Security-as-Code: Embedding Policy-Driven Security in CI/CD Workflows
DOI:
https://doi.org/10.63282/3050-9416.IJAIBDCMS-V3I2P108Keywords:
Security-as-Code, DevSecOps, CI/CD, Cloud Security, Policy-driven Security, Automation, Infrastructure-as-CodeAbstract
Security in software development has long been considered an independent, downstream process- flowing after the code has been written, and before the code gets deployed. Such a reactive stance has proven ineffective in the present, cloud-native world, where agile iteration and rapid releases are the norms. The paradigm shift toward DevSecOps also requires integrating security directly into the CI/CD pipelines themselves, so that policy enforcement becomes automated and a continuous process. The Security-as-Code (SaC) framework is proposed in this paper as an approach to managing security rules, compliance standards, and risk mitigation, similar to conventional application code. We discuss ways of integrating SaC into a cloud-native CI/CD pipeline, compare available tools, and their compliance with policy-driven security practices. We evaluate the evolution of academia and industry in terms of automation, from static/manual controls to automated, code-driven enforcement, through a literature survey of pre-2022 works. The pipeline is a policy-driven SaC pipeline composed of Infrastructure-As-Code (IaC) scanning, dependency scanning, container hardening, and runtime policy checks. Included results include the reduction of vulnerabilities introduced into production environments and measurable successes in terms of conformance adherence. Future research opportunities are discussed in the paper: in the area of automated threat modeling, in zero-trust CI/CD environments, and AI-assisted SaC policies
References
1. Mohamed Ahmed The Rise of SecDevOps: Embedding Security into DevOps Workflows
Published February 17, 2021.
2. Myrbakken, H., & Colomo-Palacios, R. (2017, September). DevSecOps: a multivocal literature review. In International Conference on Software Process Improvement and Capability Determination (pp. 17-29). Cham: Springer International Publishing.
3. Pasquale, L., Spoletini, P., Salehie, M., Cavallaro, L., & Nuseibeh, B. (2016). Automating trade-off analysis of security requirements. Requirements Engineering, 21(4), 481-504.
4. Canning, M., O’Dwyer, B., & Georgakopoulos, G. (2019). Processes of auditability in sustainability assurance–the case of materiality construction. Accounting and Business Research, 49(1), 1-27.
5. Quick, R., & Sayar, S. (2021). The impact of assurance on compliance management systems on bank directors' decisions. International Journal of Auditing, 25(1), 3-23.
6. Nemet, G., Margalit, G., & Eyal, R. “Continuous Integration and Continuous Deployment Pipeline: A Systematic Mapping Study.” IEEE Access, 2021.
7. Ur Rahman, A. A., & Williams, L. (2016, April). Security practices in DevOps. In Proceedings of the Symposium and Bootcamp on the Science of Security (pp. 109-111).
8. Vehent, J. (2018). Securing DevOps: security in the cloud. Simon and Schuster.
9. Fernández González, D., Rodríguez Lera, F. J., Esteban, G., & Fernández Llamas, C. “SecDocker: Hardening the Continuous Integration Workflow.” arXiv, Apr 16, 2021.
10. Mahfuz, A. S. (2016). Software Quality Assurance: Integrating Testing, Security, and Audit. CRC Press.
11. Takanen, A., Demott, J. D., Miller, C., & Kettunen, A. (2018). Fuzzing for software security testing and quality assurance. Artech House.
12. Banerjee, S. (2021). Mathematical modeling: models, analysis and applications. Chapman and Hall/CRC.
13. Smolen, P., Baxter, D. A., & Byrne, J. H. (2000). Mathematical modeling of gene networks. Neuron, 26(3), 567-580.
14. Fokaefs, M., Barna, C., Veleda, R., Litoiu, M., Wigglesworth, J., & Mateescu, R. (2016, October). Enabling DevOps for containerized data-intensive applications: an exploratory study. In CASCON (pp. 138-148).
15. Saito, H., Lee, H. C. C., & Wu, C. Y. (2019). DevOps with Kubernetes: accelerating software delivery with container orchestrators. Packt Publishing Ltd.
16. Jagelid, M. (2020). Container vulnerability scanners: An analysis.
17. Javed, O., & Toor, S. (2021, August). An evaluation of container security vulnerability detection tools. In Proceedings of the 2021 5th International Conference on Cloud and Big Data Computing (pp. 95-101).
18. Angermeir, F., Voggenreiter, M., Moyón, F., & Mendez, D. “Enterprise Driven Open Source Software: A Case Study on Security Automation.” arXiv, Feb 10, 2021.
19. Al Jawarneh, I. M., Bellavista, P., Bosi, F., Foschini, L., Martuscelli, G., Montanari, R., & Palopoli, A. (2019, May). Container orchestration engines: A thorough functional and performance comparison. In ICC 2019-2019 IEEE International Conference on Communications (ICC) (pp. 1-6). IEEE.
20. Kocher, P. S. (2018). Microservices and containers. Addison-Wesley Professional.
21. Boda, V. V. R., & Immaneni, J. (2021). Healthcare in the Fast Lane: How Kubernetes and Microservices Are Making It Happen. International Journal of Emerging Research in Engineering and Technology, 2(3), 33-42.
22. Rahul, N. (2020). Vehicle and Property Loss Assessment with AI: Automating Damage Estimations in Claims. International Journal of Emerging Research in Engineering and Technology, 1(4), 38-46. https://doi.org/10.63282/3050-922X.IJERET-V1I4P105
23. Enjam, G. R., & Chandragowda, S. C. (2020). Role-Based Access and Encryption in Multi-Tenant Insurance Architectures. International Journal of Emerging Trends in Computer Science and Information Technology, 1(4), 58-66. https://doi.org/10.63282/3050-9246.IJETCSIT-V1I4P107
24. Pappula, K. K., Anasuri, S., & Rusum, G. P. (2021). Building Observability into Full-Stack Systems: Metrics That Matter. International Journal of Emerging Research in Engineering and Technology, 2(4), 48-58. https://doi.org/10.63282/3050-922X.IJERET-V2I4P106
25. Pedda Muntala, P. S. R. (2021). Prescriptive AI in Procurement: Using Oracle AI to Recommend Optimal Supplier Decisions. International Journal of AI, BigData, Computational and Management Studies, 2(1), 76-87. https://doi.org/10.63282/3050-9416.IJAIBDCMS-V2I1P108
26. Rahul, N. (2021). AI-Enhanced API Integrations: Advancing Guidewire Ecosystems with Real-Time Data. International Journal of Emerging Research in Engineering and Technology, 2(1), 57-66. https://doi.org/10.63282/3050-922X.IJERET-V2I1P107
27. Enjam, G. R., Chandragowda, S. C., & Tekale, K. M. (2021). Loss Ratio Optimization using Data-Driven Portfolio Segmentation. International Journal of Artificial Intelligence, Data Science, and Machine Learning, 2(1), 54-62. https://doi.org/10.63282/3050-9262.IJAIDSML-V2I1P107
