Netflix's newest open-source project, Security Monkey, hunts for vulnerabilities atop Amazon's cloud

Netflix’s crazy cloud engineers are at it again — this time with a new open-source tool to optimize the company’s use of Amazon’s public cloud.

The goal is to ensure that Netflix stays secure as several engineers with different accounts change configurations for different parts of Netflix atop Amazon Web Services.

[aditude-amp id="flyingcarpet" targeting='{"env":"staging","page_type":"article","post_id":1499846,"post_type":"story","post_chan":"none","tags":null,"ai":false,"category":"none","all_categories":"business,cloud,enterprise,security,","session":"C"}']

Hence the development Security Monkey, which began in 2011.

“We needed a way to understand how AWS configuration changes impacted our security posture,” Jason Chan, Kevin Glisson, and Patrick Kelley of Netflix’s cloud security team wrote in a blog post about the project. “It was also critical to have access to an authoritative configuration history service for forensic and investigative purposes so that we could know how things have changed over time. We also needed these capabilities at scale across the many accounts we manage and many AWS services we use.”

Netflix stands out as one of the most high-profile companies that depend heavily on Amazon’s cloud. It also gets props for sharing its inventions with the rest of the world under open-source licenses alongside a handful of other companies, like Airbnb and Pinterest.

Previous Netflix projects include the Asgard cloud management tool, the Suro data pipeline, and the Lipstick user interface for showing Apache Pig workflows.

With Security Monkey, an admin at a company running applications on AWS can check out historical information about configurations, as well as issues that meet certain criteria. And the person can explain why a certain possible vulnerability is acceptable.

Read the blog post about Security Monkey to learn more about the project, and if you use Amazon’s cloud, you might want to check out Security Monkey on GitHub.