DevOps - risks are underestimated
Digital transformation requires a high level of agility and is driving the use of DevOps environments because DevOps offers accelerated innovation, greater flexibility and reduced complexity in application development and deployment.
With DevOps implementations, companies therefore primarily want to realize business benefits. However, they all too often neglect security in the process - a serious mistake, as DevOps in particular significantly expands the attack surface for cyber attacks.
When companies use DevOps models, more privileged accounts and access data are generated and shared automatically across networked business ecosystems.
Such access data - which has often been insufficiently considered and secured to date - includes service accounts, encryption, API and SSH keys, container secrets or embedded passwords in program code, which is often also stored in central repositories.
The additional privileged access data used, which is linked to people, services or applications, inevitably represents a lucrative target for an external attacker or malicious insider. After all, they allow complete control over a company's entire IT infrastructure.
The security risk for companies is further increased by the use of numerous orchestration and automation tools, such as CI (Continuous Integration) and CD (Continuous Delivery) tools or source code repositories such as GitHub in DevOps projects.
The challenge here is that the tools used in the DevOps toolchain, such as Ansible, Chef, Puppet or Jenkins, do not offer any common standards and companies therefore have to take individual, specific security measures for each tool.
In particular, the workflows for access control to privileged access data vary considerably. As a result, many companies have no, inconsistent or manual strategies for access control - security gaps are therefore pre-programmed and are sought out by attackers just as automatically as code is generated in the DevOps pipeline.
Successful countermeasures can only be taken with a dedicated DevOps security stack, and this is where IT security comes in. It must take a systematic approach to support DevOps teams in achieving a high level of security.
DevOps and security tools and practices must be integrated to establish efficient protection for privileged data. Close collaboration between DevOps and security teams is therefore the first step in successfully building a scalable security platform and implementing a DevSecOps strategy that can keep pace with the dynamic environment and rapidly evolving technology.
The administration of all DevOps tools and access data should take place under the umbrella of such a security platform. The central, automatic management and securing of all confidential access data used in a DevOps pipeline - such as encryption and API keys, database passwords or transport layer security (TLS) certificates - is of essential importance.
Of course, individual secrets are also managed here automatically and dynamically to secure access in DevOps production.
All access data used by machines, systems and people should be protected in a highly available and secure storage system (vault), a specially "hardened" server that offers reliable protection against unauthorized access with several different security layers.
