EP126 What is Policy as Code and How Can It Help You Secure Your Cloud Environment?

Guests: 

Dominik Richter, the founder and head of product at Mondoo

Cooked questions:

What is a policy, is that the same as a control, or is there a difference? And what’s the gap between a policy and a guardrail? 

We have IaC, so what is this Policy as Code? Is this about security policy or all policies for cloud?

Who do I hire to write and update my policy as code? Do I need to be a coder to create policy now?

Who should own the implementation of Policy as Code? Is Policy as Code something that security needs to be driving? Is it the DevOps or Platform Engineering teams?

How do organizations grow into safely rolling out new policy as code code? 

You [Mondoo] say that "cnspec assesses your entire infrastructure's security and compliance"  and this problem has been unsolved for as long as the cloud existed. Will your toolset change this? 

There are other frameworks that exist for security testing like HashiCorp’s sentinel, Open Policy Agent, etc and you are proposing a new one with MQL. Why do we need another security framework?

What are some of the success metrics when adopting  Policy as Code? 

Resources: