In this pocket guide, you’ll find essential information about main security controls. I will explain the concepts, risks, share real-world examples and some interesting, less obvious insights.
Idea
DevOps shortens development lifecycle through automated continuous delivery and integration. It is a challenge to maintain security and stability of the frequently changed environment. However, frequent release cycles are beneficial for patching.
With highly automated release management it may be as easy as one click to deploy a new version of the application. However, a deployment gate can be implemented to maintain human oversight, requiring manual approval before software progresses through the pipeline.
DevOps model also enables integration of security tools into the process. It is easier and cheaper to catch security issues early in the development process, than late in the production deployment. That concept is also known as “shifting security left”. We will discuss it in detail in the security assurance article.
A key mechanism to deal with failed release is capability to roll back changes. The capability should be regularly tested.
Application examples
Here is how release cycle may look from start to finish:
- A staff developer commits code to Git (version control system).
- Code security scanning (Static Application Security Testing – SAST) is triggered.
- If no security issues are found, pipeline compiles the code into a binary artifact.
- Unit tests are invoked at this stage to verify the application functionality.
- Container build is initiated.
- The container is tested for composition (Software Composition Analysis – SCA) and known vulnerabilities, along with other, non-security testing.
- If Infrastructure-as-code is involved, it is scanned for misconfiguration and hardening.
- The container is moved into a staging environment. Further validation and testing are performed.
- Human approval is requested for the production deployment.
- If approved, container is deployed into the production to serve live requests.
Risks
In the DevOps model, developers share responsibility for the production system with operations teams. Keep this shared responsibility in mind when designing authorization rules.
Storing production secrets in source code is a dangerously common mistake. Scanning of code for secrets is essential.
Quirks
While security scanning tools are maturing quickly, there is often lack of confidence to implement them in the “break the build” mode. Careful tool selection and tuning are required to overcome this.
Further reading
Pocket Guide: Machine and Container Security
Pocket Guide: Security Assurance
Please check out the map of cyber security controls below. It is simple yet awesome.
