Security as Code: A Smart Solution to a Complex Endeavor
Security as code gives pragmatic meaning to the concept of DevSecOps. By embedding security throughout your SDLC, security controls can be automated and consistently applied. As the use of infrastructure as code accelerates, this automated approach to security policies becomes a critical necessity to keep up with DevOps velocity.
Predefined security policies boost efficiency, and also allow for checks on automated processes to prevent any mishaps in the deployment process (like accidentally taking down the whole infrastructure due to misconfiguration in a staging environment).
Six security as code capabilities to prioritize
Francois Raynaud, founder and managing director of DevSecCon, said that security as code is about making security more transparent and getting security practitioners and developers to speak the same language. In other words, security teams need to understand how developers work, and use that insight to help build the necessary security controls into the SDLC—ones that accelerate development, not hinder it.
Developers want to create secure code,
but they’ve lacked the tools and practices to do so. By embedding security into the DevOps workflow, developers are finally empowered to resolve security flaws that they create, resolving them early when it is most efficient and before vulnerabilities can be introduced for exploit.
Here are six best practices and capabilities to build into your pipeline:
1. Automate security scans and tests (such as static analysis, dynamic analysis, and fuzz testing) within your pipeline so that they can be consistently applied across all
projects and environments.
2. Build a continuous feedback loop by presenting results to developers, allowing them to remediate issues while coding and learn best practices during the coding process. 3. Evaluate and monitor automated security policies by building checks into the process. For instance, verify that sensitive data and secrets are not inadvertently
shared or published.
4. Automate complex or time-consuming manual tests via custom scripts, with human sign-off on results for exceptions. Validate the accuracy and efficiency of test
scripts so that they can be replicated across different projects.
5. Test new code on every code commit.
6. Monitoring, both scheduled and continuous, should automatically surface vulnerabilities and simplify their tracking to resolution. A feature, such as GitLab’s
Security Dashboard, can improve visibility while simplifying efforts.
Once you have these six best practices in mind, your team can work toward becoming a well-oiled DevSecOps machine; along the way, security as code will inevitably become the smart solution within a complex endeavor.
Learn how we can help you use GitLab DevSecOps to move your organization forward, faster.
321 Gang | 14362 North FLW | Suite 1000 | Scottsdale, AZ 85260 | 877.820.0888 | gitlab@321gang.com
