Introduction to VMware vRealize Automation SaltStack SecOps

A Brief History of VMware vRealize Automation SaltStack SecOps

Previously released in April 2019 alongside SaltStack Enterprise 6.0, the SaltStack SecOps add-on added security policy compliance and vulnerability remediation capabilities to SaltStack Enterprise. SaltStack SecOps was well received in the industry and won several awards, including being named the hottest new cybersecurity product at RSA 2019 by CSO Online. In September 2020, VMware announced its intent to acquire SaltStack. By October 2020, VMware announced that it had closed on this acquisition and introduced VMware vRealize Automation SaltStack Config as the configuration management component in VMware vRealize Automation. Finally, in February 2021, VMware announced the release of VMware vRealize Automation SaltStack SecOps.

What Is VMware vRealize Automation SaltStack SecOps?

VMware vRealize Automation SaltStack SecOps is an add-on for VMware vRealize Automation SaltStack Config, which comes as part of the vRealize Automation product. VMware describes the product as the “compliance and vulnerability management component of vRealize Automation, delivering full-service, closed-loop automation for IT system compliance and vulnerability remediation.” The add-on introduces two additional sections within the VMware vRealize Automation SaltStack Config user interface: Compliance and Vulnerability. I will explore each of these components in more detail below.

SaltStack SecOps Compliance

The Compliance portion of the SecOps add-on allows you to manage benchmarks, checks, and define assessment policies. Per VMware, the product “includes a database of up-to-date, certified security content based on CIS and Defense Information Systems Agency Security Technical Implementation Guides (DISA STIGs).” However, as I’ve found with many compliance benchmarking products, the out-of-box content is often outdated and missing the latest operating system releases. In the case of DISA STIGs, earlier this year, VMware vRealize Automation SaltStack SecOps only contained a single STIG (Red Hat Enterprise Linux 7), but as of this month, STIG content for both Microsoft Windows Server 2016 and Microsoft Windows Server 2019 is now available. DISA recently released the Microsoft Windows Server 2022 STIG, Version 1, Release 1 on September 28, 2022. Hopefully, it will become available within VMware vRealize Automation SaltStack SecOps sooner than later.

Compliance Benchmarks

VMware’s Supported Security and Compliance Benchmarks documentation provides a list of supported benchmarks within VMware vRealize Automation SaltStack SecOps. However, I’ve found that the list is inaccurate (as of October 2022). Based on my review of the available compliance benchmarks in the product, the following compliance benchmarks are available in VMware vRealize Automation SaltStack SecOps:

Custom Compliance Content

VMware vRealize Automation SaltStack SecOps supports the creation of custom compliance content using the SaltStack SecOps Compliance Custom Content SDK. This SDK allows you to create, test, and build custom security content to use alongside the SaltStack SecOps built-in compliance library. Creating the custom compliance checks is as easy as utilizing the template files included in the SDK and defining both a state (.sls) file and a meta (.meta) file for each check. The SDK provides capabilities to test your content utilizing Docker containers, and once tested, the SDK can generate a tarball file suitable for uploading into VMware vRealize Automation SaltStack SecOps.

SaltStack SecOps Vulnerability

The Vulnerability portion of the VMware vRealize Automation SaltStack SecOps add-on allows you to assess and remediate your systems against the latest security advisories. Per VMware, it “is a vulnerability remediation solution that allows Security and IT teams to work together to assess the vulnerability status of your systems against the latest security advisories, including those that reference Common Vulnerabilities and Exposures (CVE).” This task is accomplished by defining a vulnerability policy, scanning target systems based on the policy, and remediating any advisory with an available remediation package.

I find this portion of the product quite intriguing due to the following:

1. VMware vRealize Automation SaltStack SecOps duplicates existing capabilities within VMware’s Carbon Black suite of products. It even provides the ability to import vendor scan data from VMware Carbon Black (among other products).
2. VMware vRealize Automation SaltStack SecOps does not provide a list or database of known vulnerabilities which the product will scan or remediate.
3. VMware vRealize Automation SaltStack SecOps Vulnerability data is only released quarterly, leaving the product outdated.

Based on the lack of visibility into the vulnerabilities supported and the lack of frequent updates to the vulnerability database, I find it difficult to view this product as a serious solution for use in vulnerability assessment and management. From my experience thus far, the tool appears to primarily surface missing patch findings based on the guest operating systems’ built-in patching capabilities.

Supported Operating Systems

VMware vRealize Automation SaltStack SecOps Vulnerability supports the following operating systems:

It’s worth noting that the list does not contain the latest operating systems, including:

• CentOS Stream 9 (released in December 2021)
• Red Hat Enterprise Linux 9 (released in May 2022)
• Oracle Linux 9 (released in June 2022)
• Ubuntu 20.x (released April 2020)
• Ubuntu 22.x (released April 2022)
• Microsoft Windows 11 (released October 2021)
• Microsoft Windows Server 2022 (released August 2021)

Third-Party Security Scans

VMware vRealize Automation SaltStack SecOps supports importing results from third-party security scanners. After import, vRealize Automation SaltStack SecOps can be used to remediate the security advisories. The following third-party security scanning solutions are supported:

• Tenable
• Rapid7
• Qualys
• Kenna Security
• Carbon Black

SaltStack SecOps Compliance and Vulnerability Content Updates

By default, vRealize Automation SaltStack SecOps will regularly download and ingest the latest compliance and vulnerability data directly from VMware. If necessary, the product supports downloading this data via an HTTP proxy. If your SaltStack SecOps systems are on an air-gapped network, you can optionally download the data manually from VMware Customer Connect and import the tarball files into the product. Per VMware, vulnerability data is updated quarterly, although they also state that this frequency could change in the future. VMware does not specify a frequency for new benchmark data releases but says that benchmarks are released independently of SaltStack SecOps releases.

Conclusion

VMware vRealize Automation SaltStack SecOps has the potential to be a useful tool when it comes to enforcing compliance with industry benchmarks. However, I’ve observed that new industry benchmarks have not been released in a timely fashion for enforcement via SaltStack SecOps. The lack of timely updates could be a roadblock to adopting the product within specific industries.

Regarding the tool’s vulnerability scanning and remediation capabilities, I do not see the product as a viable solution. The lack of a published vulnerability database and the infrequency of updates prevent the end user from knowing whether or not specific vulnerabilities exist within a system or if the tool is even checking systems for the vulnerability. Until VMware vRealize Automation SaltStack SecOps can list which vulnerabilities a system does and does not have, the solution itself will only be useful for remediating vulnerabilities imported from third-party vulnerability scanners.

Share:

Search

Get Notified of Future Posts

Follow Me

Recent Posts