Cloud DevOps and Security

There is a buzz in Australia, post Amazon’s Web Services Summit, around a few cloud related concepts. I will try and distill.

Public cloud: Enterprises here are mostly talking about hosting Internet/extranet-facing corporate applications on Amazon EC2 AMI instances (think little Windows or Linux virtual servers) behind Amazon’s elastic load balancers (IaaS) or Microsoft’s Azure Platform, which abstracts above active directory, Web servers and database servers.

Private cloud: Some enterprises are getting interested in spinning up VPNs into Amazon to host intranet applications on shared hardware.

Roll your own private cloud: Some enterprises have engaged service providers to create their own private cloud environments on dedicated hardware on their own premises.

DevOps: This is the concept of not only version-controlling and release-managing a software package installation but also the installation/configuration of the infrastructure that the software package sits on by the use of automation. The catch phrase for DevOps is "Infrastructure as Code".

In practice this usually means scripts of some sort that deploy Amazon AMIs, elastic load balancers, configure them, and build/deploy the software package. There are many benefits, namely consistent infrastructure configuration across environments, better (often also automated) testing and the ability to frequently and rapidly deploy. Some single-application, massive-scale, online companies deploy new software versions multiple times a day.

How does security fit into this?

In software deployment there are a few key security controls. Segregation of development, test and production environments—approvals for release from development to test and from test into production should be segregated so that one person cannot write and promote code to production.

Infrastructure security controls also need to be deployed for DevOps style automated deployment. The configuration scripts should securely configure the systems to benchmarks. Did you know that the Center for Internet Security are planning to have CIS benchmark configured AMIs in the Amazon Marketplace?

All this DevOps and Cloud stuff is starting to help us Infosec people with the basics so we can focus on the tricky appsec aspects. I encourage you all to investigate Amazon AWS and Microsoft Azure and start to enter a new and potentially more secure world!

Join the CSO newsletter!

Error: Please check your email address.

More about Amazon Web ServicesLinuxMicrosoft

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Matt Hackling

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts