devopsy.kinsta.cloud

Author: Arick Goomanovsky

  • Implementing Shift Left Security in the Cloud

    Implementing Shift Left Security in the Cloud

    While ransomware has been the leading concern for enterprise security teams over the few past years, software vulnerabilities are nipping at its heels. The boom in cloud-based apps and services and increased digitization of work have been a boon for hackers, who are taking advantage of developers’ and DevOps teams’ attempts to work faster and smarter to keep up with demand. One estimate says that four out of 10 zero-day attacks carried out in the last decade happened in 2021 alone.

    Many things account for this increase. Developers are stretched and are reusing code, which allows for misconfigurations and vulnerabilities to reappear unexpectedly in different programs, and the use of multiple cloud services fragments security measures and reduces visibility into the code running many enterprise functions. This is why developers and security professionals alike are paying more attention to security throughout the software development life cycle (SDLC), particularly in the early stages.

    Shift Left Security Principles and Challenges

    The zero-day surge has led to an increased interest in shift left practices as a way to make security a priority in the development process. Shift left culture brings security into the equation much earlier in the software life cycle, before the software is deployed, rather than patch bugs after users report them. This preemptive approach helps head off vulnerabilities that can affect an application’s security posture unbeknown to its defenders.

    Shift left principles can also enhance security when developers build applications for cloud platforms—such as Amazon Web Services, Microsoft’s Azure or Google Cloud—where visibility into the proprietary code and security tools of the platform can be limited. In a shift left culture, DevOps embeds least privilege policies as part of the daily work on cloud workloads, to protect network infrastructure and avoid granting excess permissions on those workflows.

    For example, setting up role-based access control (RBAC) on Kubernetes containers enforces a least privilege model on those clusters and avoids excessive permissions that can lead to a breach, while removing admin credentials from continuous integration/continuous delivery (CI/CD) workstations shuts off hackers from using those pipelines as an attack vector.

    Shift left security is a great concept, but runs into hurdles in execution, mainly the internal conflict between development teams who want to move at the speed of business while security staff takes a more cautious approach. This leads to friction, with developers warning about access denials affecting their work and causing deployment delays, while the security analysts worry about data breaches caused by too many users with unchecked admin privileges.

    Working out this friction requires a mindset shift, where DevOps understands that security is part of the development process, and management can trust that developers have security in hand. This also requires tools and training to integrate shift left practices, such as platforms that can bridge the security needs of the CISO (by granting greater visibility into the network infrastructure code, for example) and the agility needs of the DevOps teams (by automating security guardrails and entitlements, for example). The ultimate goal is creating what is known as a DevSecOps model, bringing together development, security and operations into one agile, safe and efficient workflow.

    How to Adopt Shift Left Security on the Cloud

    Four best practices can help:

    ● Gain deep visibility: With enterprises often working in multiple cloud environments—and mixing public and private clouds into hybrid infrastructures—visibility into assets typically suffers, which makes getting a clear view of risk difficult. Being able to discover all identities, permissions, configurations and resources in the environment and all the access paths to specific resources can help build a contextual inventory of cloud assets to better manage them and carry out policy analysis.

    ● Prioritize risk: Risk management is a key practice of any security program, but the flood of alerts from multiple cloud providers and systems can overwhelm security operations centers, which are often short on talent and time. Automation tools can now search and prioritize risks across an entire cloud environment, from development to production, spotting problem combinations and alleviating the workload of sorting manually through alerts across multiple silos, freeing the staff to work on higher-priority mitigation and remediation tasks.

    ● Just-in-time access: Zero-trust architecture has become the standard to aspire for most security defenses, but it is often challenged by the difficulties of managing access privileges. Just-in-Time (JIT) access, granting limited-time revocable rights, is a useful tool for building a zero-trust security architecture and enforcing least privilege policies to maintain it. Technology tools that actively manage and monitor developer access to cloud environments, including a strong audit trail of privileged activity, give security a means to enforce JIT access and zero-trust in turn.

    ● Find and prevent vulnerabilities and misconfigurations: Infrastructure-as-code (IaC) has made software deployment in the cloud (much more agile and efficient with the use of virtual machines, containers, microservices, etc. However, security is often an afterthought both pre- and post-production when standing up cloud infrastructure. Organizations should scan code for security policy violations and other risks in order to mitigate flaws before they reach production and to detect and fix problems in production environments. With feedback and automated guardrails built into development workflows, DevOps and security teams can reduce security risks in their code.

    Like zero-trust, shift left is on its way to becoming a standard practice for cybersecurity assurance. But building a DevSecOps model takes more than good intentions. It requires practices, tools and training to execute that model, and a mindset of partnership across the enterprise and with outside cloud and security partners. Only a group effort will provide the cloud security assurance an agile business needs.

     

  • The Missing Link in DevOps Cloud Security

    The Missing Link in DevOps Cloud Security

    We’ve all seen the data from the latest Verizon Data Breach Incident Report that shows half of security breaches stem from credential abuse. It’s clear that credential compromise is an epidemic in cybersecurity and can be largely avoided with multifactor authentication and least-privilege policies. Misused credentials have shot up by almost 30% over the last five years, according to Verizon. Engineers and developers are not immune to this plague; they may be even more attractive to attackers because admin privileges allow access that reaches far beyond that of the everyday user. In fact, they are often granted always-on access when, in reality, they only need brief, intermittent access to get their job done. According to Gartner, privileged access carries significant risk. Even with PAM tools in place, the residual risk posed by users with standing privileges remains high. They recommend identity and access management (IAM) leaders implement just-in-time (JIT) strategies and, eventually, reach a posture of zero standing privileges.

    Giving engineers right-sized permissions with only the privileges they need to carry out specific tasks is especially important when these credentials are used to stand up or make changes to production resources.

    Just in Time for Developers

    JIT inventory management has been standard in many industries for decades. Especially in manufacturing, where factories can’t afford to have supplies sitting in the warehouse unused, assembly lines lying idle or have production at a standstill while waiting for parts. In information security, JIT management grants users privileged access for only the amount of time needed for a user to complete a task. This helps minimize the attack surface and avoid the risk caused by long-standing unrevoked privileges.

    In today’s agile environments, development engineers need to move and fix things fast. For example, cloud infrastructure environments are usually set up and maintained by DevOps and development teams via continuous integration/continuous delivery (CI/CD) pipelines. But developers sometimes also need direct, highly privileged access to production environments for more specific tasks.

    While static privileges that allow developers to perform day-to-day tasks are typically provided through the network’s IAM system, organizations often lack the ability to grant and revoke privileges dynamically for cloud environments. That’s because traditional on-premises privileged access management (PAM) and identity governance and administration (IGA) solutions don’t support cloud-native—and increasingly multi-cloud—infrastructures.

    Developers will always need quick, highly privileged access to sensitive cloud environments for activities such as debugging or manual deployment of a service. But those wide-ranging entitlements don’t need to be permanent and can introduce a significant risk if they’re not revoked once the job is done.

    This has left organizations resorting to risky, overprivileged practices. Inactive accounts are the source of many cybersecurity headaches. In fact, that is how cybercriminals breached the network of Colonial Pipeline in last year’s ransomware attack that shut off gas supplies. Overprivileged accounts are another big headache, which was a big factor in the now-famous SolarWinds attack.

    JIT Access

    This is where JIT access comes into play, and can enforce highly granular entitlement management for privileged access in the cloud. Gartner has become an advocate of JIT since it enables a number of security best practices. They recently advised security leaders to implement “a process for quick and easy requesting and granting of additional privileges with minimal disruption to an individual’s workflow.”

    One of the biggest challenges to implementing JIT privilege management is provisioning. Security staff is overtaxed, especially as the adoption of multi-cloud environments keeps adding complexity to their work. Provisioning individual, temporary permissions for each task becomes onerous when there is so much more to oversee.

    JIT privilege management for the cloud has to meet developers’ need for speed, self-sufficiency and transparency. One approach is to use a self-service portal that accepts requests for elevated privileges, manages the approval process, grants authorized permissions and automatically revokes them when they expire.

    A JIT Framework for Developer Security

    This framework provides security and productivity benefits.

    First, it minimizes the cloud attack surface by enforcing temporary and granular least-privilege policies. This prevents attackers that have compromised a user’s credentials from using excessive permissions to access sensitive resources and exfiltrate data.

    Second, it saves engineering teams time and effort by enabling them to quickly submit a request, notify approvers and gain temporary access. This automated workflow eliminates delays and allows DevOps staff to get their work done more rapidly and securely.

    Finally, monitoring user activity during elevated privilege sessions makes it possible to generate reports for all JIT access requests and authorizations to enforce security policies. It also creates an audit trail for forensic analysis in a security incident.

    When implementing a JIT framework for cloud privilege management, consider the following best practices:

    Look for tools that offer developers a seamless experience through a self-service portal. This saves everyone time by automating the submission, processing, approval and logging of access requests.

    Define owners for each step of JIT approvals including who manages eligibility, who approves the scope of access and who reviews requests.

    For low-risk access requests or those involving non-production environments, use policies that eliminate the need for human intervention. The system should be able to log requests, assess the stated reason for the escalated privileges and the timeframe and respond rapidly.

    Reducing the Attack Surface With JIT

    Giving DevOps staff unfettered access to sensitive resources, especially in production environments, for extended periods of time violates basic security hygiene best practices. JIT privilege management enables organizations to keep engineering activities on track and on time without incurring excessive risk. By reducing the attack surface associated with DevOps identities, even if a user’s credentials are compromised, a hacker will not have the keys to the proverbial kingdom. This will limit the blast radius of an attack.

    The challenge companies face is extending traditional privilege management capabilities to cloud environments. Fortunately, new cloud-native advances in IAM and PAM functionality are making it possible to close this missing link in cloud security.