Beware of these creatures lurking in your DevSecOps teams

Source:-https://sdtimes.com

Halloween is upon us, and while much of the world is focused on scary creatures like ghosts, ghouls, or werewolves, DevSecOps teams have a few scary creatures of their own to deal with.

From the Dracula-like developer stuck in a world from centuries ago who is thwarting the creation of secure apps, to the DevOps ghosts that downplay the importance of app vulnerabilities, it’s important for DevSecOps teams to understand the threats that may be lurking in their own teams.

First off, there are the Dracula-like developers who are stuck centuries in the past. According to Dennis Hurst, founder of Saltworks Security, these developers exist out of a desire not to change the way they write code. “We run into this a lot, of ‘we’ve always built an application this way, why do I need to security test it?’ And they’re not sort of realizing that these applications are now on the internet, they’re public facing, or they’re connected to things that are on the internet, or they’re running in a cloud infrastructure so it’s no longer a nice sort of happy data center,” said Hurst.

According to Hurst, the way for teams to overcome these Dracula-like team members is to have clear leadership. “Without strong leadership, team members feel free to keep doing what they have always done, which stifles innovation,” he said.

Another scary member of the DevSecOps team to look out for are DevOps ghosts, in other words, shadow IT. According to Hurst, these are the people that believe “they can just magically go around all of IT and go straight to the cloud. The applications are there, sort of like ghosts, you hear them rattling around and you know that they’re there but you don’t actually see them, nobody knows about them, they’re kind of – maybe they’ll be there. We see this a lot in security where we find applications running on the internet that no one knew about.”

Hurst added that this isn’t a rare occurrence; it’s actually fairly common, especially with more employees working from home. People go home and take their laptops with them, so how do you secure that?

“A lot of companies have jumped to the cloud for some parts of their business because of COVID, maybe they couldn’t get to the data center,” said Hurst. “So it’s just easier for people to get in their mind that ‘oh, I can just stand this application up in the cloud and when this is all over with we’ll figure out how to get it back in-house.’ We’re definitely seeing it more. We’re seeing more people going to the cloud, maybe using a corporate credit card to open the accounts even, so it’s not even a corporate owned account even, it’s just somebody’s personal credit card that they use to stand up a website somewhere, we see that more than we would like.”

Hurst believes that using monitoring systems is one of the biggest ways to protect against shadow IT. He explained that there are services that monitor the internet looking for properties that point back to or are linked to the company’s IT infrastructure. A big downside is that there isn’t really a proactive way of preventing someone from spinning up a service on their own. “Anyone can go out and stand up a website, but you can monitor to see when it happens. The faster you can address it, the easier it is to manage,” said Hurst. “So if a website is stood up for a day, it’s pretty easy to take that down or get them to move it. If it’s there for 6 months or a year, doing business, it becomes much stickier and challenging to get pulled out because you’re taking business offline.”