For SaaS companies and other organizations that build software in-house, performing cybersecurity risk assessment and remediation as part of DevOps is a recommended best practice. According to NIST, Development Operations (DevOps) is “a set of practices for automating the processes between software development and information technology operations teams so that they can build, test, and release software faster and more reliably.”
DevOps Security adds preventive cybersecurity measures to DevOps that are performed while developers write and update multiple code versions. This article will identify some best practices to help you deliver more reliable software apps.
Striving for Continuous Compliance in DevOps
Continuous compliance is the ongoing monitoring process for compliance with industry regulations and following cybersecurity best practices. Establishing a consistent release management process can help attain continuous compliance. Other steps include adding access controls to the code base, patching updates to software libraries regularly, and having a repeatable approach for adding new software features that meet customer needs and comply with relevant regulations.
Some of the recommended controls that support continuous compliance in DevOps include:
Multiple Environments – It’s essential to create several code environments; ideally, you should have separate development, staging, and production environments. Multiple code environments with an approval workflow for moving code between them provides a set of checks and balances.
Segregation Of Duty – clearly define the responsibilities of developers, approvers, administrators, and managers, and assign no more than one role per person. One set of permissions per person allows for easy auditing of changes. Requiring multiple roles and approvals whenever code is moved between environments or released to customers helps protect the codebase.
Authentication – implement strong authentication mechanisms, including multi-factor authentication (MFA), and require developers to change their passwords regularly.
QA Testing – ensure that your quality assurance process includes testing and performing vulnerability scans when moving code between environments to catch cybersecurity risks as soon as possible. Many organizations have incorporated secure code reviews and application security testing at specific points in their development process.
Key Management – use software keys to provide access to servers, and set an expiration date for each one.
Security Protocols – use the Secure Shell Protocol (SSH) during DevOps. SSH is a networking protocol that helps secure remote logins to a computer or server. SSH provides multiple options for strong authentication and protects communications security and integrity. Use a secure protocol such as SSH to safeguard any access to software code.
Encryption – Provide user encryption keys to protect sensitive customer or business data.
SaaS applications reside in the cloud and typically experience a significant volume of transactions from internal and external users. After the software is released, perform threat hunting regularly to identify unusual behavior and potentially malicious activities. Threat hunting includes conducting static scans, ongoing monitoring of logs from various aspects of the software infrastructure, and automated scans.
Conclusion
As we continue to see ransomware attacks and hackers exploiting vulnerabilities like Log4j, it is imperative to incorporate security early in the software development lifecycle. We contend that DevOps is the right place to introduce the cybersecurity discipline and processes to reduce risk. Although achieving absolute security is likely impossible, an organization should aim to implement practical controls that enable business operations and development operations to be conducted effectively and securely.
Software developers can lead the way by advocating for and implementing the security and privacy controls discussed above as part of DevOps. Unfortunately, some of our penetration tests and vulnerability scans have found vulnerabilities that could have been prevented if the DevOps team had performed secure code reviews during the software development process.
