►
Description
For more Continuous Delivery Foundation content, check out our blog: https://cd.foundation/blog/
Cloud Security in Continuous Delivery - Chen Goldberg, CloudWize
One of the biggest challenges is making sure the continuous integration processes in the cloud are made easy to use and straightforward to all stakeholders involved and in charge of the security. In this session, we’ll explore continuous delivery and security in the cloud, the different stakeholders as CloudOps, DevOps, SREs, Cloud architects, RNDs, and DevSecOps. Chen will also include examples of the challenges and repercussions. We’ll explore the following points: - Setting clear responsibilities between the stakeholders. - What you need to look for in a tool to simplify the process, help protect the cloud and keep up with continuous delivery. - Organized and centralized logs and threats management. Numerous options to handle them. - How to use an autonomous risk management system.
A
A
A
A
A
A
This
is
because
companies
need
today
to
deploy
fast
and
the
process
that
was
supervised
and
took
weeks
to
a
month
or
even
months
now
happen
daily.
The
usage
of
different
technologies,
including
cloud
services
in
the
project
pipeline,
create
the
need
to
define
more
secure
guardrails
in
the
processes,
and
that
should
be
every
company's
vision.
A
Before
the
cloud,
the
company
was
the
only
one
in
charge
of
the
process,
but
moving
to
the
cloud
create
share
responsibility
model.
We
are
sure
that
the
cloud
will
reduce
the
overhead
that
we
used
to
have
managing
on-prem
environment,
but
many
times,
people
that
start
to
migrate
their
workload
into
the
cloud.
Ask
me:
hey,
I
moved
to
the
cloud,
so
why
should
I
need
to
care
about
the
security
and
compliance
the
provider
is
in
charge
of
all
of
that?
Doesn't
it
well.
That
is
not
the
situation.
A
I'm
going
to
show
you
later,
how
exactly
and
what
I
mean-
let's
jump
to
it.
Let's
take,
for
example,
one
of
the
security
requirements.
I
have
encrypt
my
data
so
that
nobody
will
suffer
from
a
data
breach
right
to
do
so.
I
need
to
overview
all
my
services
that
are
related
to
the
data
storage
and
make
sure
that
each
one
of
them
are
enabled
with
encryption.
A
A
This
is
another
thing
about
cloud
security
context
always
find
all
the
connection
between
the
entities
and
the
influence
and
the
trade-offs
that
it
have
understanding
the
old
picture
and
relative
connection
in
that
use
case
might
exposing
sensitive
data
to
other
third
party
or
another
user
that
use
the
cloud
in
a
different
way.
So
we
need
to
keep
in
mind
that
all
the
requirements
I
have
need
to
be
considered
a
not
specific
requirement
regard
configuration
dbs.
It
may
have
context
and
influence
on
other
services
as
well.
A
A
The
first
channel
challenge
is
communication
with
all
the
cloud
stakeholders.
Today,
more
and
more
cloud
stakeholders
have
become
a
part
of
the
cicd
process.
We
need
to
understand
the
boundaries
of
each
other,
understand
the
trade-offs
and
sometimes
look
at
a
different
angle
to
understand
the
whole
picture.
A
As
the
company
become
more
mature,
there
will
be
more
cloud
stakeholders,
but
still
one
of
the
bad
symptoms
is
that
there
is
no
owner
of
the
cloud,
so
we
need
to
work
as
a
team
and
build
good
communication.
Let's
give
an
example
in
the
planning
stage,
we
have
a
security
requirement
from
the
system,
the
one
that
charge
of
all
the
security
in
the
company.
A
A
This
is
another
layer
in
the
pipeline.
The
phenops
is
the
one
that
is
in
charge
of
optimize
the
cloud
regard
expenses
he
or
she
can
ask
the
devops
to
remove
europe
region
entities
because
europe
region
is
more
expensive
than
the
other
regions,
and
by
that
we
ended
with
all
our
stake
outside
of
europe.
How
much
time
do
you
think
will
take
the
security
team
to
understand
what
was
changed?
Remember
once
you
communicate
better,
you
can
get
feedback
right
away
and
get
rid
of
bottlenecks.
A
The
second
challenge
that
we
have
is
lack
of
expertise
in
the
cloud
today.
The
cloud
services
are
changing
on
a
daily
basis
and
it's
hard
to
keep
update
with
all
the
changes.
Still,
we
need
to
make
sure
our
security
team
keep
updating
with
all
the
best
practices.
A
few
way
to
do
so
is
purchase
two
that
aim
to
fulfill
the
gaps,
having
more
security
with
use
meeting
with
your
cloud
account
manager
and
get
assistance
from
the
cloud
providers.
Architects
using
msp
that
have
expertise
in
that
domain,
don't
say
it
will
be.
A
Okay,
make
sure
you
use
all
dimension
and
building
a
center
of
excellence
to
the
cloud
security
in
your
company
challenge.
Number
three
reduce
the
operation
expenses.
We
want
to
make
sure
to
build
a
lean
and
effective
security
system
that
check
only
the
re
relevant
policy.
We
got
my
cloud
architecture
because
our
goal
is
to
build
the
development
pipeline
that
runs
smoothly
and
automatically.
We
want
to
make
sure
no
tasks
are
being
done
manually
and
we
are
not
repeating
them
challenge.
Number
four
is
building
a
system
that
continuously
heals
itself
with
minimum
interruptions.
A
The
last
challenge
I'm
gonna
talk
about
today
is
full
visibility
of
what's
going
on,
and
what
to
do
when
you
get
visibility,
you
can
take
control
in
order
to
get
that
visibility
in
the
cloud,
especially
in
the
cloud
that
refer
to
the
continuous
delivery.
We
need
to
do.
Preliminary
actions
collect
all
the
relevant
data
from
the
cloud
meaning
collect
cloud
services,
configuration
events,
identity
access,
cost
usage,
metrics
logs
network
configuration,
etc.
A
If
you
don't
want
to
pay
the
extra
money
make
sure
you
collect
only
the
relevant
or
the
most
important
environments,
such
as
fraud
or
pre-fraud.
What's
called
staging
also,
once
you're
doing
that,
you
need
to
organize
all
the
data
that
you
collected
the
logs
and
the
security
threads
into
one
centralized
space,
put
all
that
logs
into
centralized
log
system
for
better
understanding
and
now
on
an
audit
process
or
a
bridge.
You
can
act
fast
with
no
missing
pieces
spreading
different
places
and
there
is
no
timeline
boundaries.
A
Today,
cloud
provider
limits
you
with
the
timeline
that
you
can
pull
the
logs,
try
to
find
a
way
to
take
all
the
logs
without
a
limitation
that
you
can
go
back
in
time
and
check
exactly
who
did
what
and
what
was
changed
after
you
get
all
that
logs.
You
now
can
prioritize
the
risk
based
on
the
architecture
stack
and
history
of
attack,
use
miter
community,
and
you
can
find
in
that
miter
community
website
a
lot
of
use
cases
of
previous
attacks.
A
This
will
build
the
knowledge
that
you
need
in
your
company
once
you
have
that
you
can
build
service
mesh
between
the
object
for
getting
context,
information
getting
the
context.
Information
is
help
us
actually
to
understand
how
to
prioritize
risk
and
what
actually
is
do
matter
try
to
build.
On
top
of
that,
simple
views
and
continuous
monitoring
for
full
discovery
and
assessment.
Remember:
cloud
environment
change
rapidly.
So
what
was
yesterday
it's
not
relevant
for
today.
A
A
So
when
you're
talking
about
tool,
you
don't
want
a
flashy
tool
that
will
make
you
crash.
So,
let's
try
to
understand
what
we
are
looking
for
in
a
tool:
here's
how
to
choose
a
security
tool,
first
get
a
tool
that
provides
you
with
what
you
really
need
and
not
based
on
your
decision
is
it
nice
to
have?
Is
that
you're
popular
on
the
web?
No,
I
need
a
tool
that
fulfill
my
requirement.
A
The
tool
should
be
relevant
to
all
the
phases
in
the
continuous
delivery
pipeline.
Each
step
have
its
own
security
checks,
and
you
need
to
make
sure
that
you
get
a
tool
that
fulfill
all
the
stages
make
sure
to
find
one
tool
instead
of
million
tools
that
actually
stay
on
the
shelf
and
you're,
not
using
them
a
tool
need
to
be
customized
for
your
own
needs.
If
you
need
to
write
policy
regard
your
company
requirement,
it's
not
helpful
that
you
got
a
lot
of
lists
of
insight
that
you
cannot
use
or
making
it
false
positive.
A
Remember
some
of
the
stakeholders
are
non-coder,
so
we
need
to
fit
the
two
for
an
encoder
as
well.
We
need
to
consider
all
the
stakeholders
in
the
cloud,
and
some
of
them
are
non-coder,
so
just
try
to
give
them
simple
view
to
understand.
Each
other
needs
investigation,
investigation
capabilities
that
enable
our
professional
services
team,
the
availability
to
forensic
things,
forensic
complex
situation.
A
A
Now
one
thing
to
take
it's
the
two
are
a
means
to
an
end,
not
the
target.
Your
goal
is
to
discover,
investigate
and
react
faster
in
that
continuous
delivery
pipeline.
If
the
tools
slow
you
down,
probably
it's
not
what
you
need
always
ask
this
question:
does
it
save
me
time
in
the
long
run?
Does
it
help
me
reduce
resources?
A
A
Some
key
takeaways
for
the
cloud
security
in
continuously
delivery,
one,
it's
all
about
communication
and
organization
culture
to
succeed.
You
need
teamwork
and
an
understanding
of
each
other
needs.
Second,
define
your
needs
before
you
choose
the
tool,
make
sure
that
you
have
all
stakeholders
requirement
and
everything
is
in
the
tool.
A
The
turn
manual
policy
enforcement
work
into
automatic
workflows
at
each
stage
in
the
continuous
delivery
pipeline,
don't
force
people
to
do
something
that
is
not
in
their
dna
developers
are
not
a
security
people
and
security.
People
are
not
developers.
Remember
that
keep
in
mind
that
you
cannot
make
everything
secure
all
the
time,
but
you
can
build
the
process.