{"id":8308,"date":"2016-09-28T09:00:13","date_gmt":"2016-09-28T09:00:13","guid":{"rendered":"http:\/\/www.devopsonline.co.uk\/?p=8308"},"modified":"2016-09-23T14:42:48","modified_gmt":"2016-09-23T14:42:48","slug":"devops-without-a-security-sacrifice","status":"publish","type":"post","link":"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/","title":{"rendered":"DevOps without the security sacrifice"},"content":{"rendered":"<p><em>Kevin Bocek, Chief Security Strategist, Venafi, examines how to accelerate fast IT without sacrificing security.<\/em><\/p>\n<p>Earlier this year, Gartner research showed that\u00a0<a href=\"https:\/\/www.gartner.com\/doc\/3241517\/steps-manage-risk-security-bimodal\" target=\"_blank\" rel=\"nofollow\">60% of organisations<\/a>\u00a0are using or will soon use DevOps. Businesses are adopting bimodal IT \u2013 relying both on traditional (slow) IT and newer methods that deliver faster time-to-market and continuous improvement of business technology. DevOps, one of the most popular new philosophies, provides IT services quickly to support innovation and faster development of new features.<\/p>\n<p>There is no doubt that DevOps accelerates the deployment and rapid evolution of business technology and delivers numerous advantages such as:<\/p>\n<ul>\n<li>Faster response times to address market changes or customer requirements more quickly. Companies that have embraced a DevOps methodology increased their speed to market by 20%.<\/li>\n<li>Increased customer satisfaction through frequent product updates based on continuous feedback from users.<\/li>\n<li>Better operational efficiency due to automation, resulting in more than 60% of organisations adopting DevOps approaches.<\/li>\n<\/ul>\n<h2>Slow security processes challenging DevOps<\/h2>\n<p>However, as with every new technology, the rewards do not come without risks. In fact, nearly\u00a0<a href=\"https:\/\/www.venafi.com\/blog\/infographic-crumbling-cybersecurity-cios-are-wasting-millions\/\" target=\"_blank\" rel=\"nofollow\">80% of CIOs<\/a>\u00a0are concerned that DevOps makes it more difficult to know what\u2019s trusted and what\u2019s not. In order to maximise the speed of delivery of these services, it\u2019s not uncommon for DevOps teams to overlook security. This oversight can have costly consequences, including data breaches, application outages and failed audits.<\/p>\n<p>Let\u2019s look closely at one example of how DevOps is being challenged by today\u2019s slow security processes. Cryptographic keys and digital certificates comprise the foundation of trust and privacy. This foundation enabled explosive growth of the Internet in the 1990s and allows us to trust Internet-based transactions. Recently, cryptographic keys and digital certificates have expanded to include the cloud and the Internet of Things (IoT).<\/p>\n<p>Keys and certificates turn on private, encrypted communications and let us know that a website should be trusted over Hypertext Transfer Protocol Secure (HTTPS). Without them, any website could pretend to be your bank, favourite online store or cloud provider. They\u2019re used to connect applications, administrators and clouds over Secure Shell (SSH). Digital keys and certificates authorise digitally signed code to run on iOS and Android devices, Windows and OS X operating systems and even Boeing and Airbus aircraft.<\/p>\n<p>But the process to issue and deploy keys and certificates has historically been slow and complicated \u2013 the exact opposite of DevOps\u2019 goals and objectives. Getting trusted digital certificates can take days, not the seconds the automated and orchestrated DevOps environment expects.<\/p>\n<p>DevOps teams frequently \u2018engineer\u2019 their way around this problem. In some cases, DevOps teams use untrusted or unauthorised certificates like those freely available from Let\u2019s Encrypt or GoDaddy. In other cases, they don\u2019t use certificates at all. Either approach makes it more difficult to identify threats, and without HTTPS encryption, data is exposed to attackers. Complicating things further, if HTTPS is used, it\u2019s difficult for security systems to inspect encrypted traffic for threats and attacks.<\/p>\n<p>The open source community, like Lemur from the Netflix security and operations team, has found ways to make it easier for DevOps teams to use keys and certificates. But so far these attempts to improve the security of DevOps systems have only created new, more complex security blind spots.<\/p>\n<h2>Creative ways to empower DevOps<\/h2>\n<p>The question remains: How can enterprises reap the benefit of DevOps without exposing themselves to additional security risks? Solving this problem requires security teams to think differently \u2013 we need to build security into DevOps in a way that is fast and easy. In the same way Formula 1 engineers enable drivers to push the limits, security teams need to find creative ways to empower DevOps to go faster, without compromising security.<\/p>\n<p>Here are some tried and true best practices for keys and certificates that can help DevOps teams embrace speed without sacrificing security:<\/p>\n<h3>Automate: make it fast and easy<\/h3>\n<p>Organisations should implement procedures to automate the creation and distribution of keys and certificates for use with HTTPS and SSH throughout the build process so that DevOps teams don\u2019t have to do it themselves. Give DevOps a simple, easy-to-use API and bake it in everywhere. This approach allows IT security to eliminate keys and certificates kludges (aka \u2018re-engineering\u2019) and keeps data and applications safe and secure.<\/p>\n<h3>Maximise visibility to eliminate certificate-related outages<\/h3>\n<p>Customer satisfaction is an ongoing endeavour; one service outage and your customer satisfaction rating can plummet. Failure to renew certificates before they expire or improper configurations (as with the\u00a0<a href=\"http:\/\/www.crn.com\/news\/cloud\/300076751\/azure-nightmare-customer-suffers-9-day-intermittent-outage-gets-no-help-from-microsoft.htm\" target=\"_blank\" rel=\"nofollow\">Microsoft Azure outage<\/a>) can be costly. Service failures with applications using HTTPS can result in a downtime of up to US$1 million per hour for high volume services. In order to avoid unnecessary outages, make sure you are able to discover where all application certificates are being used.<\/p>\n<h3>Build for new: use a catalogue of recipes<\/h3>\n<p>For \u2018slow\u2019 IT applications, it\u2019s typical to spend up to 4.5 hours to provision each certificate manually. However, DevOps teams may need to deliver tens or even hundreds of certificates in a matter of seconds. It\u2019s possible to create \u2018recipes\u2019 \u2013 collections of automation driven through APIs\u00a0\u2013 to orchestrate all of the steps needed to use keys and certificates. Catalogues of recipes that work across development and orchestration environments are critical to making the provisioning of keys and certificates fast and easy and preserve cross-cloud compatibility and mobility.<\/p>\n<h2>Summary<\/h2>\n<p>A DevOps teams should never have to choose between agility and security. By implementing controls and automation for keys and certificates, it is possible to keep DevOps moving at the speed of business without sacrificing security.<\/p>\n<p>&nbsp;<\/p>\n<p>Edited for web by <a href=\"https:\/\/plus.google.com\/u\/0\/115822809293912579733\/posts\" target=\"_blank\">Cecilia Rehn<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Kevin Bocek, Chief Security Strategist, Venafi, examines how to accelerate fast IT without sacrificing security. Earlier this year, Gartner research showed that\u00a060% of organisations\u00a0are using or will soon use DevOps. Businesses are adopting bimodal IT \u2013 relying both on traditional (slow) IT and newer methods that deliver faster time-to-market and continuous improvement of business technology&#8230;.<\/p>\n","protected":false},"author":123458,"featured_media":8310,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","pmpro_default_level":"","footnotes":""},"categories":[2],"tags":[76,801,297,67,298,799,77,111,112,800,113],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>DevOps without the security sacrifice - DevOps Online North America<\/title>\n<meta name=\"description\" content=\"Kevin Bocek, Chief Security Strategist, Venafi, examines how to accelerate fast IT without sacrificing security.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"DevOps without the security sacrifice - DevOps Online North America\" \/>\n<meta property=\"og:description\" content=\"Kevin Bocek, Chief Security Strategist, Venafi, examines how to accelerate fast IT without sacrificing security.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/\" \/>\n<meta property=\"og:site_name\" content=\"DevOps Online North America\" \/>\n<meta property=\"article:published_time\" content=\"2016-09-28T09:00:13+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2016-09-23T14:42:48+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/devopsnews.online\/wp-content\/uploads\/2016\/09\/cyber-attack1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"640\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Yashesh Patel\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@DevOpsAmerica\" \/>\n<meta name=\"twitter:site\" content=\"@DevOpsAmerica\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Yashesh Patel\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/\"},\"author\":{\"name\":\"Yashesh Patel\",\"@id\":\"https:\/\/devopsnews.online\/#\/schema\/person\/1183cef5fa13624c55f3faf81f391435\"},\"headline\":\"DevOps without the security sacrifice\",\"datePublished\":\"2016-09-28T09:00:13+00:00\",\"dateModified\":\"2016-09-23T14:42:48+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/\"},\"wordCount\":938,\"publisher\":{\"@id\":\"https:\/\/devopsnews.online\/#organization\"},\"image\":{\"@id\":\"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/devopsnews.online\/wp-content\/uploads\/2016\/09\/cyber-attack1.png\",\"keywords\":[\"Android\",\"cryptographic\",\"cybersecurity\",\"DevOps\",\"Gartner\",\"HTTPS\",\"iOS\",\"IoT\",\"security\",\"SSH\",\"Venafi\"],\"articleSection\":[\"Featured\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/\",\"url\":\"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/\",\"name\":\"DevOps without the security sacrifice - DevOps Online North America\",\"isPartOf\":{\"@id\":\"https:\/\/devopsnews.online\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/devopsnews.online\/wp-content\/uploads\/2016\/09\/cyber-attack1.png\",\"datePublished\":\"2016-09-28T09:00:13+00:00\",\"dateModified\":\"2016-09-23T14:42:48+00:00\",\"description\":\"Kevin Bocek, Chief Security Strategist, Venafi, examines how to accelerate fast IT without sacrificing security.\",\"breadcrumb\":{\"@id\":\"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/#primaryimage\",\"url\":\"https:\/\/devopsnews.online\/wp-content\/uploads\/2016\/09\/cyber-attack1.png\",\"contentUrl\":\"https:\/\/devopsnews.online\/wp-content\/uploads\/2016\/09\/cyber-attack1.png\",\"width\":640,\"height\":400,\"caption\":\"security DevOps\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/devopsnews.online\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"DevOps without the security sacrifice\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/devopsnews.online\/#website\",\"url\":\"https:\/\/devopsnews.online\/\",\"name\":\"DevOps Online North America\",\"description\":\"by 31 Media Ltd.\",\"publisher\":{\"@id\":\"https:\/\/devopsnews.online\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/devopsnews.online\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/devopsnews.online\/#organization\",\"name\":\"DevOps Online North America\",\"url\":\"https:\/\/devopsnews.online\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/devopsnews.online\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/devopsnews.online\/wp-content\/uploads\/2020\/03\/DevOpsOnline_email.png\",\"contentUrl\":\"https:\/\/devopsnews.online\/wp-content\/uploads\/2020\/03\/DevOpsOnline_email.png\",\"width\":198,\"height\":64,\"caption\":\"DevOps Online North America\"},\"image\":{\"@id\":\"https:\/\/devopsnews.online\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/DevOpsAmerica\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/devopsnews.online\/#\/schema\/person\/1183cef5fa13624c55f3faf81f391435\",\"name\":\"Yashesh Patel\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/devopsnews.online\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/7133dcc024275e35cf81ef202ce76441?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/7133dcc024275e35cf81ef202ce76441?s=96&d=mm&r=g\",\"caption\":\"Yashesh Patel\"},\"sameAs\":[\"https:\/\/devopsnews.online\"],\"url\":\"https:\/\/devopsnews.online\/author\/yashesh-patel\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"DevOps without the security sacrifice - DevOps Online North America","description":"Kevin Bocek, Chief Security Strategist, Venafi, examines how to accelerate fast IT without sacrificing security.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/","og_locale":"en_US","og_type":"article","og_title":"DevOps without the security sacrifice - DevOps Online North America","og_description":"Kevin Bocek, Chief Security Strategist, Venafi, examines how to accelerate fast IT without sacrificing security.","og_url":"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/","og_site_name":"DevOps Online North America","article_published_time":"2016-09-28T09:00:13+00:00","article_modified_time":"2016-09-23T14:42:48+00:00","og_image":[{"width":640,"height":400,"url":"https:\/\/devopsnews.online\/wp-content\/uploads\/2016\/09\/cyber-attack1.png","type":"image\/png"}],"author":"Yashesh Patel","twitter_card":"summary_large_image","twitter_creator":"@DevOpsAmerica","twitter_site":"@DevOpsAmerica","twitter_misc":{"Written by":"Yashesh Patel","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/#article","isPartOf":{"@id":"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/"},"author":{"name":"Yashesh Patel","@id":"https:\/\/devopsnews.online\/#\/schema\/person\/1183cef5fa13624c55f3faf81f391435"},"headline":"DevOps without the security sacrifice","datePublished":"2016-09-28T09:00:13+00:00","dateModified":"2016-09-23T14:42:48+00:00","mainEntityOfPage":{"@id":"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/"},"wordCount":938,"publisher":{"@id":"https:\/\/devopsnews.online\/#organization"},"image":{"@id":"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/#primaryimage"},"thumbnailUrl":"https:\/\/devopsnews.online\/wp-content\/uploads\/2016\/09\/cyber-attack1.png","keywords":["Android","cryptographic","cybersecurity","DevOps","Gartner","HTTPS","iOS","IoT","security","SSH","Venafi"],"articleSection":["Featured"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/","url":"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/","name":"DevOps without the security sacrifice - DevOps Online North America","isPartOf":{"@id":"https:\/\/devopsnews.online\/#website"},"primaryImageOfPage":{"@id":"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/#primaryimage"},"image":{"@id":"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/#primaryimage"},"thumbnailUrl":"https:\/\/devopsnews.online\/wp-content\/uploads\/2016\/09\/cyber-attack1.png","datePublished":"2016-09-28T09:00:13+00:00","dateModified":"2016-09-23T14:42:48+00:00","description":"Kevin Bocek, Chief Security Strategist, Venafi, examines how to accelerate fast IT without sacrificing security.","breadcrumb":{"@id":"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/#primaryimage","url":"https:\/\/devopsnews.online\/wp-content\/uploads\/2016\/09\/cyber-attack1.png","contentUrl":"https:\/\/devopsnews.online\/wp-content\/uploads\/2016\/09\/cyber-attack1.png","width":640,"height":400,"caption":"security DevOps"},{"@type":"BreadcrumbList","@id":"https:\/\/devopsnews.online\/devops-without-a-security-sacrifice\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/devopsnews.online\/"},{"@type":"ListItem","position":2,"name":"DevOps without the security sacrifice"}]},{"@type":"WebSite","@id":"https:\/\/devopsnews.online\/#website","url":"https:\/\/devopsnews.online\/","name":"DevOps Online North America","description":"by 31 Media Ltd.","publisher":{"@id":"https:\/\/devopsnews.online\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/devopsnews.online\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/devopsnews.online\/#organization","name":"DevOps Online North America","url":"https:\/\/devopsnews.online\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/devopsnews.online\/#\/schema\/logo\/image\/","url":"https:\/\/devopsnews.online\/wp-content\/uploads\/2020\/03\/DevOpsOnline_email.png","contentUrl":"https:\/\/devopsnews.online\/wp-content\/uploads\/2020\/03\/DevOpsOnline_email.png","width":198,"height":64,"caption":"DevOps Online North America"},"image":{"@id":"https:\/\/devopsnews.online\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/DevOpsAmerica"]},{"@type":"Person","@id":"https:\/\/devopsnews.online\/#\/schema\/person\/1183cef5fa13624c55f3faf81f391435","name":"Yashesh Patel","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/devopsnews.online\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/7133dcc024275e35cf81ef202ce76441?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/7133dcc024275e35cf81ef202ce76441?s=96&d=mm&r=g","caption":"Yashesh Patel"},"sameAs":["https:\/\/devopsnews.online"],"url":"https:\/\/devopsnews.online\/author\/yashesh-patel\/"}]}},"_links":{"self":[{"href":"https:\/\/devopsnews.online\/wp-json\/wp\/v2\/posts\/8308"}],"collection":[{"href":"https:\/\/devopsnews.online\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devopsnews.online\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devopsnews.online\/wp-json\/wp\/v2\/users\/123458"}],"replies":[{"embeddable":true,"href":"https:\/\/devopsnews.online\/wp-json\/wp\/v2\/comments?post=8308"}],"version-history":[{"count":0,"href":"https:\/\/devopsnews.online\/wp-json\/wp\/v2\/posts\/8308\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devopsnews.online\/wp-json\/wp\/v2\/media\/8310"}],"wp:attachment":[{"href":"https:\/\/devopsnews.online\/wp-json\/wp\/v2\/media?parent=8308"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devopsnews.online\/wp-json\/wp\/v2\/categories?post=8308"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devopsnews.online\/wp-json\/wp\/v2\/tags?post=8308"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}