Securing with Secrets
Compliant Development Process
The course is part of this learning path
Configuration is an important aspect of determining an application’s behavior. Settings files often include sensitive information like passwords and API keys. In this course, we will look at how to protect that sensitive information while the app is being developed and when it is in production.
Azure’s App Configuration Service allows you to manage access to settings data and we will see how to use it within a .Net application. We will look at using Azure Key Vault in conjunction with App Configuration Service, and how to access Azure Key Vault directly from your application and from apps running in a container within a Kubernetes cluster.
Next, we look at the idea of shifting left security testing within your development process, and how we can automate security testing as part of implementing a compliant development process. Much of this will involve using extensions from the Azure marketplace within your DevOps build pipeline.
This course contains numerous demonstrations from the Azure platform so that you can get a first-hand look at the topics we will be covering. If you have any feedback relating to this course, please contact us at firstname.lastname@example.org.
- Learn about app configuration
- Run and deploy apps with the Azure App Configuration service
- Use Azure Key Vault to store secrets and certificates
- Access Key Vault directly from your apps, including those running within a Kubernetes cluster
- Create a compliant development process by integrating code analyzers, branch policies, quality gates, open-source library scanning, and automated penetration into a build pipeline
- Intermediate-level developers, DevOps engineers, and product managers
- Anyone interested in learning how to implement secure app configurations and development pipelines
To get the most out of this course, you should have some pre-existing knowledge of software development and of using Microsoft Azure.
When it comes to delivering software, security is usually the first element that is sacrificed when trying to meet a deadline. This is particularly unfortunate in light of recent data breaches that we've seen with some organizations. While the security sacrifice may, in the short-term, benefit the bottom line, in the long run, it's turned out to be a false economy where the financial and reputational impact in some cases has been almost fatal, to the shareholders anyway.
In the traditional or old school software development lifecycle, security and testing typically came at the end of a project, just prior to release. If security issues are found at this stage, they, as with bugs, are expensive to fix due to the amount of rework needed. The CI/CD DevOps process has revolutionized software development, and like bugs, security issues are far cheaper to fix if found early on in the development process.
DevSecOps is a newly coined term for incorporating security and security testing into the entire DevOps pipeline, so that it is part of your development process rather than something added on at the end as an afterthought at pre-deployment. Integration of security or moving security from the delivery end of the process is sometimes referred to as shifting left. If you picture the development process as linear, moving from left to right, you get the idea. From a DevOps point of view, the easiest way to shift left is to incorporate automated tools to run alongside existing unit testing, thereby having minimal impact on the development process. So far, we have looked at configuration, Azure Key Vault, and secrets in some depth.
Let's see how we can use those elements as well as other tools, such as automated testing, to build a secure and compliant pipeline. In the spirit of left shifting, let's start with the code.
Hallam is a software architect with over 20 years experience across a wide range of industries. He began his software career as a Delphi/Interbase disciple but changed his allegiance to Microsoft with its deep and broad ecosystem. While Hallam has designed and crafted custom software utilizing web, mobile and desktop technologies, good quality reliable data is the key to a successful solution. The challenge of quickly turning data into useful information for digestion by humans and machines has led Hallam to specialize in database design and process automation. Showing customers how leverage new technology to change and improve their business processes is one of the key drivers keeping Hallam coming back to the keyboard.