretation of their controls. You know, and I think that's the biggest ah kind of wall between the security ah world and the software development world. Where ah the language that's being used on these documents is not interpreted correctly or it you know there is the lack of bridge between ah translating the controls into configurations ah has ah created this kind of skepticism in the compliance world. And when you talk to auditors ah it's very difficult. And I don't blame them because auditors usually come from like the generic world, right? They are not going into the implementation as a part of it. They and that's why sometimes it is easier to satisfy them than to just show them a policy document. But then again auditors will come and ask for evidence and now you don't know how to provide the evidence. So I think the biggest challenge there is is that you need to convert the compliance that is there in the document into code. And that is why you know I picked this topic of compliance as code. Ah and ever evolving standards. That's the second ah I think in the recent time I would say the second one has become ah the you know taken first priority because ah the way ah technology is evolving with AI. Ah you will have to keep ah upgrading your compliance and regulations. And ah till date, ah I think only IO 271 has updated the regulations in line with some aspects of AI. Ah there are still lack of any directions towards that. You know how to maintain it. So you will have to take in ah you know kind of ah ah consideration that soon governments will start releasing compliance ah frameworks for AI regulation. Now when AI regulation comes in it will keep changing because you know ah the way AI is first you know LLM then JNAI then tomorrow there can be something else and the way they are integrating with our systems. So ah technology is evolving much faster than what it was in the cloud era. Ah, we took a very long time to come to the cloud and the digital transformation era, but the AI ​​era is moving really fast. Ah and that's why you will see there are upgrades happening in this compliance. Like from PCI DSS X you know they have a new version which was the last version expired last year and version four is there. IO 271 October 31, 2013 version is expiring and they have gone through a complete reorganization of the older version to the newer version. They have in fact reduced the number of controls. They have not increased it. So they've clubbed a lot of things dev brought in a lot of um coding related stuff ah compared to you know earlier it was a lot of generic stuff. So these challenges will keep coming in and ah these ah needs a review every year. So you can't just say that I have you know earlier you do one certification and you're good for five years. But today that's not the case. You know may be soon you will have a situation and once every quarter and you know every two quarters you will have to do a review of ah where we are. Like a security review of Where We Are. So ah and these are the challenges and when I say interpretation right for example what does it really mean like this is a this first statement is actually a copy of a control ah from IO 271 2022. So the f the first one in fact I think it is a user device user and point device control it says ination stood on processed and I am I am reading it as is okay I have not changed and it then it is that's why I have kept it in co rotation. This is exactly what you will do when you download the iso 271 documentation This is exactly what you will do when you know see. Now what does it mean? How does it map to a real life implementation. Like, ah is it a policy, some will say, ah like, when I went to the vent to take the certification for implementation, the auditor told me, yeah, it's a policy. Hidden tell me, you know how in my AWS infrastructure I can implement it. He didn't tell me what should I use VPN and should I use this that he didn't tell me anything so you just have to secure it. Make sure it is secure and you will have to convince them. So it is a you know how do you prove your implementation works. And how do you assess if your API endpoints comply with this kind of evolving security? Because your applications will all be exposed to the Internet, will all be integrated with different third party applications and the talking point or the end point is the APIs. Right now that, that is kind of your gateway. Right? Ah you know entry what you call the not the walls. But the first point where the request will land in. So, it can be a valid request, it can be an ah you know, and doesn't matter that if a user ah from the internet comes and users it, it can even be your vendor's or outsourced ah application where you're integrating. Am so, why compliance code? And because of all this reason, we need compliance to be codified. And when I say codified, I don't mean the government term of codification. Or the auditor term of code? I mean the software development term of codification. You know, how do you make sure that these controls, and one more thing, as I said, right? Compliances are not hard and fast rules like frameworks and like 10 things you need to implement all of them. No. You can implement your application can be ah it man it can be like only five of them is in enough for your application. But you will have to make sure that you have the right justification for why you are skipping the other five. You know when you are going for a certification you can say okay. Ah, like in the last session, someone asked is it mandatory to use HTTPS when you're talking internally within the application. No it is not. And that's exactly it. The compliance won't say you have to use HTTPS. Nobody will say it. But you will have to ensure that with the using HTTP or any other protocol there is no ah you no kind of ah ah fancy stuff happening with these internally. You have to make sure that your users and your developers, whether or not you have third party endpoint integrations, they are also aware that this is a kind of a risky thing. And it's not like if you use HTTPS everything is secure. That's also not true. Right? People can even break into HTTPS. So HTTPS is not enough. So that's why you have Zero Trust policies which is not just HTTPS which is like mutual TLS and authentication from container to container. There are a bunch of things. So, it's up to us to architect and make sure that these breaches, we are preventing anybody to know steal our data and steal our information that we are storing. So, why compliance code ah ah verifiable proof end to end traceability. So when you have codified them it is easy to get the evidence. You can prove it. It is beyond just documentation and some paper work. You have the proof, you have the logging and you have the traceabilities. Ah law you know, you have the data and you can do real time monitoring. Am avoid last minute evidence collection and this is important for industries which have to show ah certification. Like I Say Banks. They might they must show certain certification. Otherwise they are not going to get license from the government to operate in the country. Healthcare, banks, fintech sectors. You have to get RBI regulation passed. I am talking about India. Like late say if you go to Indonesia they have something called as Ojeka certification. So ojeka & io 27,0001 unlike compulsory in Indonesia for banking and fintech services. If you do not have that certification. Ah you no valid. Like every year they have to go through ah not a recertification like an audit and that process. Ah you can lose your license to operate in the country. So that means your law you no loss of your business. And you will see that we have seen many startups in the recent times that failed are being closed up because they have failed these regulations and things like that. So evidence collection is an important aspect when you are going through compliance certification. And if you have it codified, you can just generate it. You don't have to go and look out for it, okay. Do I have a password policy? You don't have to go and you no search in your systems. You can just go in your code repository. And your deployment pipelines and then you can see I have the pi- password policy and this is the configuration. It's simple and they will have time steps and you know who has updated and that's kind of thing. Ah streamlining certification across tenants. Ah I think today rarely we will see monolithic architectures. V Mostly C Micro Service Level Architecture. And ah we have a lot of B to C kind of business models. So we have a lot of customers ah accounts that you create. So you have a lot of multi-tendent architecture. So when you are doing compliance certification, you have to for the whole organization by the way. So it's an organization that is going through certification. It's not your application only. Ah, and if you're skipping it for the organization, you have to give a very good reason to the auditors. So if you're going to do that you have multiple tenants. So how do you make sure that everyone is complying? So if you have a source of truth where all the controls are codified in one place, you can just create the environments for all of them. They can be in different environments, but it is like you know you can deploy them multiple times. So it's easier to streamline it across all of them. You don't have to reinvent the wheel every time for every application. And also like ah continuous integration and delivery. Ah you can deliver policy as code for example, backups policies, password policies, identity management policies, you no deletion policies. So, these are specific things that can be codified. Ah, tasting becomes a lot easier. When you have it as code. And again, as I said, IO 27,0001 requires a recertification every three years. And like every year you need an audit. So when you have such requirements and you can't spend months. The First Time Investment Yes It Will Be Like From Two To Three Months. But then again every year two three months you can't just spend and you will forget okay what was there last year. Right? So it became difficult. Ah again ah in a related version of IO 271 2022 It's not enough for only your organization to complete. They have a very specific control which says which ah you know highlights third party compliance like say if you are vendors if you have ah outsource ah partners if you are integrating they should also come be ISO 27 you know comply to IO 271 and a very ah real use case that I have faced personally is well I was building an infrastructure for a bank in Indonesia we were very specifically told that all our end points have to have mutual TLS even internally for communication because otherwise we will not be allowed to integrate with Visa's API. So Visa ah you know the Visa ah the payment gateway switching gateway. So to two they were a different infrastructure and our API it was a mobile banking app and they have we have to integrate them. So they set until you satisfy mutual mutual trust and zero trust policy in your infrastructure. We are not going to allow you to integrate with our infrastructure. So it was more you know kind of a mandatory thing for us to get our bank ah application ready than for them. So like wise ah every third party vendor like say you have outsourced some bit of development to your some vendor services. They should also make sure that they are not violating any of these password policies and deletion policies and things like that. Ah because otherwise ah you know things like last years crowd strike event which happened will happen. Crowd Strike Was Just a Vendor. Right? But ah Microsoft got blamed all around the world. Ah the actual you know halt was in the cloud strikes application, and it was a known ah vulnerability. They had this vulnerability in Red Hat systems earlier. But we didn't know about it because we don't use Red Hat that much. But Microsoft Windows is being used worldwide. So, poor thing Microsoft gets to blame for you know a lot, if you can blame Microsoft for a lot of things. But in this case it was like a there vendor did not follow something and it got it. So, when you're ah in this heavily integrated world, it's a you know, the compliance has also updated their guidelines saying that, it's not enough that you say, oh, I'm certified. Tell us everyone who is in contract with you that this is also following the same principles that you are following. So now ah let's go look at demo how I codified. So I took this example. I'm using teraph ah for codify infrastructure and this is related to infrastructure ah implementation of these controls in infrastructure. Ah I have not included anything in the application site but you can also use it for the application site. And I have chosen AWS because it is the majority of infrastructure on cloud is on AWS. It's the top most player. And ISO 271 because ISO 271 is like the help of all information security compliances. Like if you don't know where to go. Right? You can just straight away start from IO 271. Let's say you're a startup, you're building some application. You have no clue but you feel that you have to be secure. So just ah download it. You don't need certification from day one. Just download the document. Ah start reading through it. Start going through ah you know how you can implement it. So that's why I chose it. ah so or and another reason is because the older version 203 version is expiring this month and 2022 ah will start and 2022 has gone through a major ah reshuffle of ah controls. So [nasal sound] what they've done is they've actually reduced the number of controls. The first time usually we see ah loss and regulations will only increase the number of to does. But what they have done is they reduced it from 114 to 93. The reason they have reduced is very interesting. They Have Actually Actually Clubbed a Lot of Controls into One Single Because They Were All You Know Kind of Distributed All Around the Places. So, what they have done is, they have reorganized [nasal sound] the controls into four categories. And like they have organization, technical, ah physical and personal. So, ah then they kind of created it in in that zone. So let's me so or so they have take controls orc controls physical controls and people controls sorry not personal. So tech controls is purely technology you know configurations, user devices and like from user end point devices and things like that information is very-very technical a pure technical so like from if you are a software development company you can start with technical controls. Then organization level is process related to how your users are handling their hardware, software, access cards and those kinds of things. Then physical control is how you're protecting your security parameters entry securing offices and you know ah controls and things like that people controls is more around disciplinary actions and things like that. So this will be more like documentation related like contractual documentation, device level documentation but the more thing that we will be most interested in is the technical controls. So just okay so and our first thing and this will are also inspired from these implementations that I have done an experience in the past couple of years [nasal sound] ISO 2701 for Fintech and Ojka as I mention Ojka is similar to how do I say like Ojka is a financial authority of Indonesia it's like the RBI of India and PCI DSS sock to now interestingly I was doing a sock to kind of I'm preparing ah a startup and there they were like a recruitment application so there were ah they were asked to do sock to and there was an interesting question in the sock to a security checklist and the question was are your data centers 27001 compliant? So that was a question in a sock to a certification. So, it was like it was it was a it was a single question but to give the answer is- you know you have to go through the entire IO 27,000 and end to not your application is your data center. That means the whole AWS and they were on AWS. So I'm like ah when I say like it's like the mother of all compliances. So if you have it in fact ah the EU regulatory act the GPDR act ISO 2701 to also has a version of a they have incorporated a GPDR act into their controls. So they have made it kind of implementable there. and India's DPDP Act. Actually you go and read it. It's just a It's just a law. Actually it is not a framework that will give you. So if you read it you will have to correlate it with ISO 27001 PCI DSS and all that and we will have to soon start doing it because the government might notify it this year or early next year they are very close to it so this is how I implemented the compliance code for ISO 2701 ah controls I divided it into three sections am the top two these are like mandatory things that I have picked up so internal internal audit is a mandatory requirement in the g in the document in the standard document they say that you must have an internal audit they don't say when or how many times right they don't mention they say regularly okay so you can have once a year you can have twice a year once in two years it's up to ah you know the number of changes that your infrastructure has gone through. If your infrastructure application is going through a lot of architectural changes, you might have to do it twice a year. For example, I was doing it for a bank, they were initially on AWS cloud. Ah ah so then decided that they will move to GCP. Because GCP were giving them 30% discount in infrastructure. So we had to redo it within six months. Because our entire cloud architecture is always our logical architecture, but the physical architecture has changed, and it's good that we did it. Because we found out that GCP data centers in Indonesia where not compliant with the DC Ah You no disaster recovery. They Actually Did Not Have a Multi DC Set. They just had three buildings, three towers and three server rooms in three of them. And there calling it availability zones. And it was ah you know, the head just released it six months back. So, we did it and we could know that okay, these guys are not yet ready. So we head to inform it to the auditors. And then auditors told us if you do not have a disaster recovery centre, which is a mandatory thing for banks. You have to make sure that some other cloud like some may be 60 km. Away or some place. You have a secondary site. So, ah that came out in our internal audit when we did that. The second is risk management. This is like risk management is like I can say the default document for any kind of compliance. You know, if you go there, they will ask for a risk register and you will have to assess and manage risk. And there you will have to actually identify what are the risks that you think are critical. For yourself. You know it doesn't matter if it's a risk for like, say, a small consulting company losing four hours of data is okay, but for like, say, a health care provider or like, a telecom provider, if they lose that four hours of data, they won't be able to charge their customers with that because they've lost it. So this kind of risk it depends on companies of all shapes and sizes in different sectors. And the third thing is of course a cum-control implementation. It is also a mandatory requirement. Now it is not mandatory to implement all 93 controls. But it is mandatory for you to tell them why you are excluding it. Right? So, lately, in your company, everybody is working from home. You don't have a physical infrastructure. So, you will have to specify that I need an access card or a security guard to be securing my premises because I don't have a premises. I am working. But then you will have to make sure that your devices which your other users are using for remote connectivity are secure. That becomes a higher priority. So I divided it into these ah things ah these three categories. And So This Is How It Works If I Have To Implement It And When I Am Codifying It. Ah NXA controls, then risk assessment which is part of clause 1.6.1.2. And internal audit is part of clause 9.2. Now, I'm going to code my modules which I will show you how I have built. Compliance code modules, ah when you ah odd made all of them and ah you no codify all of them. You can launch an assessment and then you can generate the audit report. And simultaneously you can also enable thread detection. Vulnerability scanning does those things because these are part of those controls. [nasal sound] If I have to, one second. Yeah. So like you see. Yes. Here See Protection Against Malware Management of Technical Vulnerabilities. These are part of technical controls in IO 271. So when you have ah second. So, what I did was I started mapping all of them with my AWS configuration. So AWS has a tool called AWS Audit Manager which can automate your audit and they have not yet released a 2022 version they have one this kind of framework for the 2013 version. So you can map all of your So AWS Config is another service of AWS which collects data from all AWS resources based on their configuration. So what it does is it collects ah res you know information you know ah data from ah all the ah services that you're using using AWS Config AWS API AWS lock trail and then it will consolidate and map it and put there ah and then you can group them. Ah let's say Ah this is this is one config from EC to client VPN connection must have log enabled. Ok? So, EC to Client VPN is a VPN service of AWS. So, it must have login enabled. Now, why? Because if login is not enabled, I will not be able to monitor who is logging into my system. And that is because, the ISO, this is ISO control user and point devices. So, user end point device ISO control says the first one that I said. Information stored on your user devices which your users are accessing must be secured. So the first step ah is my ah devices which my users access are all via VPN let se. Ok? Now in order to make sure that the VPN is secure. The first thing I have to do is a log has to be enabled. Then VPN should not authorize everybody. It should have a role based access control. Monitoring instances should have detail monitoring enabled. There should be no public IP. Instances should not be exposed to public IP and like wise there are a bunch of these policies like IM policies root account hardware MFA must be enabled root account MFA must be enabled all those kinds of things because these are the ways how the users are accessing my devices you know ah because I'm talking here about something hosted on AWS. Now this can be different differently. The people can be accessing hardware devices. So, you might have to give users access keys and permissions and things like biometrics and things like that depending on what kind of system you're building. And so okay. Yeah. So once you have all the findings collected then you can have security across all your infrastructure. So these icons I don't know how many of you can identify these are all AWS icons like EC2 VPC and things like that. Now ah like ah as I said risk management is a compulsory thing because it is the first step that you do in implementing any compliance. And that's kind of a review of that sheet you will be able to identify what you're implementing what now this I have already said internal audit okay this is important so for specific API security managing outsourcing of ah operations as I mentioned like third party vendors third party integration points must have to also comply to the standards ah integration security in supplier relationships. That is another standard which is specific to API security. I am picking up examples which are relevant to API security. There are bunches of them which are related to application and other kinds of security. So like processes pro- procedures must be identified where you are working. Like I mentioned the use case of Visa and banks, right? Am like wise today, ah many applications go through UPI ah level ah integration. Now to integrate with EPI you need to exchange some data with them. So UPI will expect certain compliance that you have. Right? Ah if you're selling something online, ah even if you're selling a course online, if you're a you know as simple as that. And if you want Indian users to pay via UPI, you will have to follow it. So, you might say I'm just selling a small course. Why do I need to go through this? But you are selling a small course but you are integrating with UPI, it is collecting their data and you are not storing it somewhere. Maybe you are not storing it. May be you your vendor is storing it. May be a stripe is storing it. Somebody Else Is Storing It. But you are still integrating with them. So, you will have to make sure the interface is the same. Ah ya. Ok. This is all. Ok. So I divided it into ah five groups when I was creating my code base. So internal audit, risk management, network security and let me show you. Ok. So these are the five groups that I have divided it into. So under internal audit I grouped it into three parts. One part is control implementation. The first part is I need to at least ah ah you know install the ah evidence collection for these controls. First I implement it then I will see what is failing in my infrastructure. Right? So, ah my audit lays I show this is using ah a WS audit manager. There is a similar service for GCP as well where they can audit the whole infrastructure. So what I have done is ah my this is a terraform I don't know how many of you are familiar with terraform. Terraform is an open source infrastructure coding tool. Ah it's based it's using DSL. So, ah it's pretty easy to get. Ah so in terraform ah what I've done is , I've group them into four sections. So, my first control which is the user end point devices. I have mapped them into the Excel sheet that you saw. That is actually codified here. So what happens is when I run this it will go ahead and so I will have all of these like say around 34 controls you will see in under 8.1 for to match 8.1 I have these many checks. Again 8.2 has like all sorts of checks. So to match make sure that all my services are following and you no kind of measuring what it it should these are all there so the first section itself has around 34 odd controls so each of these ah controls must be checked for the conflicts. So I have all this ah like s three come, RDS all of them have to be checked. Weather all of them are having you no authorization enabled, IM enabled, password policy enabled all of them. So I have kind of you know these are mapping data mapping source and AWS config will go ahead and ah you know, assess whether it is enabled or disabled. If disabled then it will flag it. Ok. Ok. So, what you actually see is something like this. The dashboard will show you something like this and you also have an option for manual. For some places you need a manual documentation to see. So for example password policy. So you have it implemented here. But the auditor will ask for, okay, show me some documentation. Show me Ah Doc Microsoft Doc You know, PDF is not an. Doc and Excel is enough. So, you can also upload manual stuff. And what you can actually get ah out of a the good thing about AWS is that am you get a second. Okay, it's not coming up but anyway you can export the document and it will show you how many of them. Wet. How many of the controls have failed and how many of the controls have succeeded. So like wise I have another one ah let's say org level I will show you one org level also ah policies for information security. So every organization must have an information security policy. It is a formal document actually. So here I have ah made it upload a file. So you can put all of them under this AWS audit manager ah you know ah framework and then you can export a PDF file or a doc file um let's see if it comes up okay then it is kind of show or right but it's still connected but anyway I will show the document how it looks like and another thing is your internal ah a security officer can go and check whether it is enough or not. Some there will be some internal GRC team. They can go and check like that. Like Wise lets you have a backup policy. So you can go ahead and have a backup policy this way. Like this. Yeah. So this way ah when you codify all of them. So I I divided it into control implementation evidence collection and cloud security posture management risk management under risk management I have like threat intelligence and all sorts of things so you can actually visit this website and check the ah screenshots of the reports there it's not loading connected to hotspot but it's not loading ah so basically like this you can get all the data and then you can get a report like this C IAS PCIS, AWS. So these are some readymade framework that is AWSS. You Can Also Amine 2022 is a custom framework that I created for my own application. So, you can get a report like this. You Can Get Evidence See The Kind of Evidence Collected on This Much. So, it can actually be exported and it is also saved in ST buckets. So, you can export them in document file. So, each and then you can have a kind of progress like that. You know how much. If you have specified that check list where you have like 18 different things if 15 of them have passed and another three of them has failed to show you which has and then you can go. OK, one application has missed enabling HTTPS and things like that. And when you have all of them. You can deploy them through your CICD pipeline and you know, you can also say that you are running them regularly in your infrastructure. It's not skipping it. So there is an evidence here as well. So last you get automated deployment and audit automated testing and mostly these are all version controlled right it is not just bringing some document in some folders and it makes your pre audit preparation very easy and also the post audit reduces. So when you're going to do it every year, ah, this becomes very easy. So that's it. Ah, and if you want to check more of this, you can go to the website here and go to the compliance code modules, you can look it up. You can connect with me. Any questions? So Kamalika this is what we have understood so far is that you know you have done a very extensive study of 2701 and other ah protocols as well and you have divided them into an easy to understand, understandable versions of what a technology person can understand it and implement it. What you could not understand is that out of this code is a compliance code that you have created, how do I go and integrate it into my system? Like, the simplification that you've done and if I want to run through my code base into ah this how do I do that integration? Ok. So this is written in Terraform. And it's generic for AWS infrastructure. Ok. So, you can just deploy it in your Terraform ah in your AWS environments. So, Terraform is an infrastructure as code tool. Let it talk to AWS APIs. Hmm. Right? And ah it's like have you used the AWS API SDKs? No? Or it's like a script. Or or to simplify it's it's like a script. So you run this audio it will install it and it will run you ard. Understood, so this is an SDK which can be installed. No, this is not an SDK. This is a code. This is a Terrafan code. Ok. And Terraform itself is a is a DSL is based on a DSL language it's an it's a tool ah you can install it using brew install Terraform on your laptops and you can download it get clone son Terrafi have to connect it at the container level or a microservice it's an overall AWS account level oh it it runs at an AWS account level yeah okay okay and it's automatically going to check everything it has a I have one module for container scanning also I have one module for ECR scanning also. So if you install it right, it will let you configure the ECR repositories with these ah majors as three policies and you know bucket policies, password policies, AWS root account policies all of them. And it runs locally in that account, it does not take any information out of the account. Ah it depends. So if you want to run locally in that account, you can run it. If you want to have a separate account. From there you want to know. I'm saying let's say under scanning part or the configuration is on account level. Yeah. Ok. So you have to specify which region. Which account like any AWS deployment environment deployment that you do. It's the same way. Kamalika One more question. We have recently started using Vulkan. Ok. If you have heard about it. Tried it. I have heard about it. I have tried it. Ok. That's something we're using for the similar thing. Hmm. And ah may be later I would like to connect with you to understand the difference and also the cost difference versus ah ah what you're offering versus what we're paying over there if this is a better ah you know ah option between two we would like to start using it. Sure. There are other competitors of Term as well. Because TFM was the first one. Like AWS was the first one in the cloud. Teracom was the first one in infrastructure as code. And There Have Been a Lot More Derivatives of Tafm. Late to Pulumi and you know open tofu and things like that. So most of them are similar but the code, the structure idea and the logical structure will be similar but the code will be different. But we will have to see that sometimes Terraform code can be exported to those, imported to those tools as well and you can run it internally. I'll have to see if it has any Terraform integration. Sure ok thank you. Hi Kamalika am I from Audible or so thank you this was a great presentation I could sense how deep your knowledge was so I just want to ask for example as a very specific case I have a lambda running and suppose it has an exposed API key so will this part capture that for example because it is running all that. Secondly since it's Terraform I just wanted to confirm if you were shifting to GCP or else would it be simpler to do that because you would just shift the regions? Yeah. Can You Use Terraform in GCP as Well? But the provider is different. Correct. So the code will be separate. Yes. But only a few things will change, right? So the only difference you'll see is like from here, right? Here you have resources. The structure is the same. Only the resource names will be different. And here the provider configuration will be different. Understood. But the code may be the arguments will be different. Because each API has GCP has different APIs arguments. So, some may be the same, some may be like names will be the same thing. Now, some extra layer on top of it, GCP, networking is slightly different from AWS. It might add here and there. But ah the once you have done it in AWS, doing it in GCP will be easier. You know, the reason I chose AWS is because it is easy to get onboarded onto it. And ah so most people use it. So I have done similar thing on GCP as well. You can use GCP as well. In fact the ISO 27 certification for the bank that I was saying they actually migrated to GCP from Alibaba Cloud to GCP. So, Alibaba Cloud is again very similar to AWS. They literally copied everything even the names from AWS. Ok? So, it was easy for us. But then we migrated to GCP. So we had to, yes, we had to rewrite the code, but then again, it's just like you know, matching the provider, like, say, they there, they don't have RDS, they call it Cloud Sequel, so they name it differently, they call it Compute Engine, here they call it EC2, so those kinds of things, no answers will be there. So yes ah for first question ah regarding lambda. Ah I do have a check for lambda as well. In the List That I Said, Write These Conflicts. So, you can actually ah use that check for Lambda that it does not expose API key in AWS config they have a data mapping. So you can pre configure it. So, give this is this part right? You don't The only way you're going to get paid or build in AWS is when you run a full scale assessment for it. So, you can run it once. Ah like, every ah night I think it runs, if you schedule it. So that's the time that it will ah take some you know bill some amount. So once you have run it you know what is not there. So it's like even before you start your infrastructure you can run the audit. Like, if you've done some empy work, you can still run the audit and then you'll know that something like this part is missing. In Audit Manager Only. Hmm, these audit managers. It, it is it is just calling different AWS of APIs. And AWS config calls, AWS APIs, lock traces and all sorts of things. Whatever AWS can gather and it will show you. But the configuration part we have to do it. Like this we have to tell it to go and look for it. It will not know what to look for. So, this is the key part. You know all these things we will have to tell it. So that's why I could have had like even more for them. You know, ah this was the bare minimum that I actually said, okay, this is enough for my application. But it may it might be more. It might be less for other applications also. Like there are a lot of things actually even lambda I was ah see lambda must be inside BPC. So that's that kind of thing. So likewise lambda checks are there lots of lambda checks are available. Thank you. Thank you for your wonderful session. Thanks a lot.