As humans, we start life by crawling, next walking, and then running. This progression is logical, for it protects us. There is a natural flow to how our movement should develop and the associated risk we take on, as our movements increase with speed and complexity. But technology doesn’t tend to work that way. No matter how many times we’ve seen the need for that built-in security, it always seems technologies are developed and delivered ahead of the embedded security they so desperately need.
Continuous integration and continuous delivery, or CI/CD, is enabling software developers and DevOps teams to meet the high demands and dynamic requirements of users. These two combined methodologies create a CI/CD pipeline. This is a best-practice approach that DevOps teams use to deliver software updates more frequently and reliably. However, as with most things built faster, with frequent changes, not enough oversight, and without security as a key requirement, they come with potential security risks.
A continuous development and testing cycle, CI/CD enables software development agility that leverages automation to build, integrate, test, and address errors incrementally. Unfortunately, the security element always seems to come up after the fact. However, security is fast becoming as important as the apps that are being created. Data, in the form of user information, corporate secrets, trade secrets, intellectual property, competitive information, and product research and development, must be kept secret and secure from the unauthorized. Organizations that don’t adequately protect their digital assets from a cybersecurity breach can face serious regulatory fines and penalties, lost customers and revenue, and brand erosion.
What does all this mean for CI/CD development?
Privileged credentials, or secrets, are a key part of any CI/CD process. They are part of the entire software development process, through final product delivery. Manual management of secrets access for CI/CD puts organizations at risk. Automation is key to keeping secrets secure, as the risks are too great with log-lived deployments, and the possibility of developers leaving the company, or moving to another group. All too often, orphaned accounts, and their credentials, become vulnerable to malicious activity.
Development environments have people involved in various functions, like quality assurance, and testing, where privileged account sharing often takes place. Trying to manually manage privileged credentials becomes a risky endeavor. And the risk increases when organizations have users within multi-cloud environments, as well as on-premises.
In many cases, users that only need limited access are assigned broad privileges, creating overprivileged identities. In the cloud, overprivileged identities can have serious implications, with large numbers of points of access, data, applications, and infrastructure elements.
Securing access to secrets within a CI/CD environment
RevBits enables developers and DevOps to seamlessly use their tools and applications while applying consistent assess the management of security best practices for credentials and security keys. RevBits CI/CD Access Management helps DevOps reduce security and compliance risks associated with privileged access sprawl while enabling them to remain fast and agile.
RevBits supports the fast and agile development that CI/CD provides, while bringing secrets protection into the DevOps environment, with a frictionless process to securely include secrets into their applications. RevBits approach CI/CD secrets access management with a zero trust model. The automation process does not store keys internally but checks them out only when they are needed to perform escalated tasks.
When DevOps creates an app for a testing, staging, or production server, they often include secrets. These can be credentials or security keys, which authenticate data associated with an API, application, SSH, certificate, etc. RevBits secrets manager, or secrets vault, can be audited and centrally managed to protect and control secrets. Without this protection, DevOps personnel can write their own scripts that automatically pull their own certificates, inject them during deployment, and store them somewhere in their computers. They can also hardcode credentials into an app.
Using a secrets manager plugin within CI/CD environments is a more secure approach. Applying common DevOps tools, like Jenkins, Kubernetes, and others, developers can configure the variables, and associate them with the location and values they imputed for the secrets. RevBits CI/CD Access Management module keeps secrets encrypted and delivers them to CI/CD plugins when needed over SSL and one additional layer of encryption that employs Diffie-Hellman to establish the secure key exchange. This ensures the RevBits server is securely communicating with a legitimate CI/CD plugin. After the key exchange and confirmation of the plugin identity, RevBits receives the secrets value, and sends it to the deployment server. This process protects secrets, so that no one is able to manually manage, or even see them. RevBits also rotates all secrets that are not static.
PAM administrators can link and import account credentials from PAM, into the RevBits secrets manager vault. When a secret is already on-boarded in RevBits PAM, it can be automatically imported into the CI/CD module by simply dragging-and-dropping it.
RevBits CI/CD Access Management
- Equips DevOps with highly scalable security, while enabling the speed and agility needed for DevOps workflows. RevBits activates this through integration with popular DevOps tools, like Ansible, AWS, Azure DevOps, Jenkins, Kubernetes, Puppet, and Terraform.
- Provides protected, centralized management and auditing capabilities for secrets consumed by users, applications, tools, and other identities. DevOps maintains secure secrets that are applied with uniform policies and reduced management effort. The protected secrets now comply with security requirements, as part of an automated CI/CD pipeline.
- Administers the entire lifecycle of DevOps secrets, including authenticating, authorizing, exchanging, storing, rotating, and auditing.
Automated administration of secrets within the CI/CD environment includes an audit trail for reporting. Development environments are always endeavoring to deliver faster, and more iterative application code. RevBits enables the speed and agility DevOps teams require, while securing access to secrets.
Click here to learn more about RevBits PAM.
Originally published at https://www.revbits.com on May 26, 2021.
