Security Implications for a DevOps Transformation
0 likes58 views
The document discusses the security implications of adopting DevOps practices, emphasizing the integration of security throughout the development and operations workflow. Key points include the importance of collaboration between development and security teams, the necessity of automation in testing and vulnerability scanning, and the challenge of maintaining security as changes are deployed quickly. Overall, it suggests that security must be an integral part of the DevOps process rather than an afterthought.
Security Implications for a DevOps Transformation
- 1. Security Implications of a DevOps transformation
- 2. Greg Sarjeant - Puppet - Manager of Professional Services - 20 Years in IT - Puppet user since 2012
- 3. Agenda ● Overview ● Technical baseline ● Implications for security Practical DevOps
- 4. Overview What do we mean by DevOps? Practical DevOps
- 5. Most DevOps conversation is loosely defined ● What DevOps isn’t ● Value proposition ● High-level characteristics — Fewer silos — Common tools — Tech closer to customers Practical DevOps
- 6. This makes it hard to quantify What are the impacts on security?
- 8. Disclaimer: None of the examples in this presentation are endorsements
- 9. Technical Foundation How did we get here? Practical DevOps
- 10. DevOps needs a “Hello, World”
- 11. Proposal Five Key Components ● Version Control ● Package Management ● Automated Testing ● Continuous Integration ● Infrastructure as Code Practical DevOps
- 12. Let’s start a company Keep it simple ● Get a host ● Install web server ● Write the app Practical DevOps
- 13. Initial development workflow ● Log on to production server ● Write the webpage Practical DevOps
- 14. Wait, there’s more than one language? Practical DevOps
- 15. Time for reinforcements Harry Hello Can say “Hello” in 57 languages Wendy World Can say “World” in 62 languages Practical DevOps
- 16. Complication 1: Collaboration ● Who owns the file? ● Is someone else editing it? ● How do I request a change? ● What changed last? Practical DevOps
- 17. Improvement 1: Version Control Authoritative source for application code ● File history ● Change tracking ● Conflict resolution ● Version rollback Practical DevOps
- 18. Version Control: Security Implications ● Attack vector ● Access controls — View code — Commit code ● Sensitive data Practical DevOps
- 19. Revised workflow ● Commit files to git repository ● Log in to prod ● Check files out Practical DevOps
- 20. Complication 2: Distribution ● No validation ● No dependencies ● Version management ● Dev tools on Prod servers Practical DevOps
- 21. Improvement 2: Package Management Atomic collections of related files ● Metadata ● Standard inspection tools ● Programmatic deployment tools ● Pre- and post- install tasks ● Uninstall/rollback functionality Practical DevOps
- 22. Package Management: Security Implications ● Installation is generally trusted ● Validate package integrity — MD5 sums Practical DevOps
- 23. Revised workflow ● Commit files to git repository ● Build package ● Log in to prod ● Install package Practical DevOps
- 24. Time to make the magic happen Let’s ship this thing…
- 25. Nice work, Harry. Practical DevOps
- 26. Let’s build a test server! Practical DevOps How about “Harry”? What do we call it? Test Prod
- 27. Complication 3: Validation Manual testing has weaknesses ● Slow: a person has to perform the steps ● Unreliable: people miss steps ● Late: can’t happen until after deployment Practical DevOps Test Prod
- 28. Improvement 3: Automated tests ● Fast ● Consistent ● Run early and often — Locally — On check-in — On deployment Practical DevOps
- 29. Automated tests: Security Implications ● Generally positive! ● Validate code, behavior ● Validate package contents Practical DevOps
- 30. Revised workflow ● Commit to git repository ● Invoke tests ● Build package ● Invoke tests ● Deploy to test ● Invoke tests ● Deploy to prod ● Invoke tests Practical DevOps Test Prod Tests Pass
- 31. Now we’re cooking with gas
- 32. Complication 4: Orchestration We’re just telling the computers what to do ● Manage code ● Run tests ● Build packages ● Deploy packages Practical DevOps
- 33. Improvement 4: Continuous Integration Continuous Integration Servers ● Define jobs ● Run tests ● Build packages ● Deploy apps ● Run jobs on target servers ● Chain jobs together ● Stop execution if a job fails Practical DevOps
- 34. Continuous Integration: Security Implications ● Single point of entry to infrastructure ● Elevated access to managed servers ● Arbitrary job execution Practical DevOps
- 35. All the pieces are in place Practical DevOps Test Prod I’ll take it from here
- 36. The test server just failed Somebody call the sysadmin!
- 37. Here I come to save the day Practical DevOps
- 38. Complication 5: Systems administration Practical DevOps
- 39. Progressively smaller anchors ● Run books ● Pile of shell scripts ● Golden images ● VM templates Practical DevOps
- 40. Improvement 5: Infrastructure as code ● Rewrite configuration instructions ● Interpreted by computers ● Managed identically to app code Practical DevOps
- 41. Infrastructure as code: Security implications ● Agents run as root on all servers ● Code is generally trusted ● Wide-ranging abilities — Package installation — Service reconfiguration — Arbitrary script execution ● Runs unattended Practical DevOps
- 42. Sysadmins join the pipeline Practical DevOps Test Prod
- 43. DevOps The directed use of automation to build a common workflow for developers and operations DevOps The directed use of automation to build a common workflow for developers and operations
- 44. But what about all those security questions?
- 45. Implications: Security Are DevOps and security mutually exclusive? Practical DevOps
- 46. There is a perception that DevOps is incompatible with strong security.
- 47. We feed this perception ● Emphasize trust over verification ● Purist mentality — If it interferes with efficiency, it’s not DevOps ● Security is an afterthought – deal with it in Production Practical DevOps Is security the new ops?
- 48. Security organizations have real concerns
- 49. Security concerns ● Financial protection ● Intellectual property ● Customer data Practical DevOps Compromises are costly and on the rise
- 50. Requirements of security organizations ● Rigor — Minimize opportunities to introduce vulnerabilities ● Visibility — Understand what has changed, so that effects can be evaluated ● Responsiveness — When a vulnerability is identified, remediate it as quickly as possible Practical DevOps
- 52. DevOps Strength: Collaboration ● Dev and Ops teams working together is a huge benefit ● Security often gets left out ● Stop throwing over the wall to ops, keep throwing over the wall to security Practical DevOps
- 53. DevOps Strength: Automation ● Fewer eyes and minds on the code ● Less consideration of concerns outside of direct application functionality — We’re only validating what we test Practical DevOps
- 54. DevOps Strength: Speed ● More changes introduced to production more frequently ● Less time to measure the impact of a change ● Often making updates before previous changes have been validated Practical DevOps
- 55. These aren’t fundamental flaws We’ve just been insufficiently inclusive
- 56. Collaboration: Include Security ● Design for security ● Assess security implications of changes in tickets ● Incorporate security patches into the delivery pipeline Practical DevOps
- 57. Automation: Automate tests and validation ● Trigger vulnerability scans on deploy to test — This can be expensive — Tie to deployment schedule, but leave time for remediation ● Build tests for security — System configuration — Package versions — Input validation ● Incorporate monitoring, logging — Install and configure servers and agents — Detect, repor, and alertt on anomalous behavior Practical DevOps
- 58. Speed: Accelerate remediation ● Use delivery pipeline to push OS patches to production ● Update, test, and deploy custom applications more quickly ● Use monitoring and logging to identify vulnerabilities and anomalous behavior more quickly Practical DevOps
- 59. Use the pipeline to our advantage Practical DevOps Test Prod