Getting to a development process that is both faster and more secure

For government IT departments, DevOps surely seems like a godsend. This focus on rapid IT service delivery enables agencies on tight budgets to do more with less, do it more efficiently and enable faster innovation. DevOps tools including Ansible, Chef and Puppet have ushered in a whole new era of optimization, enabling the DevOps team to match the pace of network users’ needs.

Then along comes the security or auditing team with additional requirements that slow the pace of DevOps. 

To draw an analogy, imagine you were tasked with rowing a ship and you got orders to obtain approval from someone on the top deck before every stroke of the oar. This new process requires you to drop your oar, run the ladder, obtain the necessary approval, run back down, take your seat, position the oar and pull. Bear in mind, you are rewarded or punished based on how far the ship has moved.

This inefficiency frustrates everyone involved so that no one’s goals are being met, despite greater effort. With this kind of pressure, how long do you suppose it would take before you would say, “Forget it” and simply pull the oar a few times without performing the necessary checks? Eventually, the trips upstairs would grow scarce as more attention is paid to the task of moving the ship.

Does this seem like an exaggerated scenario? If so, please talk with your DevOps team.

John Willis, VP of DevOps and digital practice at SJ Technologies and co-author of The DevOps Handbook, summed it up this way: “Most modern-day DevOps teams are all about continuously removing obstacles and are maniacal about streamlining automation – as it should be. However, that’s not to diminish the fact that there is a very legitimate need to incorporate security into DevOps, so much so that the term DevOps has expanded to DevSecOps (for security). To be successful, businesses need to incorporate security into DevOps during the development and planning stage, rather than treating security as an afterthought.”

That goes for government agencies, too. The idea of treating security as an afterthought is evidenced by the practice of vaulting keys for privileged access. The checking keys in and out is anathema to streamlining DevOps. First of all, registering keys into a vault is a time-consuming and tedious process. Second, the whole process of vaulting adds friction to an otherwise-fluid DevOps process, similar to the earlier example of going above deck to get approval to row.

Consequently, DevOps professionals can end up placing new SSH keys on target systems, thereby bypassing security controls and creating what is effectively just the appearance of security versus actual security. This is the "sounds-good, no-good" security syndrome: what sounds good in theory is generally unworkable in practice and, therefore, is often ignored or bypassed.  

A paradigm shift is needed to overcome this problem. Rather than viewing security as an afterthought, creating additional layers of friction, security should be incorporated into the flow of DevOps. Moreover, to the greatest extent possible, security should enhance DevOps productivity. For example, rather than storing authentication credentials on each end point and vaulting private keys, how about facilitating authentication using ephemeral (short-lived), role-based access control in real time?

In fact, why not provide the DevOps team with an actionable list of servers and devices

rather than burdening them with asset inventory and key management? That way, a simple hyper link click will allow the user to connect right to that system or device with no additional hoops to jump through. This new process will eliminate security burdens from DevOps and mask security checks and controls from the end user, freeing them to focus solely on their primary task of pulling the oars to move the ship.

Thankfully for DevOps teams and their agencies, frictionless privileged-access solutions have been developed that balance both the need for speed and the requirement for security, but it means moving to a more streamlined security model. The only way forward is to permanently remove unmanaged keys and get rid of passwords from SysAdmin access to cloud and server environments. Monitoring, provisioning and maintenance must all be simplified, and everything access-related should be automated.

Government entities cannot afford to take security shortcuts, but that doesn’t mean they have to hamstring their DevOps teams. Instant, secure access to cloud and on-premises assets is the order of the day. Passwords, vaults and penalties must go. DevOps and the IT security staff are not enemies; they are all rowing toward the common goal of a more efficient and secure network that serves all constituents. The dynamic, role-based, short-lived, on-demand SSH certificates available today will help make that vision a reality.