Separation of Duties for DevOps

Continuous integration / delivery / deployment / verification (CI/CD/CV) all need to be segmented in org's processes.  

While this may be more difficult for on-premise deployments (Jenkins / Bamboo), most cloud PaaS offerings make this easier, especially AWS with their Code* portfolio (CodePipeline / CodeBuild / CodeDeploy).

 

Well-Architected Frameworks for Cloud Service Providers (CSP)

 CSPs now have created thought leadership for architecting cloud-based workloads:

Amazon (AWS): https://docs.aws.amazon.com/wellarchitected/latest/framework/wellarchitected-framework.pdf

Microsoft Azure: https://azure.microsoft.com/en-us/blog/introducing-the-microsoft-azure-wellarchitected-framework/

Google (GCP): https://cloud.google.com/architecture/framework

Oracle (OCI): https://www.oracle.com/cloud/architecture-center.html

AWS Lambda, Serverless Function-as-a-Service (FaaS), Primer

AWS paved the way via FaaS years ago.  However, I have yet to find a succinct, aggregation of best practices on how to use & deploy these solutions.  So, here you go:

Overview/Serverless Application Model (SAM): https://d1.awsstatic.com/whitepapers/serverless-architectures-with-aws-lambda.pdf; https://aws.amazon.com/blogs/compute/building-well-architected-serverless-applications-approaching-application-lifecycle-management-part-1/; https://aws.amazon.com/blogs/compute/category/compute/aws-serverless-application-model/; https://docs.aws.amazon.com/wellarchitected/latest/framework/wellarchitected-framework.pdf

Orchestrating serverless services: https://theburningmonk.com/2020/08/choreography-vs-orchestration-in-the-land-of-serverless/

Tracing & monitoring Lambda: https://www.infoq.com/articles/tracing-aws-lambda-functions/; https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-cloudwatch-metrics-logging.html

Negating latency challenges with cold starts: https://epsagon.com/development/how-to-minimize-aws-lambda-cold-starts/

Securing Lambda functions: https://medium.com/orchestrated/steps-to-secure-aws-serverless-lambda-part-1-a6e5d1b05f45

Edge functions: https://www.stackery.io/blog/lambda-at-edge/

Securing edge functions: https://aws.amazon.com/blogs/networking-and-content-delivery/authorizationedge-how-to-use-lambdaedge-and-json-web-tokens-to-enhance-web-application-security/ 

Tagging: https://www.cloudforecast.io/blog/aws-tagging-best-practices/

Layer-7 Logging

PPT on Layer-7 Logging

Hypervisor Replication for Virtualization Security

Vendors like Bracket & BitDefender are rolling out virtualization security solutions meant for hybrid cloud deployment to negate rootkits & chip-based exploits (Spectre, Meltdown).

However, comprehensive coverage / support seems limited & you would think that the big cloud service providers (CSPs: AWS, MSFT Azure, GCP) have hardened their own hypervisors already.

VMware's partnership w/ AWS could pave the way for hardened hypervisors that can lift & shift among on / off prem deployments.

Does MBaaS Equate to Vendor Lock-in?

Sounds like it.  Another question would be as to whether or not to redesign old solutions (e.g., Python, Twisted, etc.) to embrace  this new era.....

The InfoSec value-add of using MBaaS like AWS's (https://aws.amazon.com/answers/mobile/aws-mobile-app-backend/) would certainly be enhanced IAM / IdM (one would think at least).  So, would that juice justify the squeeze?  TDB....

Azure, Big Data, & Security

So, Microsoft has provided further innovation and thought leadership with the cloud, Big Data, & security.

As of late, Azure now offers a preview (i.e., BETA) of its Storage Service Encryption (SSE) offering for its Data Lake Store offering to complement the add-on crypto services one may use for its HDInsight (i.e., Hadoop) offering, namely integration with DgSecure.

The jury is still out on the ease of use, as well as how robust these offerings are, but, it seems Microsoft is ahead of the curve with cloud & Big Data security.

Will AWS catch-up?

Securing Native Big Data Deployments v3.0: Apache Ranger & Atlas for DevSecOps, IAM, & InfoGov

Apache Ranger (http://ranger.apache.org/) and Atlas (http://atlas.incubator.apache.org/) offer some real thought leadership for securing native big data environments.

The question that remains is, will corporate IT teams embrace these new technologies?

I do see (cloud) providers (MS Azure, AWS) using these tools, as they need to for security compliance purposes.  I also see on-premise (hyper-convergence) solution vendors (e.g., Hortonworks, Cloudera) leveraging this as well.

Cloud, CMDB, CI, & DevSecOps

AWS is changing the game w/ real thought leadership on CMDB, CI, & DevSecOps w/ rolling out: AWS Config, CodeCommit, & CodeDeploy.

Now, the question is how great do these services sync w/ on-premise solutions?  Jenkins, sure.  Local CMDB, probably not...

Also, will Microsoft (Azure) play catch-up?  Yes, they have Openness, though it really doesn't support organic services.

To be continued...