Secrets Management
Secrets management refers to the tools and methods for managing digital authentication credentials (secrets), including passwords, keys, APIs, and tokens for use in applications, services, privileged accounts, and other sensitive parts of the IT ecosystem.
Credentials and secrets used in DevOps environments are a prime target for attackers. Using a DevOps tools-centered approach to manage secrets contributes to secrets sprawl and expands the attack surface. Implementing a centralized administration solution, built for continuous development environments with security as the driving factor reduces the risk of exposure without slowing down the application delivery process.
Secure Code Analysis
We live in an era of digital transformation, with software at the heart of it and it is everywhere and when it is everywhere, everything becomes an attack surface, and your software security risk can become almost limitless.
In the fast paced world of software development, business needs to deliver feature rich applications at a speed that is not possible without automation, you need to introduce mechanisms that support the automated scanning of code to ensure that security testing is not left until the end.
Static Application Security Testing (SAST) allows developers to automatically scan their code for known vulnerabilities, this minimises the risk of incorporating known vulnerabilities into your application and further reducing the risk that these vulnerabilities can be exploited by hackers.
Container Security
The adoption of containers has grown much faster than expected and while containers have solved the problem of getting software to run reliably between environments, this has introduced a new set of challenges, traditional security tools are not designed to monitor and protect this new environment.
Container platforms need to be monitored, whether they are on-prem or in the cloud to ensure that vulnerabilities and security misconfigurations are not introduced at any stage and when the containers are running that they continue to function as intended. Your chosen platform must be able to dynamically scan for advanced threats or malware in your container images as well as alerting on misconfigurations in public cloud environments.
API Security
Digital transformation has increased the importance of API’s, according to a report from Akamai, a full 83% of web traffic today is now API traffic, so as their usage continues to grow so does your attack surface.
Due to the nature of DevOps, without automated tools and processes in place it is impossible to ensure the security of your API’s. Gartner predicts that APIs will be the most targeted attack vector in the enterprise.
So how do you secure your API’s, this is done from the very beginning, describing your security in the API contract and enforcing those security policies throughout the API lifecycle and testing for vulnerabilities throughout, once in production protection is enforced via micro API firewalls.
