The term
DevOps is used to describe a series of cultural concepts, practices, and tools that combine software development (Dev) and IT operations (Ops) and improve an organization's ability to quickly deliver applications and services.
Using the
DevOps approach, new application functions can be delivered frequently. The flexible cloud infrastructure meets the surge in demand by automatically expanding processes that can expand
new computing resources (virtual machines or containers) and deploy more application instances as needed. The organization only pays for the amount of calculation required.
Many enterprise organizations around the world are turning to agile and DevOps methods to eliminate functional and management barriers and automate change management, configuration management, and deployment processes. DevOps can ultimately help organizations shorten time to market, improve product quality, eliminate inefficiencies, accelerate digital transformation, and respond to customer needs faster.
What is CI/CD?
By merging development and operations and promoting more collaboration between intelligence,
DevOps can be closer to business goals and shorten development cycles. When using continuous integration (CI), developers incorporate code changes into the repository multiple times a day and automatically integrate the changes into the build. The continuous delivery (CD) method requires that the code is always deployable, so that it can be deployed to production at any time with the touch of a button.
DevOps security challenges
Despite its many advantages, DevOps will still bring new risks and cultural changes, as well as security challenges that traditional security management solutions and practices cannot usually solve. These traditional methods are often too slow, too expensive, or too complex to support automated software delivery and deployment to the
cloud or as containers. These challenges include:
The privileged credentials used in
DevOps are the targets of cyber attackers. One of the biggest security challenges in the DevOps environment is privileged access management. The DevOps process requires the use of privileged human-machine credentials that are very powerful but highly vulnerable to cyber attacks.
Human access: Through high-speed processes, DevOps practitioners require privileged access across development and production environments.
Machine access: In an automated process, machines and tools require elevated privileges (or permissions) to access resources without human involvement. Examples include:
Automation tools: Ansible, Puppet and Chef
CI/CD tools: Jenkins, Azure DevOps and Bamboo
Container management tools: Docker and Linux containers (LXC)
Container orchestration tools: Kubernetes, Red Hat OpenShift, Pivotal, Cloud Foundry
Tier 0 assets (such as Ansible and Jenkins) can access the credentials used by many other tools.
Once the attackers obtain privileged credentials, they can fully access the DevOps pipeline, sensitive databases, and even the entire cloud of the organization. Attackers are aware of this and are increasingly looking for privileged credentials, including passwords, access keys, SSH keys and tokens, and other types of secrets such as certificates, encryption keys and API keys. Attackers can use insecure credentials in the DevOps environment, resulting in encryption hijacking, data leakage, and damage to intellectual property rights.
Developers focus on speed, not security. The DevOps team focuses on generating code faster, so it often adopts unsafe practices outside of the security team’s authority. These practices may include retaining embedded secrets and credentials in applications and configuration files, reusing third-party code without sufficient scrutiny, adopting new tools without evaluating potential security issues, and DevOps tools and foundation Insufficient protection of the architecture.
A tool-centric approach to confidential information management can create security holes. DevOps tools usually have some built-in functions for protecting confidential information. However, these features cannot promote interoperability, nor can they securely share secrets among tools, clouds, and platforms. DevOps usually combines the built-in functions of various tools to manage secrets. Since confidential information cannot be monitored and managed in a consistent manner, this method may be difficult to provide adequate protection.
Steps to enable DevOps security in your organization
The following are the steps that organizations usually take to achieve a wide range of DevOps security while addressing the risks of privileged access and align with
DevOps culture and methods:
Instantiate the security policy into code. The cornerstone of DevOps is the concept of "infrastructure as code" (sometimes referred to as immutable infrastructure) to replace the traditional model of manually managing and configuring servers and software. By applying this concept to security (instantiating and managing security policies in code), organizations can eliminate the labor-intensive and error-prone configuration process.
Establish a division of responsibilities. The DevOps team should clearly define different roles and responsibilities:
Developers should focus on creating applications to achieve business results.
Operations should focus on providing a reliable and scalable infrastructure.
Security should focus on protecting assets and data and reducing risks.
The interaction between the groups can be written into the written security policy. For example, developers create security policies that declare what privileges their applications or services require. Security personnel then review and approve security policies, and operations personnel ensure that applications are deployed as expected.
Integrate security into CI/CD practice. In DevOps, security is usually thought of afterwards, and the execution time in the process is too late (if any). Then, possible substantial emergency changes required to resolve the vulnerability will result in delayed release. Proactive organizations are using advanced workflow planning and management tools such as Kanban to model, accelerate development, and eliminate inefficiencies. In addition, security teams are increasingly breaking down applications into microservices to simplify security checks and changes.
Take an active safety approach. Throughout the entire life cycle of an application, strict security measures should be taken to reduce vulnerabilities, improve security, and reduce risks. Good DevOps safety and health habits include:
Comprehensively address security requirements and potential vulnerabilities, because an attacker may only need to exploit one vulnerability to perform a task.
Reduce the concentration of privileges in building automation tools and ensure that code repositories do not reveal secrets.
Keep secrets used by machines and personnel (passwords, certificates, API keys, tokens, and SSH keys) in a secure, highly available repository-away from source code, and do not store on developer laptops and users Access to the storage system. Rotate secrets regularly to minimize exposure.
Apply the principle of least privilege to ensure that machines and personnel can only access resources they absolutely need.
Establish a baseline for normal usage patterns to detect anomalies in order to track malicious users and cannot steal credentials.
Divide responsibilities by recording how the credentials are used. For example, for human users, consider the keystrokes or video recording of the session.
Provide a unique identity for each computer to audit and monitor access to secrets.
Run vulnerability scans and conduct penetration tests to improve
network security.
Educate developers about security threats and best practices.
Promote close cooperation and collaboration between security and development teams.
Automate security processes. DevOps uses automation to accelerate application lifecycle management and eliminate personnel waiting time. Similarly, DevOps security should use automation to minimize human-computer interaction and manual intervention. For example, by automatically rotating secrets (passwords, keys, certificates), organizations can prevent attackers from accessing DevOps tools, access keys, or systems for long periods of time. If a leak is detected, the automatic safety program can also be used accordingly. For example, a privileged session can be automatically terminated after a security breach is identified, and credentials can be rotated automatically.
