What DevSecOps Means for Your CI/CD Pipeline

The CI/CD (Steady Integration/Steady Deployment) pipeline is a serious ingredient of the DevOps recipe. As a DevSecOps practitioner, you should take into account the safety implications for this pipeline. On this article, we are going to look at key objects to consider with regards to DevSecOps and CI/CD.

The kind of CI/CD pipeline you select—whether or not it’s managed, open supply, or a bespoke resolution that you just construct in-house—will affect whether or not sure safety features can be found to you out of the field, or require targeted consideration to implement.

Let’s dive in

Secret administration to your CI/CD pipeline

Your CI/CD pipeline has the keys to the dominion: it will possibly provision infrastructure and deploy workloads throughout your system. From a safety perspective, the CI/CD pipeline must be the one solution to carry out these actions. To handle your infrastructure, the CI/CD pipeline wants the credentials to entry cloud service APIs, databases, service accounts, and extra—and these credentials must be safe.

Managed or hosted CI/CD pipelines present a safe solution to retailer these secrets and techniques. In the event you construct your CI/CD resolution, you then’re in control of guaranteeing secrets and techniques are saved securely. CI/CD secrets and techniques must be encrypted at relaxation and solely decrypted in reminiscence, when the CI/CD pipeline wants to make use of them.

It’s best to tightly lock down entry to the configuration of your CI/CD pipeline. If each engineer can entry these secrets and techniques, then the potential for leaks is large. Keep away from the temptation to let engineers debug and troubleshoot points through the use of CI/CD credentials.

Some secrets and techniques (for instance, entry tokens) must be refreshed periodically. CI/CD pipelines typically use static secrets and techniques—which have for much longer lifetimes, and so don’t want common refreshing—to keep away from the complexities of refreshing tokens.

Injecting secrets and techniques into workloads

Cloud workloads themselves additionally use secrets and techniques and credentials to entry different sources and companies that their performance is dependent upon. These secrets and techniques might be supplied in a number of methods. In the event you deploy your system as packages utilizing VM photos or containers, then you may bake the secrets and techniques instantly into the picture, making them accessible in a file when the workload runs.

One other strategy is to encrypt the secrets and techniques and retailer them in supply management. Then, inject the decryption key into the workload, which might subsequently fetch, decrypt, and use the secrets and techniques.

Kubernetes permits for secrets and techniques which might be managed outdoors of the workload picture however uncovered as an atmosphere variable or a file. One advantage of secrets and techniques as recordsdata is that secret rotation doesn’t require re-deploying the workload.

Infrastructure as code: a safety perspective

Infrastructure as code will not be solely an operational greatest observe; it’s also a safety greatest observe. 

software program methods = infrastructure + workloads

When advert hoc modifications are made to infrastructure configurations, this drift can introduce safety dangers. When sources are provisioned with none auditing or governance, it turns into tough to keep up correct safety measures throughout all sources.

Handle your infrastructure identical to you handle your code. Use declarative configurations (like these of Terraform, AWS CloudFormation, or Kubernetes CRDs). Overview and audit each change.

Deliver your individual safety instruments

CI/CD pipelines are versatile. Typically talking, they allow you to execute a sequence of steps and handle artifacts. The steps themselves are as much as you. As a safety engineer, it’s best to reap the benefits of the safety instruments that exist already in your atmosphere (particularly within the cloud). For instance, GitHub and GitLab each scan your commits for the presence of secrets and techniques or credentials. Some managed CI/CD options construct in API scanning or software safety scans. Nonetheless, you might also desire so as to add instruments and checks into the combination.

You could possibly additionally add static code evaluation (like SonarQube) to make sure that code adheres to conventions and greatest practices. As one other instance, you mayincorporate vulnerability scanning (like Trivy or Grype) to your CI/CD pipeline, checking container photos or third-party dependencies for safety flaws.

Complete detection and response

Utility observability, monitoring, and alerting are elementary DevOps Day 2 considerations. Though your CI/CD pipeline will not be instantly concerned in these actions, it’s best to use your CI/CD pipeline to deploy the safety instruments you utilize for these functions. From the standpoint of the CI/CD pipeline, these are simply extra workloads to be deployed and configured.

Your CI/CD pipeline ought to embody early detection of safety points that set off on each change that impacts workloads or infrastructure. As soon as modifications are deployed, you should run periodic checks and reply to occasions that occur post-deployment.

In case of defective CI/CD, break glass

The CI/CD pipeline is a crucial a part of your system. In case your CI/CD is damaged or compromised, your software could proceed to run, however you lose the flexibility to make protected modifications. Massive scale purposes require fixed updates and modifications. If a safety breach happens, you want to have the ability to shut down and isolate elements of your software safely.

To take action, your CI/CD pipeline should be extremely accessible and deployed securely. Each time you should replace, rollback, or redeploy your software, you rely in your CI/CD pipeline.

What must you do in case your CI/CD pipeline is damaged? Put together prematurely for such a case, figuring out how your staff and system will maintain working (at diminished capability probably) till you may repair your CI/CD pipeline. For classy methods, it’s best to have runbooks. Take a look at how you’ll function when the CI/CD is down or compromised.

Conclusion

The CI/CD pipeline is on the core of the DevOps course of. When including safety into the combination, you want to pay attention to the implications, paying shut consideration to the safety of the CI/CD pipeline itself, in addition to the secrets and techniques and artifacts it consumes and produces. The safety features best suited to you’ll be those that match the kind of CI/CD pipeline you’ve chosen. As soon as the important thing areas to contemplate with regards to DevSecOps and CI/CD, you may make that tailor-made choice with confidence.

Subsequent

Dive deep into CI/CD pipelines on the Cisco Developer weblog after which discover DevNet’s CI/CD Sandbox.

Share: