Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Security Management

9/7/2017
04:20 PM
Simon Marshall
Simon Marshall
Simon Marshall
50%
50%

DevOps Security Management Goes Central

CyberArk is taking a centralized view of DevOps security through Conjur.

Elizabeth Lawler, founder, CEO Conjur Inc. and now VP, DevOps security at acquisitor CyberArk, is well connected. Today, she posted a celebratory remark on her LinkedIn page -- that Conjur, a DevOps security platform, is now an open source project for all. So, she reached out on both LinkedIn and simultaneously to the entire open source community. Pretty good for a day's work.

Lawler, who has a doctorate in epidemiology from BU, is right at the front of a push to enable enterprise DevOps security that offers lightning-pace creation and development of software -- the DevOps work mode -- to continue without any of the downside that can be caused by working that quickly. It's vital to make sure that secrets are secure, and the rapidity of the DevOps culture means that the faster you go, the more risks you take with them.

Security is unfortunately not usually included within DevOps initiatives. In a 2016 report from Gartner, "Top 10 Strategic Technology Trends for 2016: Adaptive Security Architecture," "…fewer than 20% of enterprise security architects have engaged to systematically incorporate information security into their organizations' DevOps initiatives."

The threat is a bit like a highly specialized spacecraft that's going where no man has gone before -- traveling and exploring ever faster -- but fragmenting and breaking up upon landing. CyberArk, which acquired Conjur in May, claims to have reinforced the spacecraft without slowing it down, if you will.

So what needs protecting? Within DevOps, there's a requirement to batten down security across a wide range of areas, broadly comprising HTTP services such as authentication, permission checks, secrets and public keys. There's also a need to perform dynamic updates, such as change secret values and enroll new hosts. It's a tough puzzle.

"There are lots of aspects to the DevOps methodology that make security a complex thing," Lawler told SecurityNow. "The tendency is for departments to adopt many security tools, not just one. There's no common tool or standard approach for everyone. [The workaround] is sometimes that there's a single super-privileged person who holds all the security credentials, and that's a big risk."


Get real-world answers to virtualization challenges from industry leaders. Join us for the NFV & Carrier SDN event in Denver. Register now for this exclusive opportunity to learn from and network with industry experts – communications service providers get in free!

According to Lawler, DevOps security needs to be "shifted to the left," -- that is, protection is applied and embedded as early in the software development process as possible, not after the fact. This is optimal because many issues can be caused by humans, and the number of hands that touch the software, either unintentionally or through misadventure. Another dynamic is that the key metric for software engineers and developers is the amount of code they deliver -- they're not measured on how many bugs they eliminate, and that can lead to a lack of experience in secrets management.

"When we founded Conjur in 2013, most of our customers needed to be security standards compliant. 2014 and 2015 marked the widespread adoption of DevOps and open source technology by larger enterprises," Lawler said. "So, we decided to work with the DevOps people because the IT security groups were not as close to next-generation security tools; we wanted to be the bridge between security, compliance and DevOps."

CyberArk currently has 50% of the Fortune 100 as customers.

Related posts:

— Simon Marshall, Technology Journalist, special to Security Now

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Overcoming the Challenge of Shorter Certificate Lifespans
Mike Cooper, Founder & CEO of Revocent,  10/15/2020
US Counterintelligence Director & Fmr. Europol Leader Talk Election Security
Kelly Sheridan, Staff Editor, Dark Reading,  10/16/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9417
PUBLISHED: 2020-10-20
The Transaction Insight reporting component of TIBCO Software Inc.'s TIBCO Foresight Archive and Retrieval System, TIBCO Foresight Archive and Retrieval System Healthcare Edition, TIBCO Foresight Operational Monitor, TIBCO Foresight Operational Monitor Healthcare Edition, TIBCO Foresight Transaction...
CVE-2020-15264
PUBLISHED: 2020-10-20
The Boxstarter installer before version 2.13.0 configures C:\ProgramData\Boxstarter to be in the system-wide PATH environment variable. However, this directory is writable by normal, unprivileged users. To exploit the vulnerability, place a DLL in this directory that a privileged service is looking ...
CVE-2020-15269
PUBLISHED: 2020-10-20
In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.
CVE-2019-9080
PUBLISHED: 2020-10-20
DomainMOD before 4.14.0 uses MD5 without a salt for password storage.
CVE-2020-15931
PUBLISHED: 2020-10-20
Netwrix Account Lockout Examiner before 5.1 allows remote attackers to capture the Net-NTLMv1/v2 authentication challenge hash of the Domain Administrator (that is configured within the product in its installation state) by generating a single Kerberos Pre-Authentication Failed (ID 4771) event on a ...