devopsy.kinsta.cloud

Tag: compliance

Puppet Adds CIS Benchmark Compliance Service

Puppet this week announced it has added a service that makes it easier to achieve compliance with benchmarks defined by the Center for Internet Security (CIS).

Yasmin Rajabi, global services strategy manager at Puppet, said the CIS Service offering from Puppet extends the ability to manage infrastructure as code into the realm of compliance. Via the service, analysts hired by Puppet will now scan infrastructure on behalf of customers and then generate a report identifying which machines do not meet CIS benchmarks.

The service also provides a list of the controls that pass or fail per node as well as scores intended to help IT teams triage issues, said Rajabi. If any drift from a previous level of compliance is detected, IT teams can then use Puppet tools to return those machines to a previous state, she noted.

The goal is to make available a service that automates what would otherwise be a time-consuming monotonous task internal IT teams normally would have to do themselves using scripts they would have to develop, she added.

Rajabi said Puppet decided to focus on CIS benchmarks because they are often considered foundational for any number of compliance mandates. Achieving CIS benchmark compliance is about 60% to 70% of the work that might be required to achieve mandates that are required in various vertical industry segments.

As IT environments become more complex many IT teams don’t have the time to manually assess their compliance with multiple mandates. However, because of audits many IT organizations wind up devoting a significant amount of time to compliance assessments. The CIS Service from Puppet offloads that tasks from IT departments in a way that produces reports that can be shared easily with an auditor, said Rajabi.

It’s not clear to what degree compliance is about to shift left along with cybersecurity. What is certain is in the wake of the COVID-19 pandemic IT teams will be looking to automate every process imaginable simply because there may be no other way to accomplish a task. Many IT organizations have already either frozen headcount or been forced to reduce the size of their existing IT staff. A service that outsources a compliance process to specialists that are better equipped to handle that task might be a timely alternative.

Whatever the motivation, most IT teams have no trouble finding ways to contribute to their organization that add a lot more value than achieving compliance. In fact, because most IT teams tend to give the compliance process short shrift because of other pressing demands on their time it’s likely mistakes will be made. Specialists who spend all their time on compliance assessments are likely to do a much better job in a fraction of the time. The challenge is making sure the IT staff doesn’t view that service as an existential threat to its existence. Of course, if they do, chances are high that the IT team in question has much bigger issues to address than simply making sure the right compliance report is being generated at the right time.

May 21, 2020
Despite Downturn, Enterprise IT Budgets Remain Intact

A survey of 137 IT operations leaders at companies in the U.S with at least 500 employees and an annual IT budget in excess of $5 million finds a surprising amount of resiliency at the beginning of the COVID-19 pandemic.

Conducted April 1 by OpsRamp, a provider of IT operations tools, the survey finds more than half of the survey respondents (58%) said they expect to either significantly or moderately increase their annual technology budgets, while 38% plan to either significantly or moderately reduce their technology spending.

The survey also finds 73% of respondents expect to either accelerate or maintain digital transformation initiatives and projects.

Bhanu Singh, senior vice president of engineering and DevOps for OpsRamp, said that at least for now among larger enterprises, digital business initiatives are being accelerated as organizations recraft their business continuity plans. With most customers and employees working from home, the need for applications that digitize business processes has become more critical, especially since no one knows for sure when the COVID-19 pandemic might subside or whether there will be another one, he said.

Many of those projects will rely on cloud-native technologies that make it easier for organizations to scale IT resources up and down, added Singh, noting organizations are quickly discovering that monolithic applications even when they are deployed on a public cloud are not as flexible as they now require.

Specifically, the survey finds IT leaders are investing heavily in AIOps (69%), information security and compliance (62%), self-service platforms (60%), cloud-native observability (51%), network performance monitoring and diagnostics (51%), big data analytics (46%) and cloud infrastructure (45%).

IT leaders are also planning to drive technology vendor consolidation (59%) to reduce costs and rely more on third-party managed service providers (58%).

In terms of hiring, IT financial analysts (68%), cloud architects (53%), DevOps engineers (50%) and data scientists (47%) top the list of priorities.

Of course, as the impact of the COVID-19 pandemic on the global economy becomes more apparent it is too early to say what the impact on IT budgets will be. Industry analysts Gartner and International Data Corp. (IDC) are forecasting a relatively small decline in IT spending of about 5% for the year once the economy begins to recover in the second half. However, it’s clear that certain vertical industry segments, such as travel and hospitality, might have a much longer way to go than, say, healthcare companies.

In addition, it’s likely that much smaller companies than those surveyed by OpsRamp may find it more challenging to restart operations after being forced to lay most of their employees in some cases.

Whatever the timing, the one probable thing is many of the IT trends that were just beginning to gain traction are likely to see accelerated adoption once the economy recovers. There will be a natural tendency to limit the adoption of new platforms and processes in the short term. However, now that it’s clear existing platforms and processes are not especially flexible it’s only a matter of time now before most of them one way or will be replaced or at the very least completely modernized.

April 23, 2020
Embracing the Journey to Public Cloud

One of the fascinating competitions in today’s business world is the one between the digital disruptors—companies whose business vision is rooted in technology and driven by the cloud—and the so-called incumbents.

One sector where this competition is particularly intense is financial services. In this sector, the digital-first companies typically don’t compete with banks and other financial institutions directly. Instead, they target specific functions based on a clear—and often data-driven—understanding of what customers want. This strategy has proven particularly successful with millennials. For example, until recently the norm for giving money to a friend or family member was to write a check. Now, almost two-thirds of 20- and 30-year-olds use payment apps, such as Venmo.

In healthcare, a different pattern is emerging, one where digital-first giants either buy or innovate their way into the sector. Examples include Amazon’s billion-dollar acquisition of the online pharmacy PillPack and the new Apple Watch, which is capable of taking electrocardiograms.

Whatever the sector, digital disruptors have one characteristic in common. They leverage the capabilities of the cloud to the maximum extent possible. A shift in power toward digital-first companies is underway, and the cloud plays a major role in helping these companies establish themselves.

Many incumbents are just now taking their first steps on the journey to the cloud, and still working on the challenges involved in migrating their existing legacy applications to more scalable and agile public cloud environments. While they’re engaged in this process, digital insurgents are already exploiting the full potential of the cloud to deliver solutions that meet emerging customer needs associated with today’s evolving lifestyles.

In highly regulated industries, such as financial services and healthcare, major brands will not necessarily see an immediate decline in their customer base, nor profits. Nonetheless, digital-first companies are capturing millions of customers annually, and this growth poses a considerable challenge over time. Embracing the journey to public cloud is crucial for legacy enterprises.

The most successful cloud-based disruptors use experimental sandboxes as a critical component of development. The public cloud can drive progress toward almost any business goal involving IT—operational transformation, new market penetration, new product launches, automation.

Digital transformation to the public cloud is also the only way companies can leverage storage scalability and the essential innovations of the open-source community. There are still lingering concerns among executives in highly regulated, data-sensitive industries concerning privacy and regulatory compliance, and these can lead to hesitation. The face is, public clouds have been in place for over two decades now, and their security is often superior to older on-premise security. Incumbents can, therefore, tap into the public cloud to ensure safety for mission critical workloads.

To accelerate the transition to the public cloud, consider the following best practices.

Learning to Fail Fast and Learn from Experience More Quickly

The Silicon Valley maxim to fail fast may run counter to incumbent corporate culture, but it is the best path to success in the new digital reality. The key is being able to learn from failures quickly and adjust accordingly.

Partnering for Progress

A digital native approach to business is often lacking in the corporate culture of incumbents. Cloud partners that have a digital disruption in their DNA can play an important role in driving cultural renewal at every level of the organization. A reliable cloud service partnership can accelerate concepts, pilots, staffing and other mechanisms designed to deliver value quickly and securely.

Re-Examining Compliance Processes

Operations should be streamlined to transform enterprise IT to be well-suited for the cloud. Companies can apply artificial intelligence to supplement human intervention, and encourage cloud adoption among employees. First, building a solid foundation, then working your way up, enables businesses to make important changes that transform the enterprise into an environment that is compliant by design.

Successfully competing with digital natives means using the cloud to find new opportunities to streamline and better comprehend customer needs and behaviors. It also means being unafraid to change time-honored business practices. At the same time, in highly regulated and data-sensitive industries, compliance and security must be prioritized. Cloud transformation has quickly become vital for companies in all sectors and represents an essential foundation for future business success.

April 17, 2020
Achieving Full Disk Encryption and PCI Compliance

Full disk encryption (FDE) is a critical security measure in today’s modern networks. With data security being more critical than ever, many IT admins are wondering how they can enforce full disk encryption across their fleets of cross-platform systems. Many organizations are also subject to compliance regulations including PCI DSS, which require FDE as a part of their compliance requirements.

What is FDE?

Full disk encryption locks down a computer’s hard drive when said computer is powered off or at rest. If a computer with FDE enabled is stolen, the only thing the thief will make away with is the hardware; the data on the system will be encrypted and very difficult to acquire.

FDE programs (BitLocker for Windows, FileVault for Mac) utilize a recovery key as a method of authentication. When a user logs into their FDE-protected system, the drive is unlocked using their associated username and password. But in case a user forgets their password, is locked out or the hard drive needs to be removed and accessed for any reason, an IT admin uses the recovery key to decrypt the drive. Given the crucial nature of recovery keys, IT admins need to store them in escrow; that is, securely stored and categorized in relation to the system it belongs to.

What is PCI?

The Payment Card Industry Data Security Standard (PCI DSS) is a compliance regulation that was created to ensure that credit card data is kept secure by companies that handle this critical customer financial information. PCI revolves around securing the cardholder data environment, or CDE, which houses all credit card information that passes through a company under compliance. There are 12 main requirements under PCI regulation, but Requirement 3 deals specifically with data encryption.

Using FDE for PCI

At its core, PCI Requirement 3 calls for installing proper security measures to protect data housed in the CDE. It is arguably one of the most important requirements for PCI altogether. FDE is an ideal way to ensure Requirement 3 compliance. By locking down at rest systems, IT admins can prevent unauthorized access due to a stolen laptop or hard drive.

In regards to encryption, Requirement 3 also demands that cryptographic keys are securely stored and maintained. Using recovery key escrow, IT admins can ensure that only the right people have access to cryptographic keys and also monitor when they’re used for access and who uses them.

How to Enforce FDE to Achieve PCI Compliance

When it comes to enforcing FDE across Mac and Windows for PCI compliance, IT admins might find that their options are limited. Many FDE tools on the market are only capable of enforcing either Bitlocker or FileVault—not both. Since many of today’s IT organizations are heterogeneous with regards to system platforms, an FDE solution that can only enforce one or the other simply won’t do and admins would rather not implement multiple solutions to reach the desired end.

Additionally, IT organizations need their FDE solution to securely store cryptographic recovery keys in escrow. This need limits the list of ideal FDE options even more. At the end of the day, with these requirements, there’s an excellent option that provides IT admins with a low overhead FDE experience suited for PCI compliance. Using JumpCloud’s Policies, IT admins can enforce FDE at scale across their Windows and Mac system fleets, escrowing individual recovery keys safely.

— Zach DeMeyer

February 14, 2020
Automation Hacks for DevOps Teams
DevOps teams are expected to do more work in less time. They need to plan, test, build, secure and release applications at a fast-paced rate. Of course, the DevOps team needs to achieve all of this while maintaining high software quality. This is why automation is a crucial part of the DevOps workflow. The goal is to delegate repetitive tasks to the machine, and free up dev time for more complex jobs.

Below are some helpful automation hacks you can apply to boost the effectiveness of your DevOps practices.

Automating Regulatory Compliance

Properly managing regulatory compliance is vital for many organizations to avoid fines and operate legally. Although compliance standards vary by industry, most focus on ensuring privacy and confidentiality. To meet these standards, companies must secure data and prove they are taking the appropriate measures. This proof is commonly accomplished with the maintenance of a clear digital trail.

You can use DevOps automation to log and store digital access trails for your protected data. You can also use automated testing and deployment to ensure that only code that passes compliance tests is deployed. This prevents compliance issues from being pushed to production and helps keep your data secure.

Automating Development Environments

DevOps workflows require frequent creation and elimination of environments, for testing, deployment and development. These environments can be created manually but it is more efficient to create environments automatically. This can be done using a golden image with your required configurations.

Using standardized base images ensures that you are working with consistent environments and standardizes configurations and privileges. These images can be used for local or remote machines and can be initialized automatically.

There are a variety of tools you can use to create and automate environment creation. Chef and Vagrant are two of the most popular. Both of these tools offer an accessible API and enable you to script automation using common languages and syntax.

Automating Code Review

Code review is an essential part of DevOps processes but it is also one of the lengthier and more tedious processes. Automation can help you perform this process more efficiently. Automatic code review works similarly to manual review except it is done using tools that integrate with development environments. These tools can check for styling, security, duplication, complexity and code coverage, and can auto-suggest corrections. Some popular tools for this automation include Codebeat, Code climate and Codacy.

Automating File Synchronization and File Uploads

Many DevOps and development teams use the public cloud for quickly spinning up development and test environments. However, what happens when the production environment, or other critical resources used in the dev/test process, are deployed on-premises? Having a fast, automated and reliable way to synchronize files between the on-premise data center and the cloud can save time and headaches.

There are a few approaches to synchronize files:
- Scripting file uploads and downloads. The most basic method is to use shell scripts and FTP or SFTP to upload and download files between local and cloud environments. However, this can be fragile, unreliable and difficult to scale.
- Using APIs of cloud storage services. You can move data to and from the cloud using cloud storage APIs, such as the Amazon S3 API, the Box API or specialized hosting services such as Cloudinary.
- Hybrid cloud. The ultimate solution is to create a hybrid cloud architecture where applications, developers and users view the local environment and the public cloud as one unit, and data is synchronized transparently in the background.
Collaboration Tools for DevOps Teams

There are a number of collaborative tools that teams can use to further boost gains from automation. These tools can help bridge gaps in automation and processes and ensure smooth workflows.

Slack: a chat tool that DevOps teams can integrate with automation tooling. It includes features for segregating discussions by topic, team or purpose; uploading shared files and documents; and initiating or receiving alerts from automated processes via integrations.

Jira: a tool that enables you to create and assign tasks. It includes features for scrum and kanban methodologies, unified reporting and backlog tracking. You can integrate it with many common DevOps tools, such as Jenkins.

Trello: a cloud-based Kanban board tool. It enables you to create project boards that can be shared across teams to track project progress. Through integrations, you can automate the updating of cards or initiate processes when cards are manually moved.

Asana: another cloud-based Kanban tool. Like Trello, it enables you to track and collaborate on projects across a team. Typically, when teams use tools such as Asana, they create multiple boards for different project aspects. These boards can then be viewed individually or from a central dashboard.

Conclusion

Hopefully, this article helped you figure out how to leverage automation for improved efficiency. There are many automation options for DevOps, including automated regulatory compliance, automated infrastructure, automated code review and automated file synchronization.

For DevOps project management, you can use collaboration tools such as Slack, Jira, Trello and Asana. Remember to make sure that any tool you introduce can be simply and easily integrated into your current environment. The tools of your choice also need to fit the skillset of all collaborators. For ease of use, keep your tooling ecosystem simple and minimalistic.

— Gilad David Maayan
February 13, 2020
Positioning Compliance as a Differentiator

As the threat landscape has become more perilous and complex, regulators have imposed a wide array of mandates designed to protect sensitive personal information. For most organizations, compliance is seen as the cost of doing business. However, if executed strategically it can not only improve a company’s overall security posture but shortens sales cycles and open the business to new markets.

In order to turn compliance from a check-the-box line item into a valued business initiative, businesses need to identify all global, local and industry regulations that apply to their business and, also, strategically implement the processes and technologies that keep them compliant. Whether you’re targeting specific industry verticals or going after international customers, entering new markets requires continuous education about the latest in compliance and regulatory standards as they relate to data privacy and security.

A good way to get started is to put together a roadmap for how you will get, and stay, compliant with the regulations relevant to your business. What follows is an outline of such roadmap.

Start with the Basics

When you’re building a house, a foundation is the key to a safe structure. This holds true for building a compliance roadmap for an IT infrastructure.

The first step is to ensure the infrastructure is configured in accordance with Center for Internet Security (CIS) benchmarks. If operating in Amazon Web Services (AWS), ensure all AWS best practices are met. Setting this foundation will help meet basic security and compliance requirements and will simplify the compliance journey from the very start.

Once the foundation has been set, it’s then time for the compliance, IT and security teams to determine which regulations apply to their business. This is the backbone of the compliance roadmap. The good news is that many of these regulations overlap so businesses can complete requirements for multiple regulations at the same time.

First Stop: SOC 2

As a component of the American Institute of CPAs Service Organization Control reporting platform, SOC 2’s goal is to ensure that internal IT systems are configured for maximum security, emphasizing the privacy of customer data. It’s specifically designed for service providers storing customer data in the cloud, and this means it’s becoming increasingly relevant as companies continue their cloud migrations. SOC 2 goes beyond a simple technical audit though, requiring businesses to establish and follow stringent security policies and procedures that encompass the security, availability, processing integrity and confidentiality of any data stored in the cloud.

In order to achieve SOC 2 compliance, the organization first will need to establish an understanding of what normal looks like in their environment. It’s critical to baseline typical activity in order to be able to monitor for anomalies. This enables detailed audit trails that allow for deep, contextual insight into root cause, allowing organizations to remediate issues and thus keep up with SOC 2 requirements.

The Roadmap Focal Point: GDPR

The General Data Protection Regulation (GDPR) brought compliance into the mainstream. When GDPR passed, it established strict regulations for how organizations with European customers must handle customer data. The regulation is so broad, stringent and complicated that it has motivated many tech companies to create new job titles to ensure compliance.

However, while there have been strict compliance regulations before, it’s the high financial stakes attached to GDPR that set it apart. A business can be fined up to 4% of its global revenue if it’s found to be non-compliant. Very few organizations can afford to take that kind of hit which is why so many make it the centerpiece to their compliance strategy.

The privacy implications of GDPR are extensive but one of the most important and challenging requirements is the data breach notification. Organizations must notify authorities or specific data subjects within 72 hours of a breach. Most organizations are unable to locate sensitive consumer information within their environment, making this requirement near impossible. However, if the organization bakes data controls into its systems and enacts continuous monitoring and real-time intrusion detection, it not only becomes achievable but improves internal processes.

Go Broad with Certification Add-Ons

Once you’ve done the basics, like SOC 2 and GDPR, organizations can then begin looking for compliance regulations that they can actually use as business differentiators. ISO/IEC 27001, for example, is a standard that SaaS organizations often use to demonstrate an aptitude for managing information security risks. The regulation formally specifies an Information Security Management System, a suite of activities concerning the management of information risks and lays out an overarching management framework to identify, analyze and address risks. Certification requires a host of documentation, including a clear information security policy, a risk assessment process and evidence of information security monitoring and measurement. The standard spans industry type, organization size and market, so it applies to just about any company.

Compliance can be a powerful differentiator and business driver that inspires trust and confidence amongst prospects, customers and external partners. Although the above standards and regulations require extensive resources, non-compliance can result in fines and other punishment that can cripple a company. It’s important to remember that these compliance standards and regulations may have to be revisited, but once put into place and assigned to a dedicated compliance team, the once daunting task pays for itself.

— Lindsey Hardy

February 6, 2020
How to Use DevOps for Compliance

Picture this: You’ve been working in an organization’s IT department for a couple of years and tasks have become quite a routine. Some documentation here and there, code reviews, end-user training, routine meetings with the developers and so on. You can do literally everything with your eyes closed.

Then, all of a sudden, the company is going public and you feel like you’ve been thrown into a different dimension. There are new procedures to follow, endless meetings to attend and a ton of paperwork to be shipped. And don’t forget the new compliance regulations.

When this happens, do you gamble and quit or stick around and accept the new reality? Is there a truly viable option?

In comes DevOps.

DevOps means different things to different companies. Some IT experts consider it a fad while others swear of its significance.

In many organizations, DevOps combines development and operations. With it comes automation, efficiency and more transparency. With DevOps, changes can be rolled out much quicker.

DevOps can be the silver bullet for organizations looking to keep up with HIPAA, GDPR, PCI SOX and other industry regulations.

Here are four strategies for using DevOps for compliance.

Keep Track of Documentation

A big part of compliance involves documentation. Yes, boring but critical. With a unified development and operations team, you can merge the documentation processes of those who release changes and those who make them. It’s also easier to get everyone on board when it comes to compliance requirements.

You can use the newfound synergy between dev and ops to avoid documentation bottlenecks by adopting a unified and trackable version control system. Tools such as Git, wiki pages and internal dashboards can be used to harmonize documentation and version control.

Make sure everyone is on board by conducting routine training and holding meetings involving both dev and ops personnel.

Leverage DevOps Automation

Part of the reason why DevOps has attracted so much attention is the automation it brings.

With DevOps, time-consuming tasks such as monitoring pull requests, internal audits, access controls, code reviews, failovers and code coverage can be optimized through a transparent, unified and automated system. For instance, you can link all deployments, code review and build results in a single process to streamline audits and daily operations.

DevOps automation not only helps to streamline internal processes but also in demonstrating that you have met all compliance requirements. Things like access control and failover/recovery processes can stifle your compliance efforts if they are not optimized through automation.

Streamlining Dev Workflows for Compliance

Most compliance problems stem from messy development workflows that are not helpful for those keeping track of updates. For instance, an update that is put into production without going through the normal stress tests or internal reviews is not helpful. With multiple teams working on different features during the development stage, it’s easy to overlook small updates that could potentially introduce vulnerabilities.

DevOps helps to prevent accidental compliance breaches emanating from flawed dev workflows. This is achieved through the integration of stress testing into the development process itself.

With DevOps, you don’t have to wait until an update is ready for production to stress test it. Working with a dedicated compliance team, you can create a compliance blueprint in the form of a testing and logging system to keep track of code that is still in the production stage way before it goes into production.

Foster a Compliance Culture

In a non-DevOps environment, it’s common for different teams or individuals to blame each other, refuse to take responsibility or be out of touch with processes that are not in their job description or assignment. To ensure compliance, a bit of team management is required through communication and culture development.

DevOps makes this process easier thanks to the improved inter-team dynamics, automated processes and increased transparency. It’s easier to merge the dev and ops teams to help identify potential trouble spots and ways of resolving them. The operations staff will not blame the developers when a disaster occurs if they were part of the entire process and vice versa.

Effective teams always take responsibility instead of looking for a fall guy or starting finger-pointing when something is amiss. Inculcate a culture of compliance in your teams by ensuring that they are all aware of what is required of them and their shared responsibilities.

From the above, it is clear that DevOps can be the only thing you need to ensure compliance in your organization. However, adopting multiple recommendations at a go can be challenging. Therefore, take it one step at a time and use available tools, such as Git, to implement some of these processes.

— Ken Lynch

January 15, 2020
CircleCI Achieves SOC 2 Compliance for DevOps Platform

CircleCI has achieved a SOC 2 compliance rating for the DevOps platform it makes available via a software-as-a-service (SaaS) model.

Tad Whitaker, security manager at CircleCI, said CircleCI is the first provider of a SaaS platform for DevOps that has invested the hundreds of thousands of dollars required to achieve SOC 2 compliance.

SOC 2 compliance requires organizations to pass an annual audit based on the Trust Services principles and criteria defined by the American Institute of Certified Public Accountants (AICPA). That criteria evaluate IT environments on everything from the cybersecurity controls they have in place to the integrity of the data management processes employed. A SOC 2-level certification means DevOps teams can have confidence in the fact that their data is being kept completely confidential, said Whitaker.

With interest in best DevSecOps processes on the rise, Whitaker noted more organizations are starting to ask questions about how data is managed and secured on the cloud services they rely on to build and deploy applications. Cybersecurity professionals who are now participating in those processes are starting to ask challenging questions. To address those concerns, Whitaker said CircleCI created a team within the company to first attain SOC 2 compliance and, now, maintain it.

That may lead to additional processes and controls being put in place, but DevOps teams can be confident that everything possible is being done to secure their data from prying eyes, including employees of CircleCI.

A lot of the data being employed to build new applications is among the most sensitive an organization is likely to possess. As organizations embrace DevOps practices to drive digital business transformation initiatives, there’s a much greater need to ensure the DevOps environment is secure end to end. However, most of the DevOps platforms delivered as a service today are not able to validate the level of security they claim to have put in place, said Whitaker.

It’s unclear how many organizations are going to insist of SOC 2-level certifications before agreeing to develop applications on a specific DevOps platform. However, SOC 2-level certifications are routinely required for cloud service providers so it’s only a matter of time before the same audit requirements are applied to other cloud services. The challenge will come when DevOps teams have to adjust their existing DevOps processes to accommodate the security processes that SOC 2-compliant cloud service providers are required to make.

In the meantime, the days when DevOps teams could employ cloud services to bypass cybersecurity policies are coming to an end. Cybersecurity teams are finally catching up in terms of figuring out how to enforce cybersecurity policies beyond an on-premises IT environment. Not every DevOps team may appreciate the impact those policies may have on productivity. However, if the alternative is to have sensitive data that DevOps teams are now being held accountable for exposed on the web because of careless processes than the time to come to terms with cybersecurity has finally come.

— Mike Vizard

October 31, 2019
Chef Achieves Multiple Compliance Mandates

Chef today announced it will make it easier for organizations that adopt its IT automation framework to stay compliant with mandates such as the Federal Information Processing Standards (FIPS), Secure Technical Implementation Guidelines (STIG) and the Center for Internet Security (CIS) certification.

John Snow, senior software development engineer and federal content lead for solutions engineering at Chef, said it’s incumbent on the provider of an IT platform or application to make sure their offerings comply with widely required mandates. FIPS compliance, for example, not only applies to federal agencies, but also any organizations that interacts with those agencies.

Specifically, Chef said it has achieved FIPS compliance along with providing an implementation of STIG profiles for RHEL 7 and Windows Server 2016 in Chef InSpec and achieving a (CIS) certification for Amazon Web Services (AWS) Foundations Benchmarks Level 1 and 2 in Chef Automate. Chef claimed it is the first vendor to achieve CIS certification across AWS, Microsoft Azure and Google Cloud Platform.

Snow said Chef was able to achieve that goal in part because of the time and effort it put into developing a parser that enabled the company to approach compliance as a programmable extension of its development process. That translation process is required because most compliance mandates are written for auditors by auditors, not by IT operations teams. Chef will also leverage that capability to ensure its platforms remain current with any future updates to the compliance mandates its supports, said Snow.

Chef has been making a case for treating compliance as code for several years now. Any given compliance mandate typically consists of a set of controls that need to first be put in place and then tested and validated. Rather than trying to achieve that goal relying on manual processes that don’t scale, Chef contends achieving compliance should become a natural extension of best-in-class DevOps processes.

It’s not clear yet to what degree compliance may become integrated within DevOps. But recent advances in DevSecOps suggest it’s only a matter of time before responsibility for implementing compliance controls “shifts left” along with security control. Compliance teams may define what controls will need to be put in place. But responsibility for implementing those controls as part of any quality assurance process is moving toward DevOps teams. Developers, however, will take on that responsibility only when a means to programmatically implement those controls is readily available.

The long-term economic implications of that shift may prove to be profound. Organizations of all sizes incur massive costs both implementing compliance controls and having them audited by a third party. As the compliance process becomes more automated, not only does it become easier to implement controls at scale, but the documentation required to pass an audit is generated automatically. Given that most auditors charge per hour for their services, the savings derived from limiting the time and effort associated with preparing for and then passing an audit could be substantial. The challenge and opportunity is educating the DevOps team on not just how much money might be saved for the company, but also how much of that money might be reinvested in advancing DevOps adoption.

— Mike Vizard

March 13, 2019
What It Really Takes to Build Compliant Apps

If you search online for “software compliance,” you’ll be met with a seemingly endless lineup of blog posts, how-tos and explainer articles promising to tell you everything you need to know about writing and deploying software in a compliance-friendly manner.

Some of those are good resources, especially the ones that delve into meeting specific compliance requirements associated with specific regulatory frameworks. (Articles that make generic recommendations such as “secure your data!” are less helpful, but I digress.)

In this article, I aim to contribute something new to the conversation about software and compliance, especially as it relates to modern, containerized, microservices-based environments. I’m not going to rehash all of the existing content about compliance best practices. Instead, I’d like to offer a new way of thinking about how you actually build compliant applications—by taking a DevOps approach to compliance.

What does that mean, exactly? Let me explain.

Why DevOps Compliance?

I know, when you hear a term like DevOps compliance, your first thought is likely, “Well, there’s another meaningless buzzword.”

But when I use that term, I’m thinking about much more than marketing hype. I’m referring to the actual practice of using DevOps processes as the basis for building compliance into your applications.

I’ll explain what that looks like in a moment. For now, let me explain why the concept of DevOps compliance matters.

For one, this concept drives home the truth that to create compliant applications, you need to make deliberate design decisions and follow specific processes for implementing them. This is what makes the concept of DevOps compliance, as I’m presenting it here, different from typical recommendations for achieving software compliance. Instead of treating compliance as something that you worry about once your application is written (or as a process that lives in its own silo, if you want to describe it in DevOps-y terms), the innovation behind DevOps compliance is to bake the compliance process into the rest of the software delivery pipeline, ensuring that the software that’s created is secure from the beginning of the development process.

Implementing DevOps Compliance

What does DevOps compliance look like in practice? How do you actually bake compliance into a CI/CD pipeline?

Involving Everyone in Compliance

For starters, you ensure that everyone who plays a role in software delivery understands what compliance means and which specific compliance requirements affect the software they are building. This is not often the case by default. Typically, compliance is something that your lawyers and security team know about, but not something your developers, software testers or IT Ops team members spend much time studying.

To do DevOps compliance, that has to change. Your engineers need not become compliance experts, but they need visibility into the specific compliance challenges that they must meet. They must also understand how those challenges change—as they frequently do, because compliance frameworks have a tendency to be updated regularly.

Tracking Compliance Across the CI/CD Pipeline

Second, achieving DevOps compliance requires implementing processes that allow you to verify and vet the state of compliance at all stages of the software delivery process. When developers are designing new code, they should be thinking about how that code can be compliant. When the QA team is testing the code, they should verify that it meets compliance goals. And when IT Ops deploys the code, it should monitor it to ensure that it is actually fulfilling compliance needs in production.

A third key process to implement is auditing across the software delivery life cycle. While the precise reporting and auditing requirements of software vary from one compliance framework to another, it’s a best practice to make sure that you are logging and able to report compliance-related data.

Auditing

The problem many organizations run into is that they think about the auditing challenge only when software is in production. To do DevOps compliance, you should be baking auditing into all stages of the CI/CD process by collecting data that demonstrates how you are working to meet compliance goals, and that measures your success in achieving them. This practice ensures that if something goes wrong with compliance, you have full visibility into where the issue originated and how to fix it, which are important considerations for meeting compliance challenges successfully.

Ideally, you’d never make a compliance mistake, but in reality, you probably will sometimes experience oversights. When they happen, it’s much better if you know exactly what went wrong and can quickly develop a plan for fixing it. That not only helps you avoid repeating the same mistake, but it can also help keep regulatory authorities happy. They tend to be more forgiving of compliance errors if you can show proactively (using your own auditing data) that you know what went wrong, and how you are going to fix it.

Conclusion

Compliance is not something that most developers or Ops engineers enjoy thinking about. In fact, it’s something that many of them don’t think about at all, and that’s a problem. But as software-related compliance challenges grow increasingly more complex, and as the consequences of non-compliance grow ever greater (both in terms of regulatory fines and a loss of reputation in the eyes of customers), compliance is something that all participants in the CI/CD pipeline should be supporting. They should be doing so at all stages of the software delivery process, and in a way that maximizes visibility into compliance efforts via a clear auditing trail. That’s what DevOps compliance looks like.

— Sonya Koptyev

December 20, 2018