In the last 12 months, almost 40 per cent of UK businesses identified a cyber attack. Security incidents considerably impact businesses in all sectors: financial loss, reputational damage, legal and regulatory consequences, loss of intellectual property and significant disruption to operations. As a result, organisations must take decisive steps to prevent, detect and hastily respond to security incidents.
Today, many organisations follow DevOps principles and use tools to develop applications. DevOps is collaborative by nature, connecting development and operations teams to deliver high-quality software solutions faster. However, releasing software quickly must not come at the expense of security. Organisations must follow several security best practices to improve security measures, increase efficiency, enhance collaboration between teams and protect the organisation’s reputation.
Equifax: A Cautionary Tale
Failure to prioritise security may have incredibly serious consequences. Just look at the Equifax data breach—in March 2017, a vulnerability was discovered in an open-source development framework that Equifax used to create Java applications. Unfortunately for Equifax, some employees did not implement the security fixes they were meant to, and vulnerability scans did not flag several of the vulnerable systems, meaning they were not patched. As a result, attackers gained access to Equifax databases over a series of months. The breach resulted in 143 million records being compromised, which included names, addresses, Social Security numbers, dates of birth, driver’s license numbers and some credit card information. In the wake of the disastrous data breach, Equifax has spent $1.4 billion on upgrading its security systems.
Now, let’s explore the steps organisations can take to prevent, detect and respond to security vulnerabilities.
Follow The DevSecOps Model
The DevSecOps model is the integration of security into every stage of the software development lifecycle—think of it as an extension of the DevOps approach that focuses on security. DevSecOps integrates security testing and code analysis into the software building pipeline, which uses automation tools to identify and quickly address security vulnerabilities.
Key principles of DevSecOps include treating Security as Code (SaC) by integrating security into DevOps processes and tools by identifying where security tests and checks may be included without adding extra costs or delays to code and infrastructure changes. Another key principle is using automation tools to monitor software continuously for security vulnerabilities and provide feedback in real-time. Finally, DevSecOps promotes collaboration between developers, operations and security teams, which helps to create a culture of shared responsibility.
Review Change Management Processes
Change management is a process that aims to control changes in the software development process. We recommend conducting a change management process review to ensure it meets security requirements. Make sure there is an approval process for software changes which involves the security team, track software changes with version history and test software changes rigorously before release to ensure there are no viable attack points.
Conduct Security Training
All team members should undergo extensive security training to ensure they have the relevant skills and knowledge to keep the development and deployment processes as secure as possible. In addition, security training will help team members gain a deeper understanding of the security process and each team member's specific roles and responsibilities.
But that's not all—security training will help prepare employees for common cyberattacks, such as phishing. A good way to see how prepared employees are for phishing attacks is to periodically run a phishing test. The test involves sending realistic but fake spear-phishing emails to employees to see how they respond. If they do not respond as they should, it's time to ramp up organisation-wide security training.
Similarly, extensive security training helps team members to better understand governance and compliance requirements and foster a culture of security within the organisation more generally. The good news is plenty of web security courses are available to teach employees about workplace security best practices.
Finally, in-house testing is another essential aspect of improving security. It involves testing software and applications within an organisation's own infrastructure before testing it externally. This approach allows organisations to identify and fix potential attack points, preventing a hacker from taking advantage of security vulnerabilities.
Vulnerability Assessment
A vulnerability assessment involves scanning software for potential weak points and taking action to fix any flagged issues as quickly as possible. Vulnerability management software allows organisations to secure code prior to deployment, ensuring that it is not launched with security gaps that hackers could utilise to access vital systems and sensitive data. It’s important to note that vulnerability assessments should be conducted regularly.
There are several tools to choose from, but the right tool will depend on the nature of your organisation. A potential solution would be to use a generalised scanner that addresses your primary area and layer other areas of your business with scanning tools that specialise in specific areas. For example, implement a scanning tool for areas such as infrastructure, network, image and web applications.
Configuration Management
Last but certainly not least, you should implement configuration management. Configuration management involves managing software configurations throughout the development and deployment process to ensure they are completely secure. The process involves several stages, including configuration identification to ensure all configuration items are accounted for, configuration control to manage changes to the software configuration and configuration status accounting, which is maintaining a record of the status of each item.
Finally, configuration verification and audit involve verifying that the software configuration meets the system design requirements and auditing the system to ensure it complies with relevant governance and compliance requirements. Various configuration management tools are available, including Puppet, Chef or Ansible. We recommend Ansible as it is user-friendly, open source, agentless, customisable, efficient and highly flexible.
Follow Industry Standards
Organisations should ensure they are keeping up to date with industry standards to ensure their systems are secure. For example, the Open Container Initiative (OCI) standard ensures that container images and runtime environments are portable across different platforms and container engines. This helps to reduce the risk of security vulnerabilities caused by platform-specific configurations.
Similarly, the OWASP Top Ten lists the most critical web application security risks organisations must know. The Open Web Application Security Project (OWASP) developed the list, and it is updated regularly to inform developers about common security vulnerabilities in web applications. Security risks currently listed include identification and authentication failures, software and data integrity failures, security misconfiguration, insecure design and security logging and monitoring failures.
In Summary
Cyber attacks can have serious consequences on businesses in all sectors, including financial loss, reputational damage, legal and regulatory consequences, loss of intellectual property, and significant operational disruption. However, by following the six best practices outlined above, organisations can bolster security measures, increase efficiency, enhance team collaboration and protect their reputations.