So let's talk about the NIST Cybersecurity Framework a little bit.
One of the ways that Terrascan can help you implement this
framework within your organization is it addresses a couple
of the areas in this framework.
For example,
under the Identify framework there's a module called risk
assessment. And Terrascan can help you meet this goal,
specifically these two points here,
the ID.RA‑1: Asset vulnerabilities are identified and
documented, and the ID.RA‑5: Threats, vulnerabilities,
likelihoods, and impacts are used to determine risk.
So if you incorporate Terrascan into your CI/CD pipeline for your
infrastructure code, you can absolutely identify different
vulnerabilities and document them for you.
There's a feature that I'll go into a little bit later where
Terrascan can automatically open up GitHub issues in a repository
based on what the vulnerabilities it finds are.
And then each vulnerability in Terrascan is categorized
from low, medium, high to critical,
which can give you an idea of how to prioritize remediating
those in your infrastructure code. Terrascan also covers a
little bit of the protect domain, specifically identity management,
authentication, and access control. Under PR.AC‑4: Access permissions
and authorizations are managed, incorporating the principles of least
privilege and separation of duties.
Terrascan has some pre‑written rules for things like AWS IAM policies or roles
that will enforce least privilege in user and group credentials, and I'll go
into a little bit more of that in the demo as well.
For now, let's dive into the demo here.
We're going to install Terrascan and then scan some
Terraform code for vulnerabilities.
And then finally,
we'll go over skipping rules and additional implementations of Terrascan.
Let's get started.