By Ali Bidabadi, Sr. Director, Cloud Solution Architecture
As more application teams adopt Continuous Integration/Continuous Delivery (CI/CD) workflows to enable application development, it’s increasingly important that organizations have integrated and automated security in place to protect these workflows.
CI/CD pipelines are at the center of daily operations for businesses across industries. When set up properly, they ensure consistency across delivery processes by automating manual tasks and providing visibility into how software is being worked on. It is within these pipelines where a network’s infrastructure has access to various resources, including code signing credentials and analytics keys.
Since most modern applications are based on a microservice architecture, DevOps teams have leveraged containers and container orchestration platforms, such as Kubernetes, to build and deploy their applications. As a result, container security must be a critical component of any solution that tries to protect CI/CD workflows. Below are considerations for DevOps teams to ensure their container strategy isn’t compromising security.
How DevSecOps Teams Can Achieve Security for the Entire Applications Lifecycle
Security should not be limited to only one part of a DevOps workflow. Instead, it needs to be injected into every stage of a CI/CD workflow pipeline-from the time that a developer checks in code to a code repository, until the time that the application is deployed to a runtime environment. At a high-level, a CI/CD pipeline is comprised of three stages: build, deploy, and run. It is paramount to secure each stage of the pipeline to prevent breaches in the overall lifecycle of an application. Here are five things to keep top of mind during each stage of the CI/CD workflow pipeline:
1. Scan application source code automatically – DevOps teams should perform intensive and comprehensive scans for an accurate vulnerability assessment of your application and integrate continuous application security testing into major DevOps CI/CD environments. Embedding testing into the process of developing and deploying applications to evaluate and detect security gaps that you can mitigate/remediate in the course of the Software Development Lifecycle (SDLC) can ultimately speed up production.
2. Build images securely – Images often consist of source codes and third-party libraries. Before building an image, it is critical to parse packages and libraries to generate a detailed report of all vulnerabilities (CVEs) as well as the libraries/packages in which vulnerabilities are discovered. Additionally, certain libraries should be excluded if they can cause security risks. A vulnerability report may also be able to help detect the presence of credentials and/or secrets in an image.
3. Plug seamlessly into the CI/CD workflow – Most application teams leverage build tools such as Jenkins to automate their build process. In order to add security to a build pipeline, security solutions need to be integrated into common build frameworks. Such integration allows application teams to learn fast and fail/pass builds based on their organization’s requirements. For example, if an organization has a security requirement that does not allow deployment of an application with critical vulnerabilities, a policy needs to be set to fail builds when a critical vulnerability is found in an image.
4. Run compliance checks against CIS benchmarks – As container orchestration platforms such as Kubernetes gain popularity, running static checks to detect potential vulnerabilities in those environments has become extremely important. The Center for Internet Security (CIS) has released recommendations for Kubernetes security best practices. This includes recommendations for configuring Kubernetes to support a strong security posture, such as disabling anonymous requests to the API server and running containers only as a non-root user.
5. Continuous runtime security – While preventing breaches in an application by shifting security to the earlier stages of a CI/CD pipeline is a key aspect of any comprehensive CI/CD security solution, securing running microservices is equally important. Traditional Next Generation Firewalls (NGFWs) do not have the context required to understand Kubernetes constructs, such as namespace, pods, labels, and so on. The risk of implicit trust and flat networks on preventing attacks from the outside give attackers plenty of surface once the perimeter has been breached. Fortinet Fabric Connectors built into FortiGate NGFWs address challenges related to inspecting egress traffic. This solution is primarily relevant for securing traffic in and out of the container infrastructure, known as the south-north traffic. Containers may have dependencies on external K8s services, such as access requirements for databases, third-party API endpoints, and cloud services. With that seamless integration with Kubernetes, FortiGate can apply advanced inspection and granular firewall policies based on K8s/container tags and metadata. Additionally, FortiADC can be deployed as an ingress controller, address ingress security, and protect web applications against OWASP top 10 attacks.
##
To hear more about cloud native topics, join the Cloud Native Computing Foundation and the cloud native community at KubeCon + CloudNativeCon North America 2022 in Detroit (and virtual) from October 24-28.
ABOUT THE AUTHOR
Ali Bidabadi, Sr. Director, Cloud Solution Architecture
Ali Bidabadi is a Sr. Director of Cloud Solutions Architecture at Fortinet, leading a team of Cloud Solution Architects globally. He has more than 18 years of experience designing and building Cybersecurity, SDN, and NFV products in public/private clouds and data centers. Prior to Fortinet, Ali was a Public Cloud Solution Architect at Juniper and a Principal Software Architect at Cisco where he designed and built an NFV-based orchestration platform for Cisco’s Mobility Core Business (MCBU). He was a founding member of Intel Security Controller team (ISC) and helped develop the L4-7 integration of Intel Security IPS with VMware NSX, Cisco ACI, and OpenStack/ODL platforms.
