Identity and access in the DevSecOps life cycle

May is Identity and Access month in the Red Hat’s monthly Security series! Beginning in March 2021, the Red Hat Security Ecosystem team has provided an introduction to a DevOps Security topic in a regular fashion to help you learn how Red Hat weaves together DevOps and security to help master the force called DevSecOps. We explain how to assemble Red Hat products and our security ecosystem partners to aid in your journey to deploying a comprehensive DevSecOps solution.

Identity and Access defined

Typically when identity and access is mentioned in a Kubernetes context, it’s IAM, or Identity and access management.  These security methods control access to on-premises and cloud assets, applications, and data based on user or application identity and administratively defined policies. They are found in every stage of the DevOps lifecycle and can help protect against unauthorized system access and lateral movement. Taking a look at the different methods in Identity and Access, the following become a distinct, but related list:

• Authentication is verifying the identity of users, services and applications.

• Authorization is granting the authenticated users to specific resources or functions. In Kubernetes context, this is commonly referred to as role-based access controls (RBACs), which grant collections of users access to resources or functions based on their job responsibilities, simplify administration and onboarding, and reduce privilege creep.

• Secure identity storage, such as secrets vaults and hardware security modules (HSMs), which manage and safeguard security credentials, keys, certificates, and secrets while at rest and in transit. HSMs are typically a physical device which securely stores digital keys through encryption to protect sensitive data.  Secrets Vaults are typically a software solution that securely stores and manages any type of secret, like tokens, passwords, certificates, and encryption keys.

• Provenance, which in the context of containers, is the ability to verify the identity or authenticity of code or an image typically through some type of digital signature or attestation record.

Identity and Access integrated in DevSecOps

As seen in the DevSecOps framework below, Identity and Access is represented in each integration point in the life cycle. This makes sense as identity needs to be managed properly in each step of the way in DevOps. 

The table details some, but not all, of the common items to consider for identity and access in a DevSecOps life cycle.

Enhance and Extend Identity and Access with Red Hat Partners

Combining Red Hat OpenShift Container Platform identity and access features with Red Hat’s certified Ecosystem Security Partners provides holistic enterprise-ready DevSecOps. If you are looking to enhance and extend Red Hat’s security capabilities in Identity & Access, take a look at the following Red Hat Partners:

• Cyberark’s certified software and webinar.

• Thales’ Red Hat solution brief and webinar.

For more information, visit "Modernize and secure applications with DevSecOps," or talk to us at Enhance container security and adopt DevSecOps.