Security should start in software engineering

Businesses need to improve security for engineering teams

When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.

We all know that software engineering is important. Shipping quality code on time is vital to success in the tech industry - and for a variety of other industries also running their businesses from a technology platform or on custom code.

Nicholas Mills is the EMEA General Manager atCircleCI.

So why iscybersecurity, such a vital part of business continuity and availability, apparently so neglected? Of course it’s a complex process, but all too often speed of execution and stability of code are prioritized as a short term win, and the long termsecurityof the code is not well thought out. And when it goes wrong, it can be spectacular, as with the supply chain attack that hit many US enterprises and government systems in late 2020… Forecast to take months to years to unpick, eject, secure, and understand.

Recent hacks demonstrates that when attackers have the upper hand, they really demonstrate considerable agility and innovation, perhaps more than enterprises often can. Now, as a result, technology leaders should be looking to improve security andprivacyat the heart of their CI/CD and software delivery pipeline. The risks are clear and present.

There’s a phrase in cybersecurity circles, that there are organizations that have been hacked and there those that don’t know that they’ve been hacked. It may have been true. Yet across the IT industry standards and awareness have risen, and new generations of tools are in use that leapfrog over the exploitable flaws and limitations of earlier generations. The main challenge is to drum the importance of building for security at the outset into the regularDevOpsmindset and have it resonate throughout every stage ofengineering. And where it already exists within engineering, ensure that the business gets the message. Simply put, growing businesses need to improve software engineering security.

Cloud and the impact on security

Cloud computinguptake has offered many pros and cons for enterprise cybersecurity. The cons have been noteworthy and offer a chance for sober reflection. High profile cyber-attacks demonstrate that attackers have the upper hand, picking and choosing high value targets, and are very agile and innovative in discovering loopholes for access and entrance. As a result, technology leaders need to increasingly be looking for improved security and privacy at the heart of their CI/CD and software delivery pipeline. They need to be able to trust whatcloud servicesthey are using, to know who their users are, and their legitimacy.

Cloud platforms and delivery are clearly now the reasonable default given enforced remote use over 2020 and beyond. Creating a secure cloud environment, and running a secured set of processes and people in the organization on top of it is a topic in which business leaders must be very interested and alert. Cloud is the way organizations are bringing costs down, scaling the business, and collaborating. The impact on security of increasing the attack surface, and in the exploitation of unsecured services, however, is enormous.

Engineering cloud securely

The adoption of Infrastructure as Code (IaC) has dramatically risen as engineers look to deploy cloud infrastructure faster and more efficiently. IaC refers to the technologies and processes that manage and provision infrastructure using machine-readable languages (i.e. code) as opposed to inefficient manual operations. Languages and frameworks, like Terraform and Pulumi, provide a unified language to codify infrastructure and streamline cloud orchestration across different environments and providers. Alternatively, cloud providers’ native IaC frameworks, such as AWS CloudFormation and Azure Resource Manager (ARM), transform manual, one-off processes into consistent, scalable, and repeatable provisioning.

Are you a pro? Subscribe to our newsletter

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

IaC offers opportunities to automate, scale, and secure cloud environments. Now, many organizations are in a perilous state because in the past they had to approach cloud security after-the-fact. This was done via resource monitoring for policy violations during runtime. Even with automation in place, this approach can end up being time-consuming and arduous for engineers that need to address identified issues reactively. By extrapolating cloud infrastructure into code and embedding it into the development lifecycle, teams can now address cloud security preventatively. So with IaC engineers can enforce security best practices alongside container scanning, dependency scanning, and so on. For it to be truly effective, it must be embedded into automated CI pipelines.

Hosting securely in the cloud

For those hosting in a cloud environment, it’s vital to ensure to check the monitoring tools of that environment. Azure has Application Insights, and AWS has CloudWatch Application Insights. Put them to good use. They can track malicious login attempts, unauthorized access, and errors coming from your application.

Consider a software platform that offers reusable, shareable, open source packages of configuration. The idea is to enable the immediate integration of third-party services, including security tools such as scanner services that help hunt down cloud vulnerabilities. Scanners like AWS Parameter Store (for managing and loading environment secrets), Checkmarx (for static and interactive application security testing), or Probely (for scanning your web application for vulnerabilities).

When it comes down to it, nowadays organizations do not need to choose between speed or security when innovating. Automation and the right third party they can take to reduce the risk of revealing secrets and minimizing attack from bad actors.

Vulnerability management is just one area where continuous integration/continuous development (CI/CD) acts as a force multiplier for development teams. Building resilient systems allows teams to ship high-quality code in less time with lower risk. By putting the CI pipeline to work the business gets access to a key differentiator and leverage point for the organization.

Nicholas Mills is the EMEA General Manager at CircleCI.

Phishing attacks surge in 2024 as cybercriminals adopt AI tools and multi-channel tactics

This new phishing strategy utilizes GitHub comments to distribute malware

Arcane season 2 finally gave us the huge Caitlyn and Vi moment we’ve been waiting for – and its creators say ‘we couldn’t have done it in season one’