Over a million developers have joined DZone.
{{announcement.body}}
{{announcement.title}}

Automating Security in DevOps: Combating No's With Chaos

DZone's Guide to

Automating Security in DevOps: Combating No's With Chaos

At All Day DevOps, DJ Schleen talked about security issues. Get some insights from his talk on utilizing DevOps methods to automate security.

· DevOps Zone
Free Resource

The Nexus Suite is uniquely architected for a DevOps native world and creates value early in the development pipeline, provides precise contextual controls at every phase, and accelerates DevOps innovation with automation you can trust. Read how in this ebook.

Traditional security has thrived in a culture of "no."

The Culture of "No"

We have all met that wall. And when those walls exist, people find ways around them. The workarounds make their lives easier. They implement what they think is best. Their efforts are not intentionally destructive, but can lead to unintentional vulnerabilities and, potentially, harm.

At All Day DevOps, DJ Schleen (@dschleen) tackled security issues in his talk, Automating Security in DevOps - Security in the Pipeline. While he studied physical architecture and design, he now works in software security architecture and is a DevSecOps Evangelist for insurance giant Aetna.

The culture of "no" is exactly the kind of culture DevOps is designed to improve, and, as DJ asserts in his talk, "DevOps is an unprecedented opportunity for security." DevOps provides a system to react quickly by supporting a continuous delivery culture and the addition of security controls into an automated environment.

Invest in People

DevOps is also about investing in people, improving the lines of communication between development, operations, and security, and automating where you can automate to give humans the ability to focus on what we do best. You maximize success with DevOps when you invest in people, which, in turns, also improves your processes and tools.

So, how do we change security from a culture of "no" to a culture of "yes" - or, perhaps more appropriately, "Yes, but this is what it looks like."

To start, DJ first looks at the underlying system and asks, "Is Agile 'agile' enough" to force this change. When his answer is "no," he knows it's time for DevOps.

Too often, Agile is just a collection of mini waterfalls. DJ states, "DevOps breaks the chain of waterfalls. With DevOps, you can get fixes out quickly and easily. No one has to come in on Saturday."

Building Security Into the DevOps Pipeline

To fully recognize the benefits of DevOps for security, DJ notes you must build security into the pipeline, automate wherever possible, and have security professionals code too. DJ outlines some goals:

  • Be a culture of yes and working together.
  • Deliver remediation guidance back to developers.
  • Integrate security knowledge and secure coding practices into your DevOps teams.
  • Have security teams "get hands dirty" by coding.
  • Don't just automate the scan button.
  • Pass software through well-defined and automated gateways where guardrails sre in place to assess code security without decreasing velocity.
  • Utilize automation to stop or pause the delivery pipeline when critical vulnerabilities are detected or manual intervention is necessary.
  • Utilize automation to provide actionable remediation guidance.
  • Remember software after production deployments.

Chaos in Your Comfort Zone

What are some practical techniques DJ recommends? First, introduce chaos.

Chaos is a matter of stretching your comfort zone. DJ recommends going beyond traditional monitoring. Consider:

  • Randomly take containers down.
  • Explore holes in your development practices.
  • Unleash random hell on your infrastructure and applications.
  • Continuously review the stability and resiliency of your systems.
  • Execute attacks in production.

DJ digs into the details of each of these techniques, but, in the end, it all comes back to introducing chaos to improve your preparedness for attacks and your understanding of the entire system.

Of course, this approach has challenges. DJ mentions selecting the right toolsets, tailoring the people, processes, and tools to unique environments, teaching old dogs new tricks, having multiple "flavors" of DevOps, and making KPIs and indicators actionable.

Don't Go the Road Alone

To dig into the details with DJ, watch his full talk for free here. Then if you have any questions, ping him on Twitter (@dschleen) where he is very active in the community. We all learn from one another, so don't go the road alone.

In the meantime, his takeaways are:

  • Don't fear deploying rapidly and often into production.
  • Always gather information in the form of KPIs and make them ACTIONABLE.
  • Support the organization with tools, techniques, and best practices.
  • Automate EVERYTHING.
  • Defects are defects - regardless if they are a code defect or a security vulnerability.
  • Code your infrastructure - eliminate access to physical or cloud-based machines.
  • Choose tools that interfere minimally with flow.
  • Introduce chaos to become a moving target.

If you missed any of the other 100 speakers at All Day DevOps, you can find their 30-minute presentations here.

The DevOps Zone is brought to you in partnership with Sonatype Nexus.  See how the Nexus platform infuses precise open source component intelligence into the DevOps pipeline early, everywhere, and at scale. Read how in this ebook

Topics:
devops ,security ,devsecops ,automation ,all day devops

Published at DZone with permission of Derek Weeks, DZone MVB. See the original article here.

Opinions expressed by DZone contributors are their own.

{{ parent.title || parent.header.title}}

{{ parent.tldr }}

{{ parent.urlSource.name }}