Securing Your Enterprise Continuous Delivery Pipelines with CA Automation Solutions (Formerly Automic) and CA Privileged Access Manager

Securing Your Enterprise Continuous Delivery
Pipelines With CA Automation Solutions
(Formerly Automic) and CA Privileged Access
Manager (CA PAM)
Scott Willson
DST45T
DEVSECOPS
Product Marketing Director – CA Automic Release Automation
CA Technologies

2 COPYRIGHT © 2017 CA. ALL RIGHTS RESERVED#CAWORLD #NOBARRIERS
© 2017 CA. All rights reserved. All trademarks referenced herein belong to their respective companies.
The content provided in this CA World 2017 presentation is intended for informational purposes only and does not form any type
of warranty. The information provided by a CA partner and/or CA customer has not been reviewed for accuracy by CA.
For Informational Purposes Only
Terms of This Presentation

Abstract
In this session, we will discuss why it's important to incorporate security into the
software delivery pipeline. Lots of organizations are focused on continuous delivery and
security, but most have not formulated an official strategy for combining the two; in
short, they are complementary and need to be woven together broadly and deeply
within a deployment pipeline.
Included in the session will be recommendations, best practices, industry trends and
practical tips for "baking" security within and across an automated release process.
Scott
Wilson
CA Technologies
Director, CA
Application Release
Automation

Agenda
DEFINITION OF TERMS
WHY CA AUTOMIC RELEASE AUTOMATION
COMBINING CA AUTOMIC RELEASE AUTOMATION WITH CA DEVSECOPS
SOLUTIONS
CONTINUOUS DELIVERY CHALLENGES
CA DEVSECOPS SOLUTIONS
CA PRIVILEGED ACCESS MANAGER (CA PAM)
1
2
3
4
5
6

Definition of Terms

DevOps Is a…
Gartner – 2014 Cool Vendors in DevOps
DevOps is a philosophy (not a market).
There are no rules, no manuals, only guidelines.

DevSecOps…
Key Security Statistic
Application-layer attacks were the leading cause
of data breaches in 2016.
-Verizon Data Breach Investigations Report

DevSecOps…
Key Thought About DevOps
Without security, DevOps merely introduces
vulnerabilities into software faster.

Application Release Automation Tools …
 Combine:
– Automation
– Modeling (App/Env)
– Release Coordination
 Move:
– Artifacts
– Applications
– Configurations
– Data

ARA Critical for DevOps & Continuous Delivery
Gartner – 2017 Application Release Automation MQ
[ARA] tools are a key part of enabling the DevOps
goal of achieving continuous delivery with large
numbers of rapid, small releases.

Up to 50% of Enterprises Will Have an ARA Tool
Gartner – 2017 Application Release Automation MQ
By 2020, 50% of global enterprises will have
implemented at least one application release
automation solution, up from less than 15% today.

High Confidence =
Release Promotion
Continuous Delivery
Humble, J., & Farley, D. (2011). Ch. 1. In Continuous Delivery (p. 4).
1
2
3
4
Every Change to App’s Code, Config,
Env, or Data Creates New Pipeline
Build Binaries & Installers
Test Binaries + Config + Env + Data to
Confirm Ability to Release

Goal of Continuous Delivery
Collaboration + Accountability:
Makes build, deploy, & test visible
Improved Feedback: Problems are
found/addressed as early as possible
Automation: Enables deployment & release of
any version to any environment

Use Same Automation Mechanics
for Every Environment
Continuous Delivery Automation
• DEV is Deployed to All the Time
• QA - Less Often
• PRE-PROD - Even Less Often
• PROD - Less Frequently Still

Why CA Automic Release Automation

Shift Left
 Extensive REST API
 ChatOps
 Marketplace
 Integrations
 Action Packs
– Not just plugins
Analysts
 Recognized as a leader
– Gartner
– Forester
Most Scalable
 500k to 1 clustered svr
 IPv6
 IoT to Mainframe
 COTS + Core Backend
 Automation platform
CA Automic Release Automation
The Most Advance Automation Platform in the Market

Current Status
DevOps is SiloedUnprecedented Pressure
94%of executives face increased
pressure to release apps
more quickly
2014 Vanson Bourne study commissioned by CA

However …
Not Achieving
Speed, Reliability
& Compliance
Tool Chain Sprawl

How CA Automic Release Automation Works

Continuous Delivery Challenges

Continuous Delivery Challenges
Poor / zero visibility of deployments
• Managers and business users (customers) lack tracking of status or completion times
• End-to-end transparency required for compliance
Limited documentation of releases processes
Lack of scalability and control
• Managing multiple simultaneous releases with intricate dependency
No visibility or governance of privileges
• Automation mechanics’ agents/bots
• User access within pipelines not accounted for

PRODisparticularlyvulnerable
Automation Mechanics Touch Everything
zDocker zMS Azure
zAWS
zOracle
zSales Force
zService Now

DevSecOps Challenges
Process augmentation
• Significant changes requires in governance models, workflows, and processes.
Technology sophistication
• Must support multiple teams, numerous languages, repositories, and web of OSS libraries,
• Manually or semi-automatically addressing vulnerabilities leads to gaps in coverage.
Security Culture
• Company culture doesn’t support embedded security processes.
• Abandon the mind-set of check-box compliance.

CA DevSecOps Solutions

Enabling Developers
 3 Second Scan times
(with Greenlight)
 24 Languages Supported
 77 Frameworks
Supported
 29 Integrations
Company Growth
 6 Trillion + lines of Code
Scanned*
 4X Leader in Gartner
Magic Quadrant
 1400+ Customers
 30+ Patents
Customer Outcomes
 36.5M Flaws Fixed All
Time
 3,100 Consultation Calls
 400,000 Program
Management Hours
Veracode Overview
Note: * indicates year-to-date

The Veracode Approach
Outcome-Oriented Approach – Focus on Fixing Defects, not Just
Discovering Them
Coverage of entire SLC
Integrations and API’s – Enable seamless integration into
software development processes including DevOps
SaaS Platform – Shortens Time to Value, Reduce Customer
Complexity

Focus on Outcomes
Accelerate
Secure Software
Development
Reduce Risks of
Data Breaches
Compliant with
Customer Needs &
Regulators
Lower Costs
of Securing
Software Assets

DevSecOps
How do you make security a competitive advantage?
Test at every step, eliminate constraints, join disparate
tools and processes — and automate everything
Continuous Testing
Assess and improve application
security from initial code
through production
Functional + Secure =
Quality Code
32 #CAWORLD #NOBARRIERS COPYRIGHT © 2017 CA. ALL RIGHTS RESERVED

DevSecOps: Uniting Development and Security

Security Throughout the SLC
Code Commit Build Test Release Deploy Operate
CA Veracode Greenlight CA Veracode Static Analysis
CA Veracode Web Application Scanning
CA Veracode Runtime Protection
CA Veracode Software Composition Analysis
CA Veracode Integrations, APIs
CA Veracode eLearning
Code RepositoriesIDEs GRCs
SIEMs
WAFs
Security Assurance Operational SecurityDevelopment Integration
Bug Tracking Build and Deploy
Systems

CA Privileged Access Manager
(CA PAM)

Security Threat to Network and Data
Unrestricted “root”
or “Administrator”
access
No segregation of
duties
Use of shared
accounts
Poor log integrity
and quality
All-Powerful
Access
Lack of
Accountability
Risk

Management and Governance
Identity/Credential Management Identity/Credential Governance
• Fine-grained access controls
• Shared account password management
• Threat analytics
• Identity activity reporting
Control what each agent/bot can do
within pipeline steps
• Provisioning to privileged accounts
• Access requests
• Workflow
• Certification
Ensure the least amount of privileged
access for agents/bots

Combining CA Automic Release
& CA DevSecOps & CA PAM

A Practical Blueprint for Achieving Continuous
Delivery
STAGE 1
▪ Automate your scripts and
root out manual work
▪ Assessment of DevOps
competency
▪ Deliver Continuous
Delivery roadmap
STAGE 2
▪ Model environments,
components and state flows
▪ Construct automated
deployment pipelines
▪ Promote and rollback
versioned components on
demand
STAGE 3
▪ Provision full stacks
▪ Orchestrate entire lifecycle
including securing
deployment pipeline, CM,
and other ITSM procedures
▪ Enable self services
STAGE 4
▪ Automated release
management across the
entire application portfolio

Secure Automated DevOps / Continuous Delivery
Tool Chain
Reduce development overhead
by 30% by automating
environment provisioning and
setup
Centrally manage and govern
the security of your deployment
pipelines
Securely and fully automate
deployments into production
Orchestrated releases and fully
governed environments
Automate change, approval
and release management
processes
Automate agent/bot privileged
access
Zero downtime production
deployments and updates
CA recently released integration with CA PAM so
that the CA Identity Suite provides full privileged
access provisioning, access requests, tracking
and approvals, as well as automated access
certifications. So, you now can have a single
mechanism for governing the access of all users,
both regular and privileged.
CA Identity
Suite
CA PAM

How could it be done today?
Benefits
• Reduced risk of improper privileged access
• Single method of governing access for all users
• Outstanding user experience for all roles
• Increased efficiency through automation
• Flexible approval workflow to meet local needs
Capabilities
• Automated provisioning and de-provisioning
• Access request
• Access certification
Agents/Bots
CA Identity
Suite
Request Access
Provision Access
Approval Certifications
Manager
CA PAM

CA Automic Release Automation + CA DevSecOps
Solutions + CA PAM
Visibility of deployments enterprise-wide
 Shared visibility across DevOps personnel
 Transparency of automation mechanics, credentials & security tests/analytics
Security Automation
 Identifying flaws early in lifecycle
 Speed delivery of secure code
Scale Continuous Delivery, safely, across the enterprise
 Manage multiple simultaneous releases/deployments with dependencies
 Code and deployment pipelines are safe, secure and compliant
Real-time risk and security analysis

PROD
The Most Secure Continuous Delivery Pipeline
Detect
Vulnerabilities Early
JIT Credentials
No Privilege
Creep
Secure Automation
Mechanics
DEV PRE-PRODTEST
Security within and across the Continuous Delivery Pipeline
Secure App
Perimeters
IoT to Mainframe
Pipelines

Recommended Sessions
SESSION # TITLE DATE/TIME
DST40T
Scale Your Application Security Program Effectively
with the Right Program Management Model
11/15/2017 at 3:30 pm
DST38T
Shifting Security to the Left – Watch End-to-End
DevSecOps Solution in Action
11/15/2017 at 4:15 pm
DST39T
Assess and Guide Your DevOps Journey Leveraging
Industry-leading DevOps Research
11/16/2017 at 11:30 am
DST41T DevOps: Security’s Chance to Get It Right 11/16/2017 at 12:45 pm
DST43T
The CA Technologies Veracode Platform: 360
Degree View of Your Application’s Security
11/16/2017 at 2:30 pm

Must See Demos
Security
Starts with
Identity
CA Identity Suite
CA Identity Service
Deliver
Frictionless
Access
CA Advanced
Authentication
CA Single Sign-On
CA Directory
Control
High Value
Access
CA Privileged
Access Manager
CA Threat Analytics
for PAM
Manage
Your
Software
Risk
CA Veracode Static
Analysis
CA Veracode Web
Application Scanning
CA Veracode
Greenlight
Sneak
Peeks
Cross-channel Fraud
Prevention
Threat Analytics
Privileged Access for
DevOps

Stay connected at communities.ca.com
Thank you.

DevSecOps
For more information on DevSecOps,
please visit: http://cainc.to/CAW17-DevSecOps

Securing Your Enterprise Continuous Delivery Pipelines with CA Automation Solutions (Formerly Automic) and CA Privileged Access Manager

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Securing Your Enterprise Continuous Delivery Pipelines with CA Automation Solutions (Formerly Automic) and CA Privileged Access Manager

Similar to Securing Your Enterprise Continuous Delivery Pipelines with CA Automation Solutions (Formerly Automic) and CA Privileged Access Manager (20)

More from CA Technologies

More from CA Technologies (18)

Recently uploaded

Recently uploaded (20)

Securing Your Enterprise Continuous Delivery Pipelines with CA Automation Solutions (Formerly Automic) and CA Privileged Access Manager