SecDevOps in the cloud

Google Office
Claude Debussylaan 34
1082 Amsterdam
Nederland

DevOps is where any application starts. In today’s increasingly competitive world, the agility to be able to try things out quickly and move on without incurring upfront costs or facing delays while procuring hardware and integrating into your on premises environment is key to being successful. Multiple, disposable, and recreatable environments that are accessible around the globe are a must have for application lifecycle management. Configuration management tools that suits your environment, containers, and choice of development and continuous integration tools are just a few of the things that the modern developer expects to be at their disposal. Cloud Platform provides a cost effective platform that addresses these requirements and more for any development and test environment.

Enterprises are automating IT infrastructure and instituting DevOps methodologies to accelerate the pace of innovation. Traditional identity and access management solutions are not designed to natively support the unique security needs of DevOps workflows. Enterprises must introduce new systems and practices to support dynamic workloads, microservices and automated IT without compromising security or service velocity.
Since DevOps pipelines are fully automated and contain many different tools, platforms and resources, there are many secrets hidden in various locations throughout the pipeline. Attackers know where to look for secrets in these systems and how to exploit them. This is a huge threat surface with many potential open-doors for attackers.
Secrets embedded in app code pose an enormous risk. Secrets can be easily exposed, since there is no audit or control over who’s accessing them. Additional risks lie within the configuration management and used in the DevOps pipeline. As high consumers of secrets, these tools have become the new targets for attackers.

In the world of SaaS, agile and Continuous Integration/Delivery has and is being adopted quite widely. Development teams are now able to deliver and modify their releases multiple times a day using the Cloud’s flexibility and control while at the same time implementing the right techniques to develop quicker and better using agile and continuous integration/delivery. Traditional application security methods are not able to support these quick cycles. Four Simple Steps are presented to ensure secure coding as part of your Build Management process.