As computing systems and cloud infrastructure keep growing, it's critical that security and documentation don’t fall by the wayside. Throughout my career, I’ve had the pleasure of working with many different cloud contractors and developers.
One common theme I’ve noticed when involved in these cloud infrastructure services projects is that many clients haven’t planned for or don’t have a centralized code repository. This one of the benefits of DevOps, albeit one that's underused.
In other circumstances, centralized code respositories might exist; however, code changes, commits, pulls and merges don’t occur frequently — and are done without review. As a security-minded professional and managed services provider, this frightens me.
Working out in the field, I also frequently see a lack of useful documentation in an easily accessible, known location. When I ask about it, the typical answer about how to install or configure code usually is, "[Insert name here] knew how to do it, but he left a few months ago." None of these exactly are best practices.
We’re living in a time when we can build an entire network, complete with running applications from text files such as terraform and cloud formation. These days, everything is code, and code is everything.
What's the Best Way to Store Code?
That’s why infrastructure as code, provisioning scripts and every script used by operations need to be stored in a code repository. Having a code repository is important for the obvious reasons, however it’s also an essential element for adhering to government and other regulatory compliance requirements.
This recent issue with Snapchat and its leaked source code is a good lesson, a cautionary tale, if you will, about why a secure repository is a must, not an option.
You can choose from many source-control repositories. These range from open source options to paid products. You can run some as an on-prem solution, while others are cloud-based.
The important thing is deciding what may be right for your use case. You don’t want to be locked into a licensed product for unlimited users when you have a small team that writes code. Alternatively, if you have a large staff, open source might not be the best fit for you.
How Do You Configure a Code Repository?
Once you have chosen the type repository you want to use, you’ll then need to perform the most essential task of all — configuring that repository with security in mind.
Some solutions can be synchronized to your current Active Directory or LDAP services. If that isn’t an option, you will want to follow some universal IT best practices. Your first consideration should be a popular idea within the NIST framework — the "separation of duties."
Separation of duties mitigates risk. In most cases, it’s wise not to provide everyone in your organization with full administrator privileges.
Instead, “separate the duties” by creating specific user groups, such as a operations/developer group. Each group would be allowed to push and pull their own code. By doing this, you’ve taken an important step toward better cloud security.
The cloud is amazing place and also a secure one when managed correctly. That’s where cloud DevOps and site reliability come into play. They’re crucial components in cloud migration and implementation.
This is just a first look at how to securely manage your code, your cloud infrastructure and all the related security surrounding it. Next month we'll talk about pull requests and peer reviews. Stay tuned for Part Two!
