The Need for Automation in Modern Microservice Environments
August 15, 2018

Reuven Harrison
Tufin

Microservices are a hot topic in IT circles these days. The idea of a modular approach to system building – where you have numerous, smaller software services that talk to each other instead of monolithic components – has many benefits.

Speed and the ability to change and adapt on the fly are often cited as reasons for the growing interest in and adoption of a microservices approach. Today's companies need to innovate quickly to remain at the top of their industries. Traditional development methodologies simply take too long. You need to be agile in order to establish and maintain your competitive advantage. 

That brings up competing goals between developers and security, but it doesn’t have to. Instead, there is a tradeoff that needs to happen between developers and security teams around the level of control each team has. The ideal scenario is that developers will control every step of the CI/CD pipeline in order to move fast, while allowing the security team to control enough of the process to make sure that security and compliance policies are adhered to.

Where is the middle ground? How can you heighten security without slowing development? How can organizations achieve this level of collaboration and make it work to their advantage?

Visibility

To be successful, visibility is key. For developers, this is the ability to see whether they adhere to security and compliance policies or not. These checks must happen at every stage of the CI/CD process. Security teams require the visibility to know whether developers are producing configurations that are aligned to security and compliances policies.

Without an easy way to view all activity, there's no way to make sure microservices are operating properly – which makes it increasingly harder to identify risk and solve potential problems.

But just having visibility into your systems – and knowledge of potential problems – isn't enough. You need to be able to protect against vulnerabilities and risky connectivity issues, while also establishing a way to make adjustments without limiting the efficiency and productivity of your developers. 

Automation

Automation makes sense for organizations that have embraced the DevOps approach to software delivery. Using continuous integration and continuous delivery tools, services can be created and modified so often that it becomes impossible to manually review and ensure each one is configured, deployed and communicating as intended – or is being operated in compliance with corporate security policies. Automating security in line with company policies can help protect microservices no matter where they're deployed – on-premise, or in a private or public cloud.

With automation, it becomes easier to identify and protect vulnerable containers that could be externally accessible. Automation should be used to find security issues and then take actions to close up those vulnerabilities, limiting the impact of a breach or preventing one altogether. In addition, as any IT professional knows, the type and style of security issues and potential attacks change on a regular basis. Staying on top of each new potential security issue and constantly monitoring your implementations for them is difficult work; automation can do it for you on a regular basis. 

The best part is that automation can work in the background – ensuring that developers and teams are not bothered by the process, are automatically brought in line with corporate security policy – and do not have their efforts limited because of the need to remain compliant.

When done correctly, automation is an enabler of DevOps – making it easier for developers to build, deploy and operate secure applications at scale. 

Conclusion 

In embracing DevOps and microservices, companies have made a conscious decision to replace stale and inefficient business processes with more agile and effective ones that enable collaboration and empower innovation. It is easy to see that traditional security controls and processes are no fit for today’s development world. 

To be successful, organizations need visibility into and control of these new environments – and need it without disrupting the agile development process they have worked so hard to put in place. By embracing automation, they can truly have the best of both worlds. 

Reuven Harrison is CTO of Tufin

The Latest

September 24, 2018

From how applications and infrastructure are developed, configured and built to how they are tested and deployed, pervasive automation is the key to achieving better efficiency and standardization that gives companies the competitive edge. Pervasive automation is the concept of scaling automation broadly and deeply across the entire software delivery lifecycle ...

September 20, 2018

The latest Accelerate State of DevOps Report from DORA focuses on the importance of the database and shows that integrating it into DevOps avoids time-consuming, unprofitable delays that can derail the benefits DevOps otherwise brings. It highlights four key practices that are essential to successful database DevOps ...

September 18, 2018

To celebrate IT Professionals Day 2018 (this year on September 18), the SolarWinds IT Pro Day 2018: A World Powered by Tech Pros survey explores a "Tech PROactive" world where technology professionals have the time, resources, and ability to use their technology prowess to do absolutely anything ...

September 17, 2018

The role of DevOps in capitalizing on the benefits of hybrid cloud has become increasingly important, with developers and IT operations now working together closer than ever to continuously plan, develop, deliver, integrate, test, and deploy new applications and services in the hybrid cloud ...

September 13, 2018

"Our research provides compelling evidence that smart investments in technology, process, and culture drive profit, quality, and customer outcomes that are important for organizations to stay competitive and relevant -- both today and as we look to the future," said Dr. Nicole Forsgren, co-founder and CEO of DevOps Research and Assessment (DORA), referring to the organization's latest report Accelerate: State of DevOps 2018: Strategies for a New Economy ...

September 12, 2018

This next blog examines the security component of step four of the Twelve-Factor methodology — backing services. Here follows some actionable advice from the WhiteHat Security Addendum Checklist, which developers and ops engineers can follow during the SaaS build and operations stages ...

September 10, 2018

When thinking about security automation, a common concern from security teams is that they don't have the coding capabilities needed to create, implement, and maintain it. So, what are teams to do when internal resources are tight and there isn't budget to hire an outside consultant or "unicorn?" ...

September 06, 2018

In evaluating 316 million incidents, it is clear that attacks against the application are growing in volume and sophistication, and as such, continue to be a major threat to business, according to Security Report for Web Applications (Q2 2018) from tCell ...

September 04, 2018

There's a welcome insight in the 2018 Accelerate State of DevOps Report from DORA, because for the first time it calls out database development as a key technical practice which can drive high performance in DevOps ...

August 29, 2018

While everyone is convinced about the benefits of containers, to really know if you're making progress, you need to measure container performance using KPIs.These KPIs should shed light on how a DevOps team is faring in terms of important parameters like speed, quality, availability, and efficiency. Let's look at the specific KPIs to track for each of these broad categories ...

Share this