How to Prepare for an Audit AKA Make Audits Suck Less
summary
Organization runs 30+ audit engagements a year and uses Chef for config management, InSpec for checks, and Chef Automate for reporting; workflow is bootstrap nodes, split huge domains into staged environments, write InSpec profiles, roll them everywhere, and use Chef recipes to remediate. InSpec runs the CIS-like 300 tests in 60 seconds and detects surprises like 37 controls flipped after a domain join. Scans occur every 6–9 hours. Qualys stays as external originator of vulnerabilities and non-bootstrapped nodes remain the main unresolved gap.
AI-written summary · about
chapters (11)
- 0:00Start
- 1:50Business Unit Overview
- 2:19Toolset
- 4:35Applying New JHA Standards
- 5:58Bootstrap Everything
- 6:12Create Environments
- 6:55Start Asking Questions with InSpec
- 8:58Recent InSpec Success Story
- 10:13Another InSpec Success Story
- 11:27Vulnerability Remediation with Chef
- 12:30Business Unit Audit Cadence
related talks
41mSTIG Automation with Chef and InSpec
38mKick Starting our DevOps Transition with Chef Compliance
49mBaking Safety into Infrastructure Testing
25mTransform Your Security Practices With DevOps
36mImproving Security while Reducing Toil with DevSecOps
33mMario Star Power Your Infrastructure: Getting the Most Out of InSpec
36mImproving Security while Reducing Toil with DevSecOps
17mEnhancing cloud security with continuous compliance