Securing DevOps in the Cloud with Privileged Access Management (PAM)

A recent cybersecurity news item should trigger concern for anyone involved in cloud-based software development. As reported in CSO, an attacker breached a popular Node.js module. After building trust and gaining owner-level access, he or she was able to push a compromised version that hid Bitcoin and Ethereum hot wallet credentials for malicious purposes in the code.

This story highlights how challenging it can be to establish verifiable trust with colleagues in a cloud-based software development project. Cloud DevOps, in particular, with its rapid pace and flexible organizational structure, makes companies vulnerable to software-borne threats.

The flexibility of cloud DevOps can make organizations particularly vulnerable to software-borne threats.

What is Cloud DevOps?

Cloud DevOps is the work of developing and releasing software on cloud computing platforms using the DevOps model. DevOps, as its name connotes, is a blending of previously separate development (dev) and IT operations (ops) teams and processes. It’s an update on the traditional software development processes, where the development team was responsible for coding while the operations team handled putting the code into production. Testing was an intermediate step.

DevOps – the blending of development (dev) and IT operations (ops).

Cloud DevOps – the work of developing and releasing software on cloud computing platforms.

This legacy software process presents some drawbacks from the perspectives of speed and agility. The habit of “throwing problems over the wall” and letting the other team deal with the results in a sluggish, cumbersome software-releasing effort. In contrast, DevOps fuses the people and workflows of development and releasing making it well suited to today’s prevalent agile software development methodologies. DevOps also aligns well with Continuous Integration (CI), the process of inserting new code into live production software.

The cloud is a natural fit for DevOps. Everything can move much faster when there are no on-premises development environments to set up. The cloud also makes it easier for DevOps teams to collaborate across organizational and geographic boundaries. New technologies like containers and microservices similarly benefit from the combination of cloud and DevOps. It all just works better. It’s also less secure.

Security Risks in Cloud DevOps

View incidents like the Node.js hack as a warning, it’s essential for IT managers to see Cloud DevOps as more potentially risky than on-premises DevOps. With the cloud, there are many more moving parts and remote points of access to the development and production environments. If outside entities like IT contractors and development shops are involved, the risk exposure multiplies. Potential risks include:

• Insertion of malicious code into production software, e.g. ransomware
• Misuse of the development and production environments for data breaches or eavesdropping
• Implantation of rootkits on production servers

Cloud infrastructures have more moving parts and remote points have access – each of which brings potential risk to outside-intrusion.

Access Control as a Factor in Cloud DevOps Risk

To keep cloud DevOps secure, it’s necessary to be able to answer the fundamental questions that arise in the wake of any security incident: Who did what, when? With traditional software development, it’s relatively easy to answer these questions. You will have logs of who accessed the dev environments. Assuming you have Privileged Access Management (PAM) in place, you will have control over anyone conducting administrative sessions on productions servers. In the cloud, all of this is less certain.

Privileged Access Management and Cloud DevOps

Keeping Cloud DevOps secure requires control over privileged access to the back ends of all the cloud-based system elements. These include the development and test environments and, of course, the production environments. Given the combined teams and practices inherent in DevOps, all separate components can be viewed as part of a single system.

A privileged user has back-end administrative access to a system. In Cloud DevOps, almost everyone has some degree of privileged access. They may not be able to modify user accounts and system configurations, but if they can log in and alter production code, they should be considered a privileged user. They need to be bound by privileged user access control policies, subject to privileged access management (PAM).

A PAM solution realizes this goal. Designed to ensure that only administrators with proper access rights can log in to back-end systems, they monitor and manage all privileged account access. This applies to cloud infrastructure as well as on-premises systems. In a Cloud DevOps use case, a PAM solution would provide a secure and streamlined way to authorize and record any user’s activities on any element of the DevOps environment, regardless of where it was hosted.

PAM provides a secure and streamlined way to authorize and record user activities to improve organizational security for both cloud infrastructure and on-premise systems.

In Cloud DevOps, the PAM solution can centrally and efficiently manage developer and IT ops team member access across the cloud systems they manage. It enforces policies that restrict these users from bypassing security systems. The PAM solution grants and revokes privileges to developers and IT ops people. PAM also reduces the risk of privileged access to cloud DevOps environments by former developers or by people who no longer require access.

PAM Tools to Address Third-Party Application Maintenance Risks

The WALLIX Bastion offers a comprehensive PAM solution for Cloud DevOps. It enables pervasive, sustainable deployment across cloud infrastructure that supports DevOps. It does so by establishing a single gateway with a single sign-on for access by developers and IT ops people. The Bastion works for systems in the public cloud, private cloud, hybrid cloud, and on-premises environments.

WALLIX offers several components that each play a role in addressing the access control risks in Cloud DevOps. The Access Manager lets users connect to resources with a single click from any device without the need to install remote access tools. Today’s Cloud DevOps people tend to be mobile, so this capability is a plus for PAM compliance. All passwords are stored in a secure and certified Password Vault.

The WALLIX Session Manager monitors privileged Cloud DevOps users’ session activity in real-time. It creates a comprehensive audit trail. The tool can be configured to intervene automatically when Cloud DevOps access policies are breached. By assigning each access to an actual identity, the Bastion Session Manager ensures that all users are accountable for their actions. The Bastion can then speed up the process of interpreting what might have gone wrong in an incident.

The WALLIX Bastion includes robust access management, session management, and password management features.

The WALLIX solution features an agentless architecture. This approach eliminates the risk that changes in protected systems will require an extensive revamping of the PAM solution. In contrast, many other PAM solutions require a dedicated software agent on each administered device or workstation. Dedicated agents can delay PAM implementation and create difficulties when applications get upgraded.