Developers, operators, and corporate executives all agree that compliance with security and regulatory requirements is critical, but many find that enforcing security through manual scans and “best efforts” at the end of the cycle wastes staff time and adds days or weeks to the release schedule. Once the required environments are built, tested, and certified, today’s customer-centric product owners are already longing to push out the next set of changes, absorbing even more of IT Operations’ time to scramble for security and compliance solutions.

1. © Electric Cloud | electric-cloud.com
Continuous Compliance and
DevSecOps in Times of GDPR,
HIPAA and SOX

2. © Electric Cloud | electric-cloud.com
The Speakers
Torsten Volk
Analyst, EMA
@TorstenVolk
Anders Wallgren
CTO, Electric Cloud
@anders_wallgren

3. © Electric Cloud | electric-cloud.com
Torsten Volk
EMA

4. The Hard Facts
“… companies take security
very seriously, but the cost of
keeping up with changes in
technology are prohibitive,”
says Chad Crandell, chief executive officer of
CHMWarnick LLC, a hotel investment adviser.
60.000 GDPRinvestigations in2018
200.000 HIPAAcomplaintssince2003

5. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
The Current Reality
5 © 2017 Enterprise ManagementAssociates,Inc.
• Variance Abounds
• Gaps and Exceptions Are the Norm
• Proof is Rare
• Time Pressures
• Security AKA: “The Release Prevention Department”

6. 85% use more than one cloud
45% use all three clouds

7. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
DSL Overkill – A Double-Edged Sword

8. Kubernetes: 11 Ways to Get Hacked
(source: Kubernetes.io website.)
YAML Config
Encryption Points
RBAC, ABAC, Logs
Policies

9. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
Different Container Setups
9 © 2017 Enterprise ManagementAssociates,Inc.

10. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
Different Flavors of Serverless
11 © 2017 Enterprise ManagementAssociates,Inc.

11. EMA
Identified
11 Parts of
a Serverless
Stack

12. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
Key Success Metrics – So Many to Choose
13 © 2017 Enterprise ManagementAssociates,Inc.
Security Defects
• Per release
• Number of tickets
• By severity
• By team
• By component
• By user group
Repeating Occurrence
• By team
• By product/component
• By cloud
• By deployment type
Time Spent on Manual Security Tasks
• Time to create audit reports
• Security testing
• Fixing failed tests
• Security
Audits
• Prep Time
• Total hours (by dev/ops/sec)
• Number and severity issues detected
• Number of corrections

13. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
4 Key Takeaways
14 © 2017 Enterprise ManagementAssociates,Inc.
1. Security and compliance must never slow down the
continuous delivery process.
2. Automation gaps and exceptions must be eliminated
to prevent slow-down and inconsistencies.
3. Compliance and security governance and control
must be detached from individual technologies such
as Kubernetes, Terraform, AWS Lambda, or VMware.
4. Accepting exceptions from the above key rules will
result in compliance liabilities.

14. © Electric Cloud | electric-cloud.com
Adaptive Release Orchestration
How an agile pipeline leads to Continuous Compliance and DevSecOps

15. © Electric Cloud | electric-cloud.com
DevOps Software Supply Chain Example
Delivery
Team
Version
Control
Build Test Release
Stage
Prod
Pipeline Orchestration
@botchagalupe

16. © Electric Cloud | electric-cloud.com
@botchagalupe
DevSecOps Software Supply Chain Example
Delivery
Team
Version
Control
Build Test Release
Stage
Prod
Pipeline Orchestration& Acceleration
Model and Automate
Everything
Environments, Security, and
Automation as a Service
Monitor and Track Releases
Built-In Security and
Compliance
Adopt New Technologies
Safely

17. © Electric Cloud | electric-cloud.com
Model and Automate Everything
• Version, test, refactor, and enhance
extendable models
• Avoid reinventing the wheel with repeatable,
auditable, and manageable models
• Eliminate drift, unplanned work and heroic
efforts with guaranteed standard practices
• Ensure separation of duties with standardized
best practices for each and every release.

18. © Electric Cloud | electric-cloud.com
Monitor and Track Releases
• Get at-a-glance release status and health
with dashboards tailored for each
stakeholder.
• Manage confidently with up to date data
and metrics from all sources.
• Improve collaboration and alignment with
the same metrics and release status across
all team.
• Identify and resolve problems and
bottlenecks quickly

19. © Electric Cloud | electric-cloud.com
Environments, Security, and Automation as a Service
• Onboard new teams, pipelines, and
applications rapidly and securely.
• Ensure that what is presented at each stage
is exactly what’s expected.
• Encourage experimentation.
• Prove policy adherence with reusable
components and automatic audit trails.

20. © Electric Cloud | electric-cloud.com
Adopt New Technologies Safely
• Ensure consistency and reusability across
new and existing architectures,
technologies, and processes.
• Remove the “rocket science” and steep
learning curve from supporting new
technologies and APIs.
• Adopt new technologies and support change
in a non-disruptive way to future proof your
organization.

21. © Electric Cloud | electric-cloud.com
Built-In Security and Compliance
• Enforce policies automatically with
anomaly/drift detection, approval gates,
compliance checks, security tests, and fine-
grained ACLs.
• Integrate security and compliance into the
pipeline, so it’s doesn’t become a
bottleneck at the last moment.
• Enable one-click auditability, including
built-in versioning and logging of all objects.
• Accelerate incident response time and
security patching across teams, releases,
and environments.

22. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
The Current Reality
23 © 2017 Enterprise ManagementAssociates,Inc.
• Variance Abounds
• Gaps and Exceptions Are the Norm
• Proof is Rare
• Time Pressures
• Security AKA: “The Release Prevention Department”

23. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
The New Reality – Continuous Compliance
24 © 2017 Enterprise ManagementAssociates,Inc.
• Variance Abounds
• Gaps and Exceptions Are the Norm
• Proof is Rare
• Time Pressures
• Security AKA: “The Release Prevention Department”

24. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
The New Reality – Continuous Compliance
25 © 2017 Enterprise ManagementAssociates,Inc.
• Consistency
• Gaps and Exceptions Are the Norm
• Proof is Rare
• Time Pressures
• Security AKA: “The Release Prevention Department”

25. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
The New Reality – Continuous Compliance
26 © 2017 Enterprise ManagementAssociates,Inc.
• Consistency
• Repeatability and Flexibility
• Proof is Rare
• Time Pressures
• Security AKA: “The Release Prevention Department”

26. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
The New Reality – Continuous Compliance
27 © 2017 Enterprise ManagementAssociates,Inc.
• Consistency
• Repeatability and Flexibility
• Auditability
• Time Pressures
• Security AKA: “The Release Prevention Department”

27. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
The New Reality – Continuous Compliance
28 © 2017 Enterprise ManagementAssociates,Inc.
• Consistency
• Repeatability and Flexibility
• Auditability
• Time to Market
• Security AKA: “The Release Prevention Department”

28. IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
The New Reality – Continuous Compliance
29 © 2017 Enterprise ManagementAssociates,Inc.
• Consistency
• Repeatability and Flexibility
• Auditability
• Time to Market
• Security AKA: “The Release Acceleration Department”

29. © Electric Cloud | electric-cloud.com
ElectricFlow Community Edition!
Adaptive Release Orchestration
Securely, flexibly, and confidently release
new applications at any speed demanded
by the business.
Download and use it, free:
electric-cloud.com/electricflow

30. © Electric Cloud | electric-cloud.com
ElectricAccelerator Trial Edition!
Build and Test Acceleration
Reduce cycle time and iterate faster by
dramatically accelerating builds and
tests.
Download and try it, free:
electric-cloud.com/electricaccelerator
gmake -j8 vs. EA64 core

31. © Electric Cloud | electric-cloud.com
Thank you
Q&A