Application development teams need to move fast. Yet they often need to reinvent the wheel when it comes to machine identities such as SSL/TLS certificates. They frequently create their own security infrastructure, using a combination of Open SSL, secrets management tools, DevOps platforms, and scripts. Then, as environments and tools change, apps are migrated, and regulatory frameworks change, those same developers need to spend time re-coding applications, updating scripts, or learning new certificate authority APIs. To lighten the load for developers, security teams must offer a ready-made, consumable service for machine identities. In this webinar, we will explore the best practices that allow organizations to scale digital certificate provisioning while looking at the challenges facing security and DevOps. Join us and you’ll also learn: How the proliferation of machines complicates security Where machine identity protection sits in the DevSecOps toolchain Recent examples of breaches and outages due to a flawed security posture How a standardized set of consumable services supports enterprise-wide visibility and compliance, AND helps DevOps save time Develop a game plan to help security and DevOps work together and improve the security posture of your organization. Attendees will receive a complimentary copy of the white paper, “Speed and Scale: How Machine Identity Protection is Crucial for Digital Transformation and DevOps.”

1. //
//
© 2019 Venafi. All Rights Reserved.1
Use the Same Certificate Process
Across Your DevOps Toolchain
Sandra Chrust
Sr. Product Marketing Mgr.
Helen Beal
DevOpsologist
Relieve the Burden on DevOps
30 May 2019

2. //
//
//
DevOps and DevSecOps
Why Trusted Certificates Are Important Essential
The DevOps Toolchain
Use the Same Certificate Process: Offer a Service
Q&A
Agenda
© 2019 Venafi. All Rights Reserved.2
1
2
3
4
5

3. //
//
//
People Machines
Two Actors on a Network

4. //
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
“70% of network attacks
will use SSL by 2020”
—Gartner Predictions
2010 2012 2014 2016 2018 2020
Percentage of Network Attacks
Incorporating SSL
“A security or compliance
breach will shock DevOps
advocates, forcing greater
focus on governance and
toolchain oversight.”
Forrester. Predictions 2019: DevOps.
Adolescent DevOps Grapples with
Governance. November 8, 2018

5. //
//
© 2019 Venafi. All Rights Reserved.5
DevOps and
DevSecOps

6. CLOUD MIGRATION
IaaS
PaaS, Serverless
Containers
SaaS
ARCHITECTURE
MODERNIZATION
Microservices
API-Centric
Modern Languages
New Ecosystem
DEVOPS
High-
Performance IT
Automated
Customer-Centric
Fully Integrated
DIGITAL
TRANSFORMATION Machine Identities
Are Here
• SSL/TLS Certificates
• SSH Keys
• Code Signing Certificates
// © 2019 Venafi. All Rights Reserved.6
“79% of CIOs
expect the speed of
DevOps to make it
more difficult to
know what is
trusted and what is
not.”
Venafi CIO Survey

7. //// © 2019 Venafi. All Rights Reserved.7 optimising th
Dev
as
(Pa
Inform
of T
Agility
DevSecOps: Information security as
everyone’s job, every day.
(Chapter 22)
One of the top objections to implementing DevOps
principles and patterns has been, “Information security
and compliance won’t let us.” And yet, DevOps may be
one of the best ways to better integrate information
security into the daily work of everyone in the
technology value stream.
Part IV: ‘The Technological Challenges of Integrating Information
Security, Change Management and Compliance’ of the DevOps
Handbook: How to Create World-Class Agility, Reliability, & Security
in Technology Organizations
“

8. // © 2019 Venafi. All Rights Reserved.8
Why Trusted
Certificates Are
Important Essential

9. //
//
//
When Machine Identities Go Bad
© 2019 Venafi. All Rights Reserved.9
Tens of millions of
users can’t use their
mobile phones for a
day due to an expired
certificate.
Website down –
invalid (expired)
certificate:
“Your connection is
not secure.”
Incorrect SSL certificate
pinning allows hackers
to create man in the
middle attack on
API = STAMPEDE.
Another expired
certificate, millions of
users unable to access
the service due to
insecure connection.

10. //
//
//
Certificate Needs Are Growing Exponentially
© 2019 Venafi. All Rights Reserved.10
Certificates are
needed across
the entire
application stack
• Certificates apply to all infrastructure
• Servers
• Cloud
• Containers
• Virtual Machines
• Service Mesh
And need to be
embedded within
DevOps
workflows
Span the full
software lifecycle
Dev Test Stage Prod

11. //11 © 2019 Venafi. All Rights Reserved.
Methods
Commonly Used in
DevOps

12. //
Use OpenSSL to generate self-signed
certificates
Use many instances of HashiCorp Vault to
get subordinate CA or self-signed
certificates
Submit tickets to get trusted certificates
Use unauthorized CAs or create their own
Use Let’s Encrypt for automated
certificate renewals
Create homegrown scripts or
workarounds
Use certificates from public cloud
providers
Leverage built in DevOps secrets tools
Unauthorized
Certificate
Authorities
Homegrown
Solutions or
Scripts

13. //
//
//
Heterogeneous Approaches Introduce Complexity
© 2019 Venafi. All Rights Reserved.13
Source: https://www.reddit.com/r/devops/comments/b63eqp/what_keeps_a_devopssre_manager_up_at_night/

14. //
//
They must develop and operate security infrastructure that:
ü Uses trusted and protected certificates
ü Supports multiple certificate authorities
ü Delivers non-reputable audit logs
ü Protects private keys
ü Answers audit requests
ü Integrates with vulnerability management and
threat intelligence systems
ü Verifies compliance
ü Conforms to ever-changing policy
ü Provides resilience to crypto/key
compromise
ü Gives visibility to InfoSec
ü Supports attestation of corporate
compliance
And If They Are to Do Things Correctly…
© 2019 Venafi. All Rights Reserved.14

15. //
//
//
Challenges and Risks of Current Methods
For DevOps
• Diverts resources, slows
development
• Can’t migrate apps
• Outages
• Error prone, requires
maintenance
• Creates snowflake
environments
For InfoSec
• Lack of visibility
• Policy non-compliance
• Can’t audit or remediate
• Weak certificate usage
• Unprotected private keys
• Can’t inspect traffic
© 2019 Venafi. All Rights Reserved.15

16. // © 2019 Venafi. All Rights Reserved.16
The DevOps
Toolchain

17. //
//
//
The DevOps Loop
© 2019 Venafi. All Rights Reserved.17
Ideation
Integration
ValidationOperation
Realization
“One way to enable market-oriented
outcomes is for Operations to create
a set of centralized platforms and
tooling services that any Dev team
can use to become more productive…
a platform that provides a shared
version control repository with pre-
blessed security libraries, a
deployment pipeline that
automatically runs code quality and
security scanning tools, which
deploys our applications into known,
good environments that already
have production monitoring
tools installed on them.”

18. //
//
//
The DevOps Loop
© 2019 Venafi. All Rights Reserved.18
Ideation
Integration
ValidationOperation
Realization
When key and certificate
provisioning becomes
part of the automated build
process, DevOps teams can
significantly reduce IT service
delivery time:
• Over half (57%) of Venafi
customers used the Venafi
Platform to improve their
SLAs for internal IT services
Automated
build
Test through
route to live
Environment
orchestration
Deploy and
run

19. // © 2019 Venafi. All Rights Reserved.19
Use the Same
Certificate Process:
Offer a Service

20. //
//
//
New Guidance from NIST 1800-16B (Draft)
© 2019 Venafi. All Rights Reserved.20
https://www.nccoe.nist.gov/projects/building-blocks/tls-server-certificate-management

21. //
//
//
NIST 1800-16B – TLS Server Certificate Management
© 2019 Venafi. All Rights Reserved.21
4.1 Certificate Owners
With the advent of virtualization, the development and operations (DevOps) teams provision systems and software
through programmatic means. This introduces a new type of certificate owner and new TLS server certificate
challenges for organizations. As organizations push for more rapid and efficient deployment of business applications,
many DevOps teams deploy certificates without coordination with the Certificate Services team. This can result in
certificates for mission-critical applications not being tracked. This can be particularly problematic if bugs in DevOps
programs/scripts cause certificates to be improperly deployed or updated. In addition, as DevOps teams adopt newer
frameworks and tools, it is important to continue to monitor certificates and applications deployed and maintained by
older DevOps frameworks and tools.
5.2 Establish a Certificate Service
Manually managing TLS server certificates is infeasible due to the large number of certificates in most enterprises. It is
also not feasible for each certificate owner to create their own certificate management system. The most efficient and
effective approach is for the Certificate Services team to provide a central Certificate Service that includes technology-
based solutions that provide automation and that support certificate owners in effectively managing their certificates.
This service should include the technology/services for CAs, certificate discovery, inventory management, reporting,
monitoring, enrollment, installation, renewal, revocation, and other certificate management operations.
https://www.nccoe.nist.gov/projects/building-blocks/tls-server-certificate-management

22. //
//
//
Abstraction Makes it Easy for DevOps
© 2019 Venafi. All Rights Reserved.22
Venafi enables
security teams to
provide access to
certificates in a way
that abstracts
complexity away.
This ensures that
security is built into the
application without the
need for developers to
maintain cryptographic
functions.

23. //
//
//
Accelerate DevOps by Offering a Service
© 2019 Venafi. All Rights Reserved.23
23
Platform capabilities
Inventory Policy Controls
Audit, Reporting
& Logging
Agentless
Drivers
Automation
Workflows
Certificate
Authority
Connectors
DevOps can automatically request certificates for:
• Containers
• Service Mesh
• Serverless
• Servers
• Load Balancers
Modern ArchitectureTraditional InfrastructureLocated in
• Physical Data Center
• Virtual Data Center
• Hybrid Cloud
• Public Cloud
• Infrastructure
-as-a-Service
(IaaS)
And from within the CI/CD Pipeline, across environments
Test Only Certs Internal & Externally
Trusted Certificates
Development Test Staging Production
Automate renewals
(native and non-native cloud infrastructure)
Options for embedding policy-compliant certificates into DevOps workflows
Venafi APIACMESDK and CLI
*Open Source
*VCert SDK
(Go, Python,
Java, etc.)
*VCert for
Command
Line
REST API /
Web SDK
Venafi
ACME
Server
DevOps Toolchain Integrations
GitHub page: https://github.com/Venafi

24. //
//
//
Venafi Helps You Deliver DevSecOps
© 2019 Venafi. All Rights Reserved.24
Fast, repeatable
Ease of migration
Automated renewals
Strong certificates
For DevOps
Centralized control
Policy compliance
Ease of remediation
Secure key storage
For InfoSec
Accelerate DevOps, Securely

25. // © 2019 Venafi. All Rights Reserved.25
Security is not one person’s
job — it’s everyone’s job.

26. // Audience Q&A