New Accurics App Gives GitHub Users New Code Scanning Feature

anil — Fri, 09 Oct 2020 06:08:34 +0000

Source:-https://adtmag.com

Cloud security provider Accurics this week announced a new GitHub application designed to further automate the programmatic enforcement of security policies throughout the software development workflow.

The Accurics platform and the Terrascan tool for detecting compliance and security violations across Infrastructure as Code (IaC) have both been accessible through GitHub Actions for a while. Terrascan is accessible through the popular Super-Linter action. The Accurics platform is available through the company’s own action.

The new GitHub App adds an option for the automation of that enforcement, explained Accurics developer advocate Jon Jarboe, in a blog post. It provides a library of more than 500 policies aligned with compliance standards, such as the CIS benchmark. New commits and pull requests are automatically scanned for policy violations, and when security risks are found, they are added to the PR and/or repo as issues.
By adding Accurics to code scanning, any GitHub user can automate the elimination of security risks from their infrastructure as code before and after deployment, Jarboe said.

“Given the success of high-velocity DevOps teams, we believe that self-healing infrastructure is the only way to embed security into DevOps without breaking it,” Jarboe added. “Reactive processes that require manual actions simply cannot keep up. The rapid adoption of infrastructure as code provides an excellent opportunity to implement guardrails throughout the development lifecycle, starting in the earliest stages.

The new GitHub Accurics App was part of the GitHub announcement this week for integration with new third-party code scanning tools for IaC and container scanning.

“By expanding our GitHub security ecosystem, developers can use their tools of choice for any of their projects on GitHub, all within the native GitHub experience they love,” said GitHub senior business development manager Jose Palafox, in a blog post. “Our integrations tightly couple the developer workflow with a security review through GitHub Actions and Apps.”

Along with Accurics, GitHub announced integrations with 42Crunch (API Contract Security Audit), Bridgecrew (developer-first platform for streamlining cloud security), Snyk Infrastructure as Code and Snyk Container security platforms, Aqua Security (pure-play cloud native security company), and Anchore (enterprise container security workflow solution).

The Pleasanton, CA-based Accurics focuses on enabling “immutable security for immutable infrastructure, so that organizations can embrace cloud native technologies with confidence.” The company’s namesake solution seamlessly scans IaC for misconfigurations based on common policy frameworks and detects potential breach paths to eliminate risks before cloud infrastructure is provisioned. It then monitors provisioned cloud infrastructure for configuration changes that introduce posture drift, and enables reverting to a secure posture.

“GitHub is a luminary in the software development world,” Jarboe said, “and we’re excited to work with them to help deliver to their users the ability to programmatically detect and fix security risks through its new code scanning.”

Roll DevOps tools into your AWS migration plan

anil — Tue, 23 May 2017 06:54:30 +0000

Source – techtarget.com

accelerated dePublic cloud platforms such as AWS have changed how many businesses develop applications. Cloud affords development times — and enables some dev teams to release new features and app updates multiple times a day. But none of this would be possible without a vast array of DevOps tools and services.

After an AWS migration, businesses can model their infrastructure as code (IaC), build and test code with managed services and automate deployments using continuous integration (CI) and continuous delivery (CD) orchestration services. Enterprises that haven’t yet embraced cloud, however, have a long wait before they can see the benefits of using AWS DevOps tools. But before IT teams become technically proficient with AWS tools and services, they must make a cultural shift and change the way they think about traditional deployments.

Businesses should devise a strategy to take advantage of the new capabilities that are available after moving to AWS. Businesses can reach improved levels of operational maturity post-AWS migration, but it takes commitment and know-how from all lines of business.

Define infrastructure as code for resiliency

Operations engineers who work in on-premises data centers spend a lot of time writing server build documents that ensure other IT staff members follow the steps to properly deploy businesses workloads. But this approach has potential problems. Step-by-step documents go out of date quickly. And humans make mistakes, especially when they get tired and are reading through a long build document.

Using IaC during an AWS deployment means replacing old server build documents with a declarative template that can provision any AWS resource as needed. IaC templates become executable versions of those documents.

Administrators can author IaC templates with AWS CloudFormation and then store them in a version control service, such as AWS CodeCommit or GitHub. Once the admin defines IaC, the IT team can build a replica of the production environment for testing; this provides an exact infrastructure blueprint in case teams ever need to rebuild the infrastructure.

Embrace configuration management early in an AWS migration

While admins can use IaC templates to provision AWS infrastructure, they will likely have to run multiple server operating systems on various Elastic Compute Cloud (EC2) instances. Before automating deployments with code, developers and admins need to be up to speed with the concept of configuration management (CM). Many IT teams already use CM tools, which provide a way to automate the configuration of applications and the OS. In addition, CM tools can prevent configuration drift — server or application settings changing over time on a system because of a mistake or the installation of another application.

AWS integrates with all CM tools as well as OpsWorks, the configuration management service based on Chef. Amazon EC2 Systems Manager works as a Chef alternative to automate system patching, build and query inventories and automate the execution of any command with its Run Command feature. This enables admins to use existing CM assets or EC2 Systems Manager with Run Command and a State Manager feature to consistently configure applications and eliminate configuration drift.

Enforce compliance through policy as code

Beware of unexpected server or application settings that can take down an application. Automated compliance controls in AWS can prevent these problems, and enterprises should implement them shortly after an AWS migration.

One such service, AWS Config, takes inventory on AWS resources. In addition, AWS Config Rules ensures that resources comply with a desired state. AWS records state changes and alerts an IT team whenever a user creates, deletes or modifies any AWS resource.

Implement monitoring and logging

It’s important to collect and monitor application performance information and log files. Amazon CloudWatch collects performance metrics from all types of systems and monitors log files. IT teams receive alerts when system performance lags or when errors occur in log files. CloudWatch metrics and alarms also play key roles in Auto Scaling servers based on resource utilization. For example, admins can create a CloudWatch Alarm that triggers a scale-out action to deploy additional EC2 instances when CPU use on existing servers rises above a certain threshold. Alternatively, configure a scale-in action to delete additional capacity when the resource demand drops back down.

IT teams can also tap into event-based automation capabilities. Admins can configure CloudWatch Events with rules that trigger custom logic when changes are made to resources. Use state-changes data from various services as the source of these rules; this includes activity, such as launching EC2 instances or signing into the AWS Management Console. Configure rules with targets that can take an action on these events. Common actions use AWS Lambda functions with custom logic or Simple Notification Service topics that send an IT team a notification about the event.

Use CI and CD

CI is useful when merging small changes to code into a central repository. Admins then can run automated builds and unit tests to compile applications and ensure the code works as expected. This process helps to quickly identify bugs and improve software quality.

CD takes CI a step further. The CD process ensures that the code is ready to move to development or staging for further testing. Once all tests have passed, the latest version of the application is deployable to production.

Businesses can implement CI and CD with AWS-native services. AWS CodeCommit works as a secure version-control repository; AWS CodeBuild automatically performs builds when code enters the repository. AWS CodePipeline makes sure committed code is automatically built, tested and deployed into testing or staging environments, which ties together the various CI and CD services.