CI/CD as a Service: Securing Velocity in the Cloud

Size: px

Start display at page:

Download "CI/CD as a Service: Securing Velocity in the Cloud"

Brianne Page
5 years ago
Views:

1 CI/CD as a Service: Securing Velocity in the Cloud Scott Harvey November 1st, 2017

Agenda Understand The basic concepts of DevOps The benefits/barriers of adopting DevOps The security problem DevOps introduces The benefits of

2 Agenda Understand The basic concepts of DevOps The benefits/barriers of adopting DevOps The security problem DevOps introduces The benefits of consuming DevOps tools as a Service The specific benefits of CICDaaS Motivate An investigation of how CaaS can help solve business problems facing you today 2

3 Basic Concepts of DevOps We know DevOps: Has many definitions Is used as a catch phrase or buzzword DevOps might be: A methodology A method A technique A culture Agile 3

4 Basic Concepts of DevOps Culture of: Collaboration Speed Measurement Techniques to: Develop Test Deploy Tools to: Measure Automate 4

Basic Concepts of DevOps DevOps can be thought of the practice of operations and development engineers working as one team during the entire product lifecycle.

5 Basic Concepts of DevOps DevOps can be thought of the practice of operations and development engineers working as one team during the entire product lifecycle. This spans from product ideation, to design, development, production, and deployment. DevOps can also be characterized by the operational staff making use of many of the same techniques as developers for their systems work. Scripting Desired state configuration tools Infrastructure as Code Unit, feature, integration, system test frameworks Bug tracking Continuous Integration / Continuous Development or CICD 5

6 Benefits of Adopting DevOps Moving from 1-2 deploys per year to up to Moving from 31-45% failure rate to < 7.5% 6

7 Benefits of Adopting DevOps In addition to speed and accuracy DevOps improves: Recovery time Releasing weekly/daily/hourly improves opportunities to recover. Change lead time The processes in place and familiarity with them allows teams to consume change faster. 7

8 It s hard! Tools are complex, multi-origin, and rapidly changing. New paradigms in development. New strategies for deployment. Barriers to Adopting DevOps Best DevOps practices are most often counter to traditional Development and Operations departmental values... And it takes time to Retrain development and operational resources in the new paradigms necessary. Assess the security and compliance implications of tooling decisions. 8

9 Because it s hard and it takes time, the culture has to shift Development Departments Cause instability by creating change - New features - New products - Iteration Agile processes Operational Departments Create stability by resisting change - Strict change controls - Checklists - Isolation Static processes This is the largest risk of failure in creating/migrating to a DevOps strategy. 9

10 Security Problems with DevOps Traditional non-operational development resources have access to infrastructure. Operational environment footprint expansion which now includes: + Corporate networks + WiFi and rogue access points + Home networks and routers + Mobile devices + Bring your own devices (laptops, tablets, etc.) 10

11 Public clouds and XaaS More and more XaaS offerings are being hosted on a public cloud are they easy to operate? how much do they cost? are they secure? how do they change an operational model? 11

The benefits of consuming DevOps as a Service CaaS providers facilitate a zero/low barrier to best practices and tooling. Experience Platform certified and audited staff.

12 The benefits of consuming DevOps as a Service CaaS providers facilitate a zero/low barrier to best practices and tooling. Experience Platform certified and audited staff. Deep connections to the platform provider. Diverse experience with security and compliance frameworks. Standard deployment scenarios that simplify management, reliability, and security. Known pitfalls Azure ASR replication with SQL. CPU limits in tenants. IP limits when using load balancers. Billing/Support Simplified billing and support structure with the same provider doing both. Complex billing from platform providers is streamlined. 12

13 The benefits of consuming DevOps as a Service Access to an ever evolving library against a platform Terraform/ARM template build system Deploy environments from JSON templates. Infrastructure deployed and created from pre-hardened templates. Azure Functions Turn a development box on and off on a schedule. Turn boxes off and on by simply hitting a web page. Copy active DBs back into test and development environments on demand. Traffic Manager Monitor protocols other than HTTP/HTTPS to leverage Traffic Manager logic. ETL conversion utilities Migration logic for existing SSIS packages to PaaS SQL with Analysis Services and data warehousing 13

14 CICD as a Service Complete solutions to solve everyday problems: CICD as a Service Automated unit, feature, system/integration, and sanity testing: Pre-built repositories for code, tests, and DB (T-SQL) All content automatically included in build and promotion from repositories. Built and maintained by cloud platform and security trained technicians. Proxy DevOps Engineers Reduced headcount need as access to toolchain engineers is built into the service. Cloud platform trained technicians. Pre-built security. Turnkey system to manage web/site assets and application code. Works with existing Content Management Systems (CMSes). Provides easily consumable tooling. 14

How to Get Started Investigate how DevOps & public cloud can work for you. Are you concerned about how security in your development processes could affect your business?

15 How to Get Started Investigate how DevOps & public cloud can work for you. Are you concerned about how security in your development processes could affect your business? Could you speed delivery and accuracy of your revenue critical applications? Do you want to leverage industry best practices and tools? Can you use a partner that is completely aligned, trained and certified to operate a providers public cloud? Would you like access to an ever evolving library of IP to solve everyday security challenges and problems in public cloud environments? 15

16 Questions and Answers 16

17 Credits theagileadmin.com 2017 State of DevOps Report Puppet/DORA 2017 State of DevOps InteropITX Research azure.microsoft.com xmatters Atlassian DevOps Maturity Survey Report

Adopting Azure Resource Manager for efficient cloud infrastructure management

Microsoft IT Showcase Adopting Azure Resource Manager for efficient cloud infrastructure management Microsoft IT runs in the cloud. We have a massive investment in Microsoft Azure for our cloud IT infrastructure,