Rawpixel - Fotolia
IT security best practices for DevOps, cloud and more
Technology is in constant motion, making it difficult for enterprise IT shops to maintain steadfast security. Explore ways to protect DevOps, microservices and cloud environments.
When a stranger shows up at your door in a ski mask, you don't let them into your house. IT security follows a similar rule, but at a much higher level -- and at potentially higher stakes: It's not just about protecting your own home and belongings, but rather a full organization, its employees and its users.
IT security best practices can be difficult to uphold in today's constantly evolving technology market. Security checks throughout IT processes, including in DevOps pipelines, and proper access controls are all part of a healthy security strategy.
In case you missed them, here are some recent TechTarget news stories -- along with a few helpful tips -- on IT security best practices.
Enforce zero-trust model for microservices
It's not enough to secure the exterior of an organization's IT environment. A zero-trust model requires users to log into every tool and application independently -- even after they've gained access to the enterprise network. This system, which is ideal for microservices, ensures that only users with the right credentials can access a given application or data set, but it also requires that all data is classified correctly.
Security improves, but hackers stay smart
As IT applications and environments spin out into collections of individually scalable pieces, IT organizations have begun to embed security measures into the code itself. And while IT has made great strides to streamline and optimize DevOps security, the hackers on offense have a leg up -- and surpassing their abilities could be an exercise in futility.
No one ever goes in
When applications, services and infrastructure splay across an IT environment, each network crossover point represents an opportunity for a man-in-the-middle attack. Protect your organization's applications -- and its CI/CD pipeline -- from malicious keystrokes with both secured connections and key-pair-based authentication, among other IT security best practices.
The new purveyors of IT security
The development of automated DevOps security tools has put IT operations teams on the forefront of security integration in some organizations. The move to security automation is fraught with challenges and missteps, but for those organizations that have taken the leap, IT ops admins are seeding a secure environment to ease the burden on developers -- and prevent the day-to-day battle to eliminate bugs down the line.
Determine ultimate responsibility
Transitioning applications and infrastructure to the cloud leaves open the questions of ownership and responsibility. The cloud provider offers a collection of security features, but that doesn't automatically make a customer's applications secure. Each form of cloud service operates on some level of shared responsibility -- so IT admins must know when they're on the hook, and for what processes.
By whose authority?
IT security best practices must go beyond applications, infrastructure and appliances and extend to an organization's user base. Use a certificate authority server to authenticate all access points -- both human and technological.
Vault the cybersecurity skills gap
Academic computer science programs can't keep up with the rapid pace of IT, which has led to a multi-year skills gap in almost every avenue in IT -- and security isn't immune. The US Department of Homeland Security has gotten creative in its hiring process to find the candidates it needs -- and private sector organizations could benefit.
Smart security isn't a cure-all
AI and machine learning have precipitated vast improvements in IT, but they aren't the perfect fit for every environment -- or every organization. There are, however, four key use cases for AI-infused IT security tools that IT admins should know.
