devopsy.kinsta.cloud

Tag: DLP

Security Across the SDLC

We’ve seen some interesting movements in the security space over the last couple of years. My focus is on application security, but one of the movements we’ve seen is the blurring of what is application and what is infrastructure security, so I do a fair amount of that also. And then, with the advent of WAAP, we have network security playing a role in AppSec… It’s a growing snowball.

I will start with the mandatory happy declaration that DevOps no longer treats security as an annoyance. While we’re well past that, I think the shock of the whole “security is a problem, not protection” mentality that DevOps started with is still hanging with us, and some still actively believe that. But at this point, we’re well on the “Security is part of the process” trail we should be on.

If you look at the top-level changes, static application security testing (SAST) vendors have grown to be development security, covering SAST, DAST, IAST, RASP and even a bit of data security. Meanwhile, load balancers and WAF slowly evolved into full-on web applications and API security that covers the production side with active protections for things like DDoS and DLP.

Likewise, we’ve seen this with the growth of cloud workload protection and how the entire digital architecture is being pulled into CSPM.

I’ve said it before – we’re in a consolidation phase. It looks like it will go even further than I thought, though. Now, we are starting to see an interesting development: WAAP vendors are starting to include some or all of DAST, SAST and RASP. Arguably, they always did some IAST because their focus was on runtime protection, but their emphasis is more on protection than test, so it will be interesting to see that bit expand also.

And all of this includes an inconvenient fact. We don’t have any more people to do security than we ever did; in fact, we have less. That’s part of the reason that we haven’t shoved security everywhere – there aren’t people to do it. In true DevOps fashion, we have distributed the work across other teams – Dev is right there where code security and API security start, so we’ve implemented SAST and DAST bits right into the IDE, for example. Or Ops has always done some amount of security, and we’ve just upped the amount. But they don’t magically have more time, either. I’m sure you are feeling it if you are a practitioner; almost all of us are. AI promises to help with that, and in security, it will likely deliver. Another thing I’ve pointed out before is that security is one space that really does stand to gain from generative AI – in helping make more secure code, in helping make all the permutations of tests, in making rules based upon observed data and more. The time-saving benefits will deliver, in my opinion. But it’s still a lot of work, and some of it is straight-up additional work because we weren’t doing things like container security a few years ago.

In the short term, if full SDLC security is applied, there will be more work. In the long term, the mega platform for security may well reduce this work as it limits notifications across tools. Maybe we should name the coming mega platform SecArch. Also in the long term, AI will help alleviate some of the load. Until then, buckle in. You’re not likely to get staff to cover new work. But it will be worth it. Just keep plugging along, and know when to say you just can’t add one more thing to the pile.

January 31, 2024
Things To Do During Slow Times
We all know it happens in North America; once the U.S. Thanksgiving holiday hits, things start to slow down in IT—from vendor salespeople busy with family to coworkers out of the office in larger numbers. Since all regions and most religions have holidays clustered around the new year, the worldwide slowdown goes on for a good month and a half, sometimes—and in some locales—even longer.

And how we experience that slow time varies pretty widely. For some, it’s time to be completely off, like those coworkers. For others, it is time to finish those tasks that have been simmering on the back burner. For still more, it is a time of frustration as the things they’ve been working on grind to a halt. Back in the network computing days, we would do large, complex technical evaluations of the gear the vendors sold to enterprises. I covered mostly storage and servers with some security at the end, but my lab had more security, some software and some networking. We needed vendors to participate, and participation mostly meant traveling to our labs for any physical product, to set it up and let us test it. Needless to say, this slowed to a (sometimes frustrating) crawl as people reduced travel closer to the new year. I’ve felt that same frustration as an architect—when we couldn’t get vendors to respond and you really can’t blame them for doing the best they can in a time of seriously reduced staffing.

So, what can we do that doesn’t tie us to others who may or may not be available?

You know the list specific to you far better than I do, but here are some general suggestions to ponder. Most of these I have done during slowdowns.
- Learn that new language or framework. We all have one that the org is interested in, but in which we are weaker. Pick it up in those quiet hours; you can slap on headphones and focus with fewer interruptions.
- Same with new tools like test generators, DLP, GitOps or whatever your org is considering implementing. Heads down; figure it out in a test bed, and become at least versed and, at best, an SME.
- Clean up all that cruft you know you left behind over the past year. We’ve all got dead-end branches, stray text files, outdated bash scripts … Dynamic environments spew extraneous artifacts more than historically was the case. Take that time to go clean it up. I had a large script a couple of years ago that spun up a bunch of containers and ran tests. When I went to clean up, there were three different versions of the script and several orphaned containers still running. Good to get taken care of.
- Research, research, research. Whether it is something like reading a product’s site, checking crowdsourcing tools like G2 or looking at what some of the better/smarter analysts out there have to say, pick the tool you think would benefit the org, validate that it will and maybe even start documenting the use case and ROI justification (if you use ROI for consideration of new products; benefit analysis if not).
- Catch up. While generally the least fun use of this extra time on the job, it is often the most practical. We all have a ton of work, and sometimes the peace of mind that cranking out backlog offers is worth not doing the other things on this list.
- Take the time off. Seriously. Most of us (though no longer all of us) got into IT because we loved the technology and the promise. Walk away, take a breath and don’t even think about it for a week or two. Then, come back; I bet a bit of that wonder will return, making the job more fun and you more adaptable. It works if you can manage it. As others have said for many years, walking away and rediscovering a hobby can be invigorating, too.
Don’t sweat it, and don’t totally waste it. Figure out the best use of that time and move on it. There are a few spaces that simply do not slow down for holidays, and for those people, this blog is unlikely to be useful now, but at some point, slowdowns will arrive. I was a team lead at a tax software company. We slammed the holidays prepping for tax season, then got short weeks all summer. The mental checkout of teammates was similar to the end of year but delayed until early May. So we did all of this then.

But no matter what or when slowdowns happen, you’ve knocked out another year of keeping the org running. So, celebrate in some way; you deserve it.
December 13, 2023
At Some Level, We’re Doing Security Wrong

Years ago, right here in this blog, I pointed out that the worst of gamification was being applied to information security–play the game until you lose. I wish I could say we were past that, but we are not. And I think it is time for us to have a bit of a rethink (as my UK colleagues would say).

Consider this. Twenty years ago, breaches were relatively common and we were concerned enough to enact laws about data, security, etc. Today, breaches are relatively common. In the intervening years, we implemented more and more security.

The problem is that our environments—from mainframes to today—have grown increasingly complex. Our mission to make applications more useful and accessible makes them more vulnerable at the same time. And the changes are constant.

If we were doing this right, breach notifications would be super rare, and we’d all want to know if it was a broken machine or human at fault—kind of like aircraft crashes are handled and reported in most of the world. Instead, we go out to a site like haveibeenpwned to see if we’ve been impacted, shrug and assume that the free credit monitoring service from the last five breaches should have us covered financially, and we move along.

Internally, there is a post-mortem that closes whatever hole the attacker got through or exfiltrated data through and carry on, knowing full well that a different attack is coming.

We are currently staring longingly at the bright lights of AI, hoping it can protect us from unknown vulnerabilities going forward. A bit of critical thinking will make it obvious that this is simply keeping up with attackers who also have access to AI and are using it to refine and launch even more complex attacks.

The problem is that we all see the non-stop changes to attack vectors and architectures and don’t know how we could protect more broadly—and that is the appeal of trainable AI. We hope that it can rapidly generalize from its training to detect previously unknown attacks and, given enough inputs, can computationally detect attacks humans might miss in the sea of data. But that is still a point solution, in my opinion.

How attackers approach the problem and what tools (both tooling and vulnerabilities) they have available are constantly changing, but the goals are unchanged. And I think we have to adapt our thinking to address those goals instead. Policy enforcement is a step in that direction—but, again, that means we’re protecting against the known.

I don’t have the answers. I keep thinking of two approaches—airplanes are routed around a ton of threats to get their cargo to its destination safely, and that seems to be analogous to the problem. And hardened fortresses that literally ignore current mentality of “the perimeter is everywhere” and take the core, important bits of applications and lock them away even more tightly than we do today, with single-API access to a given bit and the API is monitored and analyzed constantly.

But those are both sweeping, drastic approaches, and that may be our problem. Security spaces are merging slowly, but we still have a largely “That’s ops, that’s dev” mentality in security (as just one example of why sweeping overall protections are problematic). So, maybe with merges, the time will come that this is naturally resolved. But we’re not there yet.

If you think about it, we’ve solved much more intractable problems, as the phone in your hand or the online game you enjoy spending a bit of time on demonstrate—we in IT and Dev are capable of amazing feats if we set clear goals and commit to both developing and implementing a solution. We just need those clear goals, and fighting today’s attack and hoping against hope another won’t come tomorrow just isn’t it.

October 4, 2023
What Are You Securing?

Every once in a while, I think it is important to look at the available technologies and tooling and ask, “What are we trying to do?” In the case of information security, we need to ask, “What, exactly, are we trying to protect?”

The answers to that question are seriously limited. Availability, reputation, data. Since reputation is a business mapping of the other two, that leaves us with availability and data. Of the two, data is more important. Our systems being down absolutely costs us money, but leaking customers’ private data or our corporate secrets, like source code or technology designs, is worse in the long run.

The problem with these observations is that if we are here to protect the data, and data is the more important piece of security, then why do we have far better application security than data leak prevention? Almost all of you have policies and processes to run an application through the wringer and get an “as secure as possible” result at the end. But data? The purpose of applications is to expose it. And in the process, we risk exposing too much of it or allowing tons of it out of a valid endpoint. I remember in the early days of login-based websites, there was a spectacular leak that let an attacker get hundreds of valid user credentials per page submission (there were a surprising number of these for a couple of years there; this one was at a college). We are facing much the same thing via APIs these days or even via pages meant to make access easier for users.

Locking all of this behind logins is a useful step, but to use one of the many phrases we’ve stolen from military science, it is only a part of ‘defense in depth.’

Once it is agreed that data is one of the two key things we need to protect, then the focus should be on how to do so. There are some amazing DLP products, both standalone and integrated into other technologies, that are worth looking into. There are also some great advances in automated response under the guise of AI/ML that should be watched closely because they are changing rapidly. Limiting the maximum number of responses allowed from a query is almost mandatory for application stability and for data leak prevention. And it isn’t that hard to implement.

I assure you that ne’er-do-wells—particularly state-sponsored and corporate espionage hackers, but also amateurs—are using AI to make attacks more successful and less detectable. The least you can do is respond in kind, with some of the tools that can now do things like notify you about low-and-slow data leak attacks.

Keep focused on what the goals are. Reiterate them often, and keep rocking it. That’s a lot of data splashing around the organization that your team is responsible for; make sure it’s as safe as possible.

August 23, 2023
Optimizing Security in Data Collection Processes

How you collect and process your data has a direct impact on the security of that data. By following best practices for data collection and processing, DevOps professionals can minimize the risk of data breaches and other security threats. In this article, we’ll share some best practices and tips for optimizing your data collection processes for better security.

Make use of rotating proxies

One way to optimize data collection processes is to make use of rotating proxies. This will help to prevent your IP address from being banned or blocked by web servers. Rotating proxies will also help to increase the anonymity of your data collection process.

Use a Secure Connection

When you are configuring data collection processes, it is important to ensure that all data is transmitted using a secure connection. This can be accomplished by using TLS/SSL encryption for all communication channels. This will help to protect your data from being intercepted by third parties and will also ensure that the data remains confidential.

Implement Access Control Measures

Another important way to secure your data is to implement access control measures. This means that you will need to restrict access to the data to only those individuals who need it. You can do this by using role-based access control or by implementing a least-privilege model. By doing this, you can help to prevent unauthorized access to the data while still giving different business functions across the organization access to the data and tools they need to do their jobs well.

Use Data Encryption

Another way to protect your data is to encrypt it. This means that the data will be converted into a coded format that can only be decrypted by authorized individuals. This can help to prevent unauthorized access to the data and can also help to ensure the confidentiality of the data. There are a variety of encryption methods available to you, including public key encryption and symmetric key encryption.

Make use of Data Loss Prevention Measures

Another way to protect your data is to make use of data loss prevention measures. This can help to prevent accidental or unauthorized deletion or modification of the data. Data loss prevention measures can include things like setting up auditing and logging, implementing data recovery plans and using access control measures.

Create Backup Copies

It is also important to create backup copies of your data. This way, if the data is lost or corrupted, you will still have a copy that you can use. You should store the backup copies in a secure location and you should encrypt them to help protect the data. The reason backups are such an important part of modern cybersecurity comes down to the threat of ransomware and the rise of cyberextortion.

Ransomware groups around the world have been increasingly targeting businesses of all sizes in recent years in an effort to extort money from them. And while some businesses have been lucky enough to avoid being targeted, others have not been so fortunate. The end result can be a total loss of reputation and even bankruptcy.

Monitor Activity

Another way to help secure your data is to monitor activity. This means that you will need to track who is accessing the data and what they are doing with it. This information can be used to identify unauthorized access and can also help you to determine if the data is being used appropriately.

Restrict Physical Access

It is also important to restrict physical access to the data. This means that you will need to ensure that only authorized individuals have access to the physical location where the data is stored. This can help to prevent unauthorized access and can also help to protect the data from being damaged or destroyed.

Destroy Data When no Longer Needed

When you no longer need the data, it is important to destroy it. This means that you will need to delete the data from all storage devices and ensure that it cannot be recovered. This can help to prevent unauthorized access and can also help to protect the data from being used inappropriately.

Implement Security Policies and Procedures

It is also important to implement security policies and procedures. This means that you will need to develop policies and procedures that govern how the data is to be used and accessed. These policies and procedures should be reviewed regularly and updated as needed.

Educate Employees

Another way to help secure your data is to educate employees. This means that you will need to provide training on the importance of protecting the data and on the procedures that should be followed. This training can help to ensure that employees are aware of the importance of security and can also help to prevent unauthorized access.

Employee education is your first line of defence against cybercrime because your people constitute your largest threat and cybersecurity vulnerability. This is not because of maliciousness or nefariousness, but simply because most people are not aware of many of the necessary cybersecurity best practices when it comes to data collection and handling.

Conduct regular audits

It is also important to conduct regular audits of the data. This means that you will need to review the data regularly to ensure that it is being used appropriately and that no unauthorized access has occurred. This can help to identify any security issues and can also help to ensure that the data is being used correctly.

Use encryption

As mentioned before, another way to help secure your data is to encrypt it. This means that the data will be converted into a coded format that can only be decrypted by authorized individuals. This can help to prevent unauthorized access to the data and can also help to ensure the confidentiality of the data.

Implement access control measures

Another way to help secure your data is to implement access control measures. This means that you will need to restrict access to the data to only those individuals who need it. This can help to prevent unauthorized access and can also help to ensure that the data is being used appropriately.

Conclusion

When it comes to data security, there are a number of steps that you can take to help protect your information. By taking the time to implement these measures, you can help to ensure that your data is safe and secure.

April 22, 2022