Welcome!

Java IoT Authors: Yeshim Deniz, Liz McMillan, Zakia Bouachraoui, Elizabeth White, William Schmarzo

Related Topics: @DevOpsSummit, Java IoT, Linux Containers, Wearables, @CloudExpo, Government Cloud, FinTech Journal

@DevOpsSummit: Article

Integrating Security into #DevOps By @ScriptRock | @DevOpsSummit

Security John goes through a mental breakdown before finally understanding how to adapt and survive

Three Steps for Integrating Security into DevOps

The fate of CSO John in The Phoenix Project is a good parable for illustrating the dynamic and often conflicted relationship between Security and IT Operations. Security can either become a separate, obscure, and increasingly irrelevant group that everyone else resents-sounds pretty good, huh?-or it can be integrated into broader framework of the development cycle. Security John goes through a mental breakdown before finally understanding how to adapt and survive, but it doesn't have to be that hard.

Security and DevOps

Before the rise of DevOps, strong functional distinctions were supposed to help groups focus on their core competencies. Developers wrote code, operations provisioned and maintained infrastructure, and security found holes and worried about all the vulnerabilities they knew hadn't been fixed yet. This separation of knowledge, however, created inefficiencies. Problems that would have been cheap to fix during development became expensive once they had shipped.

The name "DevOps" can lead to the naive conclusion that it's just about bridging the gap between development and operations. DevOps is much more than that-it's a holistic approach to collaborating and sharing information across functions that makes everyone's lives easier and the business more successful. Or, as Mike Kavis observes, the goal is really just to be better. DevOps provides an umbrella term for a range of techniques that have worked for many people. Any way you slice, it, DevOps means thinking about making quality software quickly-and that definitely includes security.

1. Configuration Hardening

So where does security fit into DevOps? Insomuch as DevOps is associated with tooling, it has largely been about configuration management (CM). Chef, Puppet, Ansible, SaltStack, Docker-these tools commonly come up in conversations about "doing DevOps" because they abstract configuration state into versioned code. Since CM is already a well established and supported component of DevOps, it's as good a place as any to start. Activities like checking for compliance with best configuration practices and applying updates system-wide should be a natural part of the DevOps process.

2. Policy Driven Development

Rather than CM being handled differently by development and Ops-or handled by Ops only--CM with these tools (in theory) provide a means to collaborate on shared concerns. That's not always the case, of course. All too often CM tools become the domain of a specialized "DevOps team" that actually worsens your bus factor. But given that collaboration and shared knowledge is the goal, the same applies to security vis-à-vis CM. A useful model is that of policy driven development: publicly visible, executable documentation of what security compliance means for you. In the same way that test driven development means anticipating user acceptance testing, policy driven development means anticipating and addressing security requirements.

3. Visibility

Strong safety nets like effective rollback/failover plans enable teams to move faster because failures are caught immediately in low-risk environments. This is the philosophy of the Visible Ops Handbook-brakes don't make a car slow, they let it go fast. The same type of detective controls and system scanners that let teams safely adopt a DevOps deployment approach are also the most effective for traversing the harsh, unforgiving landscape of IT security. New vulnerabilities are discovered constantly, whether you're looking at open source or proprietary software. Rather than trying to create an impregnable barrier, gaining visibility into your system state allows you to effectively manage risk. Configuration monitoring should already be part of a DevOps approach. Applying it to vulnerability assessment increases security at a minimal cost.

Conclusion

When someone says you need DevOps, think about what that really means. If your goal is to check a box, then you can probably do whatever you want and say it's DevOps. If your goal is to improve service delivery to your end users, then a little extra planning for security contingencies is in order and can greatly increase your yield. It might sound paradoxical, but having stricter controls for quality-through CM, continuous integration, and configuration monitoring tools-will allow you to ship more frequently and reduce your vulnerability exposure.

More Stories By ScriptRock Blog

ScriptRock makes GuardRail, a DevOps-ready platform for configuration monitoring.

Realizing we were spending way too much time digging up, cataloguing, and tracking machine configurations, we began writing our own scripts and tools to handle what is normally an enormous chore. Then we took the concept a step further, giving it a beautiful interface and making it simple enough for our bosses to understand. We named it GuardRail after its function — to allow businesses to move fast and stay safe.

GuardRail scans and tracks much more than just servers in a datacenter. It works with network hardware, Cloud service providers, CloudFlare, Android devices, infrastructure, and more.

IoT & Smart Cities Stories
Bill Schmarzo, author of "Big Data: Understanding How Data Powers Big Business" and "Big Data MBA: Driving Business Strategies with Data Science," is responsible for setting the strategy and defining the Big Data service offerings and capabilities for EMC Global Services Big Data Practice. As the CTO for the Big Data Practice, he is responsible for working with organizations to help them identify where and how to start their big data journeys. He's written several white papers, is an avid blogge...
Nicolas Fierro is CEO of MIMIR Blockchain Solutions. He is a programmer, technologist, and operations dev who has worked with Ethereum and blockchain since 2014. His knowledge in blockchain dates to when he performed dev ops services to the Ethereum Foundation as one the privileged few developers to work with the original core team in Switzerland.
René Bostic is the Technical VP of the IBM Cloud Unit in North America. Enjoying her career with IBM during the modern millennial technological era, she is an expert in cloud computing, DevOps and emerging cloud technologies such as Blockchain. Her strengths and core competencies include a proven record of accomplishments in consensus building at all levels to assess, plan, and implement enterprise and cloud computing solutions. René is a member of the Society of Women Engineers (SWE) and a m...
Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life settlement products to hedge funds and investment banks. After, he co-founded a revenue cycle management company where he learned about Bitcoin and eventually Ethereal. Andrew's role at ConsenSys Enterprise is a mul...
In his general session at 19th Cloud Expo, Manish Dixit, VP of Product and Engineering at Dice, discussed how Dice leverages data insights and tools to help both tech professionals and recruiters better understand how skills relate to each other and which skills are in high demand using interactive visualizations and salary indicator tools to maximize earning potential. Manish Dixit is VP of Product and Engineering at Dice. As the leader of the Product, Engineering and Data Sciences team at D...
Dynatrace is an application performance management software company with products for the information technology departments and digital business owners of medium and large businesses. Building the Future of Monitoring with Artificial Intelligence. Today we can collect lots and lots of performance data. We build beautiful dashboards and even have fancy query languages to access and transform the data. Still performance data is a secret language only a couple of people understand. The more busine...
Whenever a new technology hits the high points of hype, everyone starts talking about it like it will solve all their business problems. Blockchain is one of those technologies. According to Gartner's latest report on the hype cycle of emerging technologies, blockchain has just passed the peak of their hype cycle curve. If you read the news articles about it, one would think it has taken over the technology world. No disruptive technology is without its challenges and potential impediments t...
If a machine can invent, does this mean the end of the patent system as we know it? The patent system, both in the US and Europe, allows companies to protect their inventions and helps foster innovation. However, Artificial Intelligence (AI) could be set to disrupt the patent system as we know it. This talk will examine how AI may change the patent landscape in the years to come. Furthermore, ways in which companies can best protect their AI related inventions will be examined from both a US and...
Bill Schmarzo, Tech Chair of "Big Data | Analytics" of upcoming CloudEXPO | DXWorldEXPO New York (November 12-13, 2018, New York City) today announced the outline and schedule of the track. "The track has been designed in experience/degree order," said Schmarzo. "So, that folks who attend the entire track can leave the conference with some of the skills necessary to get their work done when they get back to their offices. It actually ties back to some work that I'm doing at the University of San...
When talking IoT we often focus on the devices, the sensors, the hardware itself. The new smart appliances, the new smart or self-driving cars (which are amalgamations of many ‘things'). When we are looking at the world of IoT, we should take a step back, look at the big picture. What value are these devices providing. IoT is not about the devices, its about the data consumed and generated. The devices are tools, mechanisms, conduits. This paper discusses the considerations when dealing with the...