Download as PDF, PPTX
Uploaded byDevOps Indonesia
Securing DevOps Lifecycle
This document discusses securing the DevOps lifecycle with continuous trust. It provides an overview of DevOps and how security remains a challenge that impacts code and data integrity. It discusses how security and quality assurance teams must integrate with DevOps. The benefits of DevOps like speed, reliability, scalability and collaboration are described. It also discusses potential vulnerabilities in DevOps and how establishing a chain of trust across tools is needed. Hardware security modules and key management systems can help support security in DevOps tools that manage the CI/CD pipeline and infrastructure.
More Related Content
Similar to Securing DevOps Lifecycle
Securing DevOps Lifecycle
- 1. PAGE 1 DEVOPS INDONESIA PAGE 1 DEVOPS INDONESIA MuditoAdi Pranowo & Jevon Hura Dymar THALES Jakarta, 19 Januari 2022 DevOps Indonesia Meetup (ONLINE) Securing DevOps Lifecycle
- 2. www.dymarjaya.co.id Securing DevOps LifeCycle DevOpsIndonesia 51 - 19/1/2022 Mudito Adi Pranowo Product Manager PT Dymar Jaya Indonesia [email protected]
- 3. Pembicara • Pengalaman 13+tahun di kriptografi praktis untuk bisnis dan solusi keamanan data digital. • Spesialis pada desain dan implementasi keamanan data digital di Perbankan, Institusi Finansial, Fintech, e-Commerce, Pemerintahan, dan banyak lagi. • Product Manager & Marketing di Dymar. • Kontak: [email protected] Mudito Adi Pranowo
- 4. Profil Perusahaan PT DymarJaya Indonesia ● Visi: Trusted Partner in Data Security. ● Misi: SolutionProviding world-class data security solution with trusted local support. ● Berdiri sejak 1988, fokus di bidang Keamanan Data. ● Menyediakan dan implementasi solusi data security di Institusi finansial, perbankan, pemerintahan, manufaktur dan lainnya. ● Implementasi di lebih dari 80 bank di Indonesia. Alamat Kantor: Soho Capital @PodomoroCity, 31st floor, Suite SC 3102-3103. Jl. Let. Jend. S. Parman Kav. 28. Jakarta Barat 11470, Indonesia www.dymarjaya.co.id
- 5.
- 6. Technology Partner Dymar ●Thales merupakan Worldwide leader untuk solusi data protection. ● Mencakup solusi: encryption, advance key management, authentication dan key management. “Securing the world's most sensitive data for over 40 years” ● PT Dymar Jaya Indonesia >25 tahun partnership dengan Thales. ● PT Dymar Jaya Indonesia merupakan Platinum Partner dari Thales.
- 7. Securing DevOps LifeCyclewith Continuous Trust https://cpl.thalesgroup.com/resources/encryption/ securing-devops-lifecycle-with-continuous-trust- white-paper
- 8. What is DevOps? DevOpsis a set of practices and tools that enables teams to develop and deliver software applications faster and more reliably. DevOps, which blends the words “development” and “operations,” is a cultural movement that breaks down organizational barriers by bringing software engineers and operations managers together to deliver the best possible application user experience. “DevOps is a cultural and professional movement, focused on how we build and operate high velocity organizations, born from the experiences of its practitioners.” - Nathen Harvey , Developer Advocate, Google
- 9. DevOps and Security Whilethere are many business advantages to DevOps, security remains a significant challenge that impacts the integrity and trustworthiness of code, software builds, firmware, and data. As a result, security and quality assurance teams must be tightly integrated with DevOps to make the software development lifecycle both efficient and secure. Secure DevOps ensures the trustworthiness of code, finished software, and data throughout the DevOps lifecycle.
- 10.
- 11. Benefits of aDevOps Approach Speed Moving at a high velocity to innovate and adjust to changing markets is critical to business competitiveness. The DevOps model allows developers and operations teams to increase the frequency and pace of software updates, enabling a constant flow of new features. In fact, according to a study, top-performing DevOps teams deploy code to production 208 times more frequently than low-performing adopters. DevOps requires trusting that the code has not been tampered with and malware has not been introduced during the build process. Securing a fast DevOps pipeline relies on code signing, secrets management, container security, authentication, and IaaS/PaaS cloud security.
- 12. Benefits of aDevOps Approach Reliability DevOps deployments are more reliable and resilient, experiencing less downtime. In fact, skilled DevOps teams experience one-third of the failure rates of low-performing DevOps teams. Security, such as code testing and software composition analysis, are implemented early in the DevOps lifecycle to reduce the cost and time to address security bugs and breakdowns later in the delivery process. Manual and automated testing and software scanning tools require strong authentication, authorization, and access controls.
- 13. Benefits of aDevOps Approach Scalability DevOps models leverage automation and orchestration that allow teams to rapidly scale compute resources, load balancing, and application services. For example, infrastructure as code allows companies to manage development, testing, and production environments more efficiently and programmatically using APIs. Scaling DevOps deployments securely requires strong key management, PKI and certificate management, encryption of data-at-rest and data-in motion, authentication, and access controls.
- 14. Benefits of aDevOps Approach Collaboration DevOps promotes a culture of collaboration and sharing between the software development and operations teams. The use of common tools and shared goals allows teams to work together efficiently to develop and deploy. Trusted collaboration requires end-user and machine-to-machine authentication, roles-based access controls, and secure communications.
- 15. Securing DevOps andCI/CD Pipeline Securing the DevOps environment is critical to the success of business-driven digital transformation. Secure DevOps requires strong key management, certificate management, authentication, PKI, access controls, code signing, and signature verification to ensure the trustworthiness and integrity of software, VMs, and containers.
- 16. Securing DevOps andCI/CD Pipeline While DevOps teams can use dynamic and static application security testing to check the code and binaries for misconfigurations or the presence of known vulnerabilities, if the system does not have a consistent and centralized approach to key and certificate management, the DevOps configuration management and orchestration tools will be very difficult to trust. For example, if the signatures used to sign code were created based on a self-signed digital certificate using keys that were generated insecurely, then a sophisticated and persistent attacker could impersonate the author of the code and potentially introduce malware. Similarly, if the configuration management tools used to manage the CI/CD pipeline, IaaS infrastructure, Kubernetes clusters, and network encryption are using secrets, machine identities, certificates, and tokens that are based on insecurely generated private keys, then the deployed software and containers should not be trusted.
- 17. Potential Vulnerabilities &Risk in DevOps The rapid adoption of DevOps and DevSecOps has created a complex software development environment that is fraught with vulnerabilities and risks. Gaps in DevOps security can lead to application vulnerabilities that result in: • Code injections • Broken authentication • Using components with known vulnerabilities • Stolen machine identities, keys and certificates • Sensitive data exposure • Weak authentication • Insecure key generation and storage • Lack of a chain of trust • Man-in-the-middle attacks.
- 18. Establishing a Chainof Trust Across DevSecOps Establishing a chain of trust across the DevSecOps tool chain requires a consistent and centralized approach to key and certificate management. Development, testing, and production environments rely heavily on machine identities, secrets, tokens, keys, and digital certificates that must be trusted. Hardware Security Modules (HSM) and Key Management Systems (KMS) are able to support advanced security features supported by DevOps tools that manage the CI/CD pipeline, cluster orchestration, TLS, and code signing.
- 19. www.dymarjaya.co.id Thank you DevOps Indonesia51 - 19/1/2022 Mudito Adi Pranowo Product Manager PT Dymar Jaya Indonesia [email protected]
- 20. DevSecOps A Primer forOur Journey Together with Thales Data Protection Part of the Thales Data Security By : Jevon (SE Thales Cloud Protection and Licensing)
- 21. • DevOps ISNOT • a single person “Shaun and Mary are NOT, themselves, DevOps” • a specific role “Melissa was hired on as the DevOps person” • a separate team Now that we have developed the app, we give it to the “DevOps group” to do their part • a toolset Our manager just approved that “DevOps application”. We are now DevOps! What is DevOps?
- 22. • DevOps IS •a Culture of Collaboration • Developers + Operations working together • Automate processes between them • From Build to Test to Deployment to Monitoring and Alerting • High Consistency • High Quality • a process of Continual Improvement • through Automation • through Monitoring • Compatible with Enterprise deployments as well as Cloud deployments What is DevOps?
- 23.
- 24.
- 25. Thales © 2019All rights reserved USE-CASES DevSecOps
- 26. 7 7 Modern Solution Architecture VaultCredentials No Solution Hardcode Credentials Secretless Broker Architecture Isolate Applications Secure – manage credentials in vault with comprehensive audit Simpler – Developers can focus on writing code More Secure – Applications cannot leak what they don't have UserName = “app” Password = “y7qeF$1” Host = “10.10.3.56” ConnectDatabase(Host, UserName, Password) At Risk – Widely exposes credentials Potential for App to Leak Secrets Solution evolution
- 27. 8 CipherTrust Manager Encryption, using RESTful APIs Container Accessusing the key stored in Conjur Conjur Server Encryption Secretless Broker
- 28. 9 What’s Possible CipherTrust Manager OpenSSLEngine PKCS #11 REST, KMIP, Java, C, .NET, PKCS #11 OpenSSL Engine/PKCS #11 REST, KMIP, Java, C, .NET, PKCS #11 PKCS #11 OpenSSL Engine PKCS #11 Discovery and Classification Transparent Encryption Database Protection Application Data Protection Tokenisation Enterprise Key Management Cloud Key Manager REST, KMIP, Java, C, .NET, PKCS #11 Luna 7 HSM
- 29. 10 Working Together Proven securitysolutions that protect data to the highest levels FIPS 140-2 Level 3, Common Criteria EAL 4+ Proven integrations and patterns with RedHat and CyberArk to reduce “Technical Debt” Trusted Kubernetes for the enterprise, Kubernetes-native runtimes Automation capabilities for organisation-wide adoption Identity Security and secrets management for the enterprise Secretless brokering for containerised applications
- 30. 11 Establishing a Chainof Trust Across DevSecOps
- 31. 12 Thales DevSecOps EcosystemPartners
- 32.
- 33. Stay Connected WithUs! t.me/iddevops DevOps Indonesia DevOps Indonesia DevOps Indonesia @iddevops @iddevops DevOps Indonesia Scan here
- 34. PAGE 34 DEVOPS INDONESIA Alone Weare smart, together We are brilliant THANK YOU ! Quote by Steve Anderson