DEVOPS SECURITY

BUYER’S GUIDE
Deploy Robust Security from DevOps Day One

FOUNDATIONAL CONTROLS FOR 
SECURITY, COMPLIANCE & IT OPERATIONS
Introduction execution, and testing—with iterative
feedback and integration every step of
»» More stable and reliable environments
You know implementing DevOps will »» Faster iterations mean quicker error
the way.
rapidly advance your processes. detection less rework projects
Adopting DevOps gives you faster time to
market, optimized delivery cycles, and a
The DevOps lifecycle
[Visual asset: Lemniscate, example “Over the past six years and
wealth of saved time and resources. The
first steps of rollout make for an oper- below from Atlassian.com/devops] 2,700 State of DevOps survey
ational sea change for your teams, and responses, we’ve found clear
In practice, DevOps teams frequently
they’ll have a lot to learn at first. evidence that DevOps practices
rely on agile tools like a Kanban board to
keep track of their work sprints and give yield remarkable results for
Amid so much transformation, it’s
tempting to push security strategies everyone a transparent view of where IT teams and organizations …
down your to-do list. You might want to each piece of the puzzle is at any given Today, DevOps is viewed as the
wait for your teams to hit their stride moment. path to faster delivery of soft-
before settling on a security solution—
Lean strategies like these require teams ware, greater efficiency, and
after all, you can always tack a basic
to consider their tasks in relation to the the ability to pull ahead of the
solution onto your deliverable cycle competition.”
project as a whole, a modality known
later, right?
as systems thinking. Systems thinking - 2017 State of DevOps Report by
In fact, this do-it-later strategy helps individual employees streamline Puppet and DORA²
becomes a major drain on your time their workflows by giving them con-
and resources and leaves your organi- sistent visibility into the impacts their
zation open to threats and attacks that disparate tasks have on the group’s pace Business benefits
of progress. According to Atlassian, DevOps teams
could take weeks or months to detect,
are two times as likely to surpass their
let alone resolve. The only diligent way
to make sure your DevOps deployment Technical benefits goals for profit, market share, and
productivity compared to teams using
succeeds is to start with a robust secu- DevOps relies on real-time communi-
traditional operational methods.3 This is
rity plan from the very beginning. cation throughout every stage of the
because of quicker delivery of new fea-
development cycle. This leads to quicker
Questions this guide answers: tures, a stable operating environment,
problem solving on behalf of your teams
improved communication, and increased
»» How will DevOps benefit my and less complexity for management to
collaboration. Business benefits include:
organization? deal with. Thirty-three percent of enter-
»» What security risks come with putting prises cite reduced complexity as a top »» More efficient use of employee time
DevOps into action? driver for DevOps adoption.1 Technical
»» Bring value to market quicker through
benefits include:
»» Which tools do I need to make DevOps continuous deployment
a success at my organization? »» Faster and more frequent deployment »» Increased employee retention and
»» How do I know which security solution engagement
will play well within the DevOps
framework?
»» What should I ask my vendor to
make sure their product fits the right Code Deploy
criteria for me?
Pl
an e
as
Dev Ops
Quick DevOps overview
Operate
Build

e
DevOps originated in the software devel-
opment world in 2008. It has since made Rel
a name for itself as the best operational
methodology for complex organizational
processes across every industry. Mo
Te s t n it o r
DevOps essentially brings agile oper-
ations best practices to development
quality assurance lifecycles. This
creates a continuous loop of planning, Fig. 1 DevOps involves continuous integration, automated testing, rapid deployment,
infrastructure as code, and application monitoring.
Cultural benefits Risk #1: Process change with Optimize Your DevOps Tool Suite
The bulk of the change that occurs security as an afterthought Do you already know what product
when you shift your teams to DevOps is Market pressure to deliver faster than capabilities you’ll use to make the most
cultural. You’ll see knowledge silos give your competitors can spur your teams to of DevOps? Here are several of the key
way to transparency, and employees cut security corners, especially if there’s tools you need to decide on to implement
increase their engagement. DevOps a skills gap when it comes to sensible and execute a successful DevOps model
gives passive employees the resources security expertise. The security skills in your organization:
they need to become engaged stake- gap arises when IT employees are shoe-
holders who see themselves as integral horned into security roles they aren’t Version control
agents of change. The increase in feed- properly trained for because of rapidly Version control tools allow you to upload
back and communication translates to growing cybersecurity talent demand. your binaries and branch your software
higher job satisfaction, too: Employees If you create an environment in which to make sure everyone on your team is
from DevOps teams are twice as likely security concerns are mismanaged or always working on the correct version.
to describe their organization as a great put off for a later date, you’ll have to go Two people can check out the same
place to work to potential recruits.4 back and assess vulnerabilities at every version and work independently, then
step of your process—wasting valuable merge their code back into the appro-
Cultural benefits include: time and resources that could be spent priate branch. Github is an industry
»» Increased collaboration between on innovation. standard development tool for fast and
teams
flexible version control.
»» Better focus, which leads to improved Risk #2: No security in the
work quality continuous integration process Project management tracking
»» Feedback loops, which make Continuous integration (CI), is a cru- Project management tracking soft-
employees feel heard and valued cial component of the DevOps model. ware, generally a SaaS, tracks specific
Developers integrate their updated code projects and tasks so that each team
to merge it with the bulk of the existing
The Top Three code for each product or service. This
member has clear visibility into the
statuses of their stories and epics. For
DevOps Security Risks means constant change occurs in a example, JIRA is a three-piece suite of
The initial process restructuring this central code repository. But which of solutions you can use to track develop-
transformation involves can lead to a these changes are planned, and what ment progress, IT and customer service
substantial payoff down the road, but happens if hackers are making changes tickets, and core business management.
only if you make a concerted effort to as well? Successful CI calls for change
integrate security directly into your management solutions that track every Build and deployment
DevOps stack. Otherwise, you run the modification made to your organization’s
risk of compromising all the work that systems.
(continuous integration)
went into the transition by leaving your Continuous integration streamlines
the development process by merging
organization vulnerable to avoidable Risk #3: No visibility across all and testing code on an ongoing basis
threats. cloud endpoints to avert problems down the line. Tools
Any modern organization using DevOps like Jenkins keep developers’ code
“An overwhelming majority will have a substantial amount of cloud production-ready and allows them to
of companies believe an inte- endpoints at any given time. From VMs continuously push their code out to
grated security and DevOps to web services to containers, that’s a lot various environments. Jenkins is also
team makes sense, with 98 to keep track of—and this is even truer popular among DevOps teams because
percent of survey respondents if you’re still working with on-premises of its extensive integrations and plugins.
systems as well. You need to have deep
saying they are either planning
to or have launched such an
visibility across all your organization’s Secure configuration assessment
endpoints or you run the risk of becom-
effort.” ing an easier target for attackers.
Secure configuration assessment tools
look at each individual system and its
- Jason Sabin,
It’s time to take control of these risks. specific settings to make sure each one
CSO of DigiCert5 is set up securely. This includes testing
Start by developing your optimized
DevOps tool suite and selecting a secu- systems such as password lengths and
rity product that will scale with your other types of secure configurations.
teams, integrate with your ecosystem, Each time you make an improvement
and manage vulnerabilities before they on an asset’s secure configuration,
become a problem. you are hardening that device or asset.
Tripwire’s secure configuration man- Question #2: Does it comes with a
agement capabilities make it the go-to
solution to ensure foundational controls
service team? Your 10-point
The best security system in the world
are met throughout the DevOps lifecycle. DevOps security
won’t do you any good if you don’t know
how to configure and maintain it. Avoid checklist
Change management solutions that don’t offer ongoing IT sup-
Change management solutions distrib- port. Look for security products with a Use this essential
ute notifications the moment changes customizable range of service options.
from your baseline occur. Tripwire’s file operational checklist to
integrity monitoring provides you with ensure your security tool
side-by-side comparisons of what any
Question #3: Will it keep us aligned
with compliance standards? contains all the necessary
given file in your system looked like
One security consideration you can’t functionality to help you run
before and after a change, highlighting
the differences so you can take action overlook is regulatory compliance. Will DevOps securely:
quickly. Tripwire change management your security solution alert you the
FF Endpoint visibility for
isn’t just for files alone—your directo- moment you stray from compliance
ries, registries, DLLs, ports, services, standards? If not, you may end up having Docker containers
protocols and more are also covered. Be to pay a substantial fine (not to mention FF Integration with legacy
in the know as soon as change occurs. risk a security breach). Make sure you
systems
talk to your vendor about the breadth
and depth of their product’s coverage. FF Change detection with
Three Critical Questions file integrity monitoring
to Ask Your Vendor How Tripwire Secures Your
Once you’re on the phone with a vendor,
FF Attack surface
spend your time wisely by asking DevOps Process reduction with configuration
the three most important questions You can put your trust in Tripwire® monitoring
to determine whether or not their Enterprise as your complete change
management solution during and after FF Vulnerability
product will perform well within your
organization. your DevOps ramp-up. The cultural management
and operational changes a successful FF Security automation and
Question #1: Does it cover both DevOps transition requires are enough
to worry about. Let us handle the rest.
remediation
cloud and on-premises? FF Log management
Many organizations rely on a com-
bination of cloud and on-premises Summary FF Real-time threat
systems—a tough position to be in With Tripwire, you can enjoy peace of detection
when so many security products only mind knowing both your legacy hard-
cover cloud-based environments. Ask ware and cutting-edge cloud container FF System hardening and
your vendor how their product will also operations will be secured with one compliance enforcement
extend to your remaining legacy frame- comprehensive change management
FF Public cloud account
works as well. solution.
configuration

Fig. 2 Real-time change intelligence—

Tripwire Enterprise gives you the most
comprehensive file integrity monitoring
solution available. Granular endpoint
intelligence provides continuous
monitoring for threat detection.
Tripwire’s industry-leading agents guard
your endpoints for continuous real-time
monitoring.
Fig 3. Securing the entire container
stack—Use Tripwire Enterprise to
enforce stringent security standards
across physical, virtual, and private and
public cloud environments. Tripwire
Enterprise supports over 1000 policy
and platform combinations, including
AWS Linux and Docker containers.

Fig 4. Security assessment and

remediation—Manual security practices
just aren’t efficient or effective enough REQUEST A DEMO
to keep up with the deep system
integration DevOps requires. Tripwire With concerted planning
Enterprise works seamlessly with best- and skillful execution,
in-breed DevOps toolsets. Integrating
with these various tools allows for
you can dramatically
automation of your key security increase your organization’s
processes. effectiveness by adopting
the DevOps model. Don’t
let insufficient security
compromise the hard work
you’re investing in the
transition.

Let us take you through

a demo of Tripwire’s
security and vulnerability
management products
and services customized
to your specific IT security
and compliance needs.
Visit tripwire.com/contact/
request-demo and learn
more about how Tripwire
Sources: Enterprise is the perfect
1 https://img.deusm.com/informationweek/ solution for secure DevOps
Interop-ITX-Research-Reports-Infographic-
DevOps-FINAL.pdf deployment.
2 https://puppet.com/resources/whitepaper/
state-of-devops-report/thank-you
3 https://www.atlassian.com/it-unplugged/
devops/devops-trends-infographic
4 https://www.ca.com/en/blog-highlight/
devops-makes-employees-happy.html
5 https://www.darkreading.com/
cloud98--of-companies-prefer-integrat-
ing-security-with-devops/d/d-id/1329405
 Tripwire is a leading provider of security, compliance and IT operations solutions for enterprises, industrial
organizations, service providers and government agencies. Tripwire solutions are based on high-fidelity
asset visibility and deep endpoint intelligence combined with business context; together these solutions
integrate and automate security and IT operations. Tripwire’s portfolio of enterprise-class solutions
includes configuration and policy management, file integrity monitoring, vulnerability management,
log management, and reporting and analytics. Learn more at tripwire.com

The State of Security: Security News, Trends and Insights at tripwire.com/blog

Follow us on Twitter @TripwireInc » Watch us at youtube.com/TripwireInc

©2018 Tripwire, Inc. Tripwire, Log Center/LogCenter, IP360 and Tripwire Axon are trademarks or registered trademarks of Tripwire, Inc.
All other product and company names are property of their respective owners. All rights reserved. BRDOSBG1a 1805