Enabling DevSecOps with the Elastic Stack

Software development and delivery is an ever-changing landscape. Writing software was once an art form all its own, where you could write and deploy machine code with singleness of purpose and no concern for things like connecting to other computers. But as the world and the variety of systems that software supports became more complex, so did the ecosystem supporting software development. Advances in how software is made, where it runs, what it affects, and how to protect those systems have accelerated the need for Ops and Sec to address the evolving complexities of the underlying systems that Dev depends on and deploys to. 

As these systems have continued to mature over the years, the lines between them have begun to blur. What used to be separate and distinct teams handling the development, security, and IT operations have found it more effective to share the load. Dev and Ops have been working together for quite a while to improve speed and automation around software delivery and deployments, but many of those gains are lost when security isn’t part of the planning and design from the beginning.

Deploying insecure software affects all of those systems, slowing down the release of future features while developers troubleshoot and fix issues, potentially compromising the infrastructure the software resides on and connects to, and eroding consumer trust in the software. The result has been a need for the combined approach of DevSecOps, where teams collaborate at the beginning of the process, often called the shift-left mentality — an approach Elastic greatly enhances with our wide array of integrations and out-of-the-box solutions.

Better together

Each of the teams involved in DevSecOps have slightly different concerns and priorities, but the goals and methods are symbiotic and supportive of each other. Developers are concerned with ensuring workflows are optimized for speed, measuring progress and keeping backlog under control, and maintaining quality standards throughout the Dev cycle. IT Ops teams care about ensuring that architecture and infrastructure requirements are clearly defined and validated to ensure availability, optimal performance, and scalability. Security teams care about ensuring that the potential for data leakage is minimized, that the organization's security and compliance posture is not compromised throughout the dev/test lifecycle, and that application security is addressed proactively through code reviews and test runs. 

By enforcing security in the agile development process up front, security is integrated at the lowest levels of the lifecycle and revalidated at successive levels, resulting in much faster and more secure systems across the board. 

In practice, DevSecOps is both a mentality and workflow that provides the following:

• Automated build, test, scan, and deployment processes
• Reduced “drift” between deployments by standardizing configurations
• Reduced attack surface through the use of pre-hardened components
• Full observability across the entire stack, including infrastructure, applications, and access
• Improved resilience with the ability for loosely coupled components to fail gracefully or be replaced easily

A DevSecOps approach requires more coordination and up-front agreement across each of the teams about the dependencies and goals to be achieved at each sprint, but the end result is robust code that adheres to several ideals at once:

• Continuous integration, continuous delivery/deployment (CI/CD): Building blocks with hardened containers, automated build and testing 
• Infrastructure as Code (IaC): System and network automation and orchestration with security controls, zero-trust and chaos engineering principles built in
• Ruggedness: Security that is built in at the initial stages rather than being an afterthought 
• Continuous monitoring: The ability to monitor and measure all aspects of the infrastructure and workloads running there; used for security, auditing, compliance, and performance
• Environment-agnostic builds: Open standards for flexibility and stability of deployment and avoidance of platform lock-in while still preferring supported software

Elastic ♡s DevSecOps

So where does Elastic fit in the world of DevSecOps? You’ve likely heard that Elastic’s really good with unifying and analyzing all your data, right? There are so many aspects of your DevSecOps ecosystem that the Elastic Stack supports and enhances.

Finding all relevant information is the very first step in any data operation and often the deciding factor between success and failure for that operation. Fast search over all data sources is the key to making critical business decisions, identifying performance issues, and detecting internal or external threats. The Elastic Stack is an open source search-based technology that is highly distributed, extremely fast, and enables the ingestion, analysis, and secure access of all types of data. In addition to the blazing fast search and aggregations Elasticsearch provides, there are several core features built into the fabric of the Elastic Stack that provide for things like automated data distribution and resilience, policy-driven data lifecycle management, integrated role- and attribute-based access controls (RBAC/ABAC), machine learning, and alerting — to name a few. 

The diagram above depicts several of the possible integration points where the Elastic Stack can be found within a DevSecOps environment — both in the software factory where the pipelines are built and run, and in the deployment platform that consumes the products of the software factory.  

Elastic easily integrates with and complements your existing DevSecOps infrastructure and data sources. You have the power and flexibility to capture and analyze every layer of your operation: 

• Provide complete observability of all logs, metrics, application performance, and security across the DevSecOps infrastructure and operations 
• Monitor, measure, and analyze every step of your CI/CD pipelines from a performance and availability standpoint, as well as for business KPIs
• Protect, monitor, and report on the deployment and container orchestration platform
• Monitor all containers that get instantiated in your deployment platform by integrating Beats as a daemonset or sidecar to the basic template used for all containers
• Use your DevSecOps workflows to deploy the components of the Elastic Stack as pre-configured, pre-hardened, auto-scaling, orchestrated artifacts to support all of your enterprise search, observability, and security operations

Conclusion

DevSecOps is a combination of tools, concepts, and workflows that’s making software development and deployment faster, more reliable, and more secure. Elastic can unify all your data to help you monitor and troubleshoot systems that enable DevSecOps to work together and more efficiently.

If you’d like to learn more about monitoring Kubernetes and containers with the Elastic Stack, check out one of our several blogs or recorded webinars on the topic, and then try it out for yourself by spinning up a 14-day free trial of Elasticsearch Service. And if you’re interested in diving deeper into continuous monitoring and observability with the Elastic Stack, be sure to join us for a free virtual event where you can learn from the experts and hear from peers solving DevSecOps problems with Elastic Observability. 

Additional resources

DevSecOps: Everything You Want to Know, But Are Afraid to Ask (recorded webinar)