devopsy.kinsta.cloud

Tag: encryption key management

  • Securely Streamline Code Signing for DevOps and DevSecOps

    Securely Streamline Code Signing for DevOps and DevSecOps

    Introducing code-signing provides security within the application, but teams should take care to understand and implement the process effectively

    Digital certificate management, with hundreds or thousands of certificates required to support IT infrastructure, can easily lead to degradation of application integrity and unnecessary risk to the business. The cumbersome nature of siloed teams manually managing digital certificates often results in the bypassing of PKI standards mandated by their organization.

    Based on the complexity of their pipeline, DevOps and DevSecOps teams may issue certificates signed by an untrusted source and stored insecurely to speed up the build and deployment stages of CI/CD workflows to avoid a lengthy certificate request process, which could take weeks or even months. Using this manual, insecure cryptographic practice to sign and deploy code exposes organizations to a high level of avoidable risk.

    Code signing, and the certificates used in that process, should be centralized and automated using cryptographic hardware. Here we will walk through the process of hardened code signing and how to streamline its management in DevOps and DevSecOps pipelines.

    Hardened Code Signing in 4 Steps

    1. Unsigned code ready for distribution. Time to generate public-private key pair

    We start with an unsigned executable that is ready for distribution. To securely sign the code, the code publisher needs to generate a public-private key pair. This is required by most runtime architectures, including Windows, Java and others. The most secure way to generate code-signing keys is by using a FIPS 140-2 Level 3 validated hardware security module (HSM).

    1. Submit public key and Certificate Signing Request (CSR) to an issuing certificate authority (CA)

    With the key pair generated in step No. 1, the CSR is generated and submitted to an issuing CA. The CSR contains information that identifies the publisher and signature algorithm, as well as the digital signature. This information is used by the issuing CA to issue the code signing certificate.

    In some situations, such as with internet of things (IoT) device manufacturing, the organization may decide to act as its own Issuing CA.

    1. Identification of publisher and authentication of CSR

    The Issuing CA verifies the code publisher’s identity then authenticates the CSR, ensuring the publisher has digitally signed it. If both identification and authentication are successful, the Issuing CA packages the publisher’s identity with the public key then signs the package, creating the code-signing certificate.

    1. Ready to sign. Determine the level of security

    Now that the code-signing certificate is ready for use, any executable can be signed and deployed unless further code testing or QA needs to occur. Enterprises, particularly fast-moving ones, often find themselves storing their code-signing keys on the code publisher’s local machine or server, an insecure method that can result in significant problems. Storing the keys on a local machine or server presents major security risks. The local machine could become compromised/stolen along with the code-signing keys, or a disgruntled employee could maliciously sign and deploy unauthorized code, which could go unnoticed for a while.

    It is best to import and store the code-signing certificate in a key management server (KMS), which stores the certificate behind a FIPS 140-2 Level tamper-resistant physical boundary. In addition to hardened storage, a KMS with proper cryptographic features and functionality can be utilized to help automate the entire code-signing and certificate management life cycle. A KMS allows DevOps and DevSecOps teams to seamlessly meet best practices while removing the manual workflow bottlenecks and natively integrating with CI/CD systems. Less time generating and managing digital certificates results in faster code deployments and an increase in team output.

    Streamline Continuous Integration

    There is tremendous value in using an HSM for secure key generation and certificate storage. Additionally, DevOps and DevSecOps teams can drastically reduce the manual labor required with continuous integration code builds. For builds requiring a defined and trackable workflow for signing, code signing with CI/CD integration can offer significant benefits.

    This workflow typically consists of a CI/CD system that is managing the build and signing request process, a centralized and secure key management server to manage all code-signing keys and perform the signing process, and an approval entity to govern the process by which code is signed in an authorized manner.

    When deploying a system like this, backed by a FIPS 140-2 Level 3-validated HSM, organizations can also introduce automation into the process. This means that instead of code signing being a manually driven step that introduces room for human error, it is natively incorporated in the code development and release workflow.

    Integration With Code-Signing Technologies

    KMS and HSM cryptographic devices that provide hardened key storage commonly integrate with popular code-signing technologies that conduct various tasks such as validating publisher identity and ensuring code integrity. For instance, organizations using SignTool.exe with Microsoft Authenticode can directly integrate with a KMS with full certificate management functionality. Other integrations and use cases include Java Jar Signer, RPM (Red Hat), Docker, and various IoT implementations. Beyond that, innovative organizations are looking at systems that can deploy more advanced code-signing workflows outside of the standard OS and runtime SDKs, to integrate more tightly with CI/CD systems.

    Integrating HSMs into DevOps and DevSecOps pipelines simultaneously improves workflow efficiency and supports other cryptographic operations across the organization.

  • Three Priorities for IT Operations Continuity During the COVID-19 Pandemic

    Three Priorities for IT Operations Continuity During the COVID-19 Pandemic

    The world has been turned upside down amidst the COVID-19 pandemic, and organizations that are trying to maintain best IT and security practices are faced with new challenges such as sudden remote workforces, increased COVID-19-related phishing and business e-mail compromise scams, and quarantine-imposed travel restrictions. 

    Are you facing disruptions in your workforce, limitations in the supply chain and up-ended disaster plans? You’re not alone. A recent survey, Critical Gaps in Business Continuity Plans: Exclusive Survey Results, reported that 62% of businesses surveyed have business continuity plans, but 48% said their plans only cover emergency operations for two to three weeks.

    With increased limitations affecting enterprises, what are the top three things organizations must prioritize for optimal security and minimal outages to aim for business as usual?

    Consider the Cloud

    If you have been considering the cloud for your IT and information security infrastructure, now might be the right time to explore all your options and make strategic moves. Eighty-three percent of enterprise workloads will be in the cloud this year, according to a recent LogicMonitor cloud study, and security hardware and applications will be no exception to that trend. The cloud can increase your capacity and facilitate remote access to vital business functions, especially now when redundancy and scalability are more important than ever. 

    For example, the cloud could be a temporary solution for a retailer whose existing payment processing infrastructure is overloaded and declining transactions as a result. It doesn’t replace their existing on-premises environment, but it augments it by adding on-demand scalability. This could cover a temporary surge in demand or stand in during a full-blown outage. Do you know whether your existing applications have cloud-based extensibility?

    Quite often, organizations aren’t aware of the cloud capabilities they can already utilize. During times of uncertainty, the cloud can be a good temporary approach and does not have to be a big expenditure. Organizations can pursue the cloud with a low commitment, month-to-month contract, and consider it more permanently at a later date.

    When moving workloads to the cloud, considering security is of paramount importance. Many public cloud providers such as AWS, Azure and Google Cloud Platform offer functions to help secure these workloads and applications, and one gaining a great deal of attention is encryption key management. All major public cloud providers offer methods for their users to self-manage the keys used to encrypt, decrypt, digitally sign,and validate data. This technology is known as Bring Your Own Key (BYOK) and is a high assurance method for letting organizations retain control of their own cryptographic keys even after moving to the cloud.

    Ensure Redundancy

    System failures are not an option in mission-critical environments, and redundancy will offer up backup to increase the reliability of your systems. Given the current COVID-19 situation, do you have backup resources that can continue to process data without interruption? What if your data center is out of service altogether? Do you have another that can keep your infrastructure operational? 

    As an example, let’s look at cryptographic key management. Numerous business applications offload private key storage to purpose-built devices known as hardware security modules (HSM). HSMs are tamper-evident, tamper-responsive servers typically certified to rigorous requirements such as FIPS 140-2 Level 3. A typical information security infrastructure may only have throughput requirements to justify a single encryption HSM that is partitioned to provide services to multiple business applications. But if this single HSM fails or must be taken offline, any application relying on it for cryptographic key management may also become unavailable. 

    In this scenario, the ideal data security infrastructure would comprise multiple HSMs along with at least one centralized management server, split between multiple geographically separated data centers. This example can be extended out to virtually any other type of IT hardware, but it is particularly important for resources representing a single point of failure, where their outage would have cascading impacts throughout your enterprise ecosystem.

    To mitigate these risks, talk to your vendors about data security and redundancy options; you might be surprised at their offerings. And consider more than just individual device outages, too. What if you can’t get into your data center? Taking a hybrid approach to infrastructure design, where you rely on a diverse set of tools to prepare you for a wide range of potential problems, will let you maintain the redundancy and high availability that your users and customers expect.

    Monitor Your Data Centers

    Now is the time to monitor your IT operations even more closely than usual to spot extremes and help with scalability and capacity planning. Can your infrastructure handle the increase of users and transactions? Are you accounting for handling higher volumes that come with an increasingly remote workforce? How would your organization handle a service disruption if you experienced an outage? Closely monitoring your IT and security resources to look for spikes and surges can guard against oversaturation and could help justify offloading workloads to cloud data centers.

    Malicious actors often ramp up their activities in times of crisis, specifically because they know that companies’ focus is otherwise occupied. Automated monitoring can greatly assist in preventing these types of attacks, but only if proper baselines and profiles are established. For example, looking at an enterprise cryptographic ecosystem, if a bank knows its HSMs are validating 10,000 PINs per second on average, and suddenly that number spikes to 100,000 per second, they should immediately investigate. Intelligent monitoring and health-checking technology is designed for these exact types of scenarios, as well as to identify infrastructure health issues so administrators can respond proactively rather than reactively.

    Your organization’s IT infrastructure and data security are depended on to be reliable, and your IT operations continuity effort needs to be prioritized now more than ever. Here’s to keeping your employees, and your IT infrastructure, in good health.

    — Ryan Smith