Chapter 12: Architecting for DevSecOps

As with everything in the enterprise IT domain, DevSecOps requires an architectural foundation. In this chapter, you will learn how to compose the reference architecture for DevSecOps practices and design the pipelines for DevSecOps. We will also discuss the best DevSecOps practices for the major public cloud providers; that is, AWS, Azure, and GCP. For that, we will elaborate on some of the leading tools in the market. In the last section, you will learn what steps the enterprise should take to implement DevSecOps.

After completing this chapter, you will be able to name the different components in a DevSecOps architecture and how to include these in a DevSecOps pipeline. You will have also learned how to secure containers and what the best practices are in various public clouds. Most importantly, you will be able to explain why including security in DevOps is crucial for enterprises.

In this chapter, we're going to cover the following...

Understanding the DevSecOps ecosystem

In the previous chapter, we discussed security principles and how this impacts the DevOps way of working. We concluded that security must be at the heart of every step in the development and deployment cycle, from the moment where code is pulled from a repository to the actual code commit and push to production. In this chapter, we will look at the foundation of DevSecOps, DevOps that has security embedded.

DevSecOps consists of three layers:

• Culture: This is not a technical layer, but it's often forgotten that DevOps is much more than just applying tools and creating CI/CD pipelines. Obviously, the same applies to DevSecOps. Within DevSecOps, every team member feels responsible for security and acts accordingly, taking ownership of it. This doesn't mean that security specialists have become obsolete, though. It's a good practice to have a security engineer or professional in the team, sometimes referred to as the security...

Creating the reference architecture

Before we discuss the reference architecture of DevSecOps, we need to understand what the role of DevOps is and how security fits in. DevOps is about the software development life cycle. An important note that we have to make is the fact that developers increasingly use open source components. This makes sense since this provides great flexibility when developing new code.

Open source is community-driven, so developers can contribute to each other's code and speed up the process. Projects can and are shared in open Git and GitHub repositories, but also internally in enterprises. InnerSource type projects are a good example of this. InnerSource uses open source best practices for software development, within the boundaries of an organization. Typically, InnerSource projects make use of shielded, access restricted repositories in GitHub or alike.

Yet, there are some risks associated with open source that need to be addressed from a security...

Composing the DevSecOps pipeline

Let's look at a common DevOps pipeline first. The basic pipeline is shown in the following diagram:

Figure 12.1 – DevOps pipeline

The basic steps in the pipeline are as follows:

• Pull code from the repository
• Build
• Test
• Deploy

In DevSecOps, we are embedding security into the pipeline, making security standards and policies an integrated part of it. Security is a layer that is applied to every step in the pipeline, but it does include several steps. This is shown in the following diagram:

Figure 12.2 – DevSecOps pipeline

These steps are as follows:

1. Dependency check: First, any vulnerability that exposes the code to the risk of an exploit should be removed. This includes code that relies on other pieces of code to run. There are differences in code dependencies: developers can have controlled and uncontrolled dependencies. As a common practice, we don...

Applying DevSecOps to AWS, Azure, and GCP

In the previous sections, we discussed the DevSecOps principles and how the pipeline is built with embedded security. In this section, we will look at the best practices of applying DevSecOps to the major public cloud platforms, that is, AWS, Azure, and Google Cloud Platform (GCP).

Working with DevSecOps in AWS CodePipeline

Before we start exploring DevSecOps in AWS, we need to understand that deployments in AWS should be based on the principles of the Cloud Adoption Framework (CAF). That framework covers specific security tasks and responsibilities, grouped into the four categories or principles for enterprise security that we discussed in Chapter 11, Understanding Security in DevOps:

• Prevention
• Detection
• Correction
• Direction

  Note

  AWS refers to these principles with different terminology for correction and direction. In CAF, these are subsequently called detective and responsive.

AWS offers native solutions...

Summary

In this chapter, we studied the different components of DevSecOps. We learned that DevSecOps is not only about tooling and automation, but also very much about culture: DevOps teams have to collaborate with the security specialists in the enterprise and together, they must be fully committed to embracing and embedding security guidelines into developing and deploying new code. Tools can certainly help in achieving maximum security in DevOps. A larger part of this chapter was about architecting the DevSecOps practice.

Then, we discussed the best practices for DevSecOps in the major public cloud providers; that is, AWS, Azure, and Google Cloud. These practices typically include the use of Docker containers and Kubernetes as container orchestration platforms. We also learned how to scan code and secure the containers before deploying them to a production platform. Important activities include static code analysis and dynamic scanning.

In the last section of this chapter...

Questions

1. What is the function of software composition analysis (SCA)?
2. What technique is used to keep containers secure?
3. What is the native tool in AWS that's used to create stacks?
4. The AWS, Azure, and GCP public cloud providers offer their own Kubernetes services to run containers. Name their respective services.

Further reading

• Blog on using AWS CodePipeline in DevSecOps: https://aws.amazon.com/blogs/devops/implementing-devsecops-using-aws-codepipeline/#:~:text=%20Implementing%20DevSecOps%20Using%20AWS%20CodePipeline%20%201,%206%20Create%20change%20set%3A.%20%20More%20
• Documentation on applying DevSecOps practices in Azure: https://azure.microsoft.com/en-us/solutions/devsecops/
• Documentation on DevSecOps CI/CD using GCP, Anthos, and JFrog: https://cloud.google.com/architecture/partners/a-hybrid-cloud-native-devsecops-pipeline-with-jfrog-artifactory-and-gke-on-prem#best_practices
• Documentation on security in Docker: https://docs.docker.com/engine/security/trust/