SECURITY AS CODE: AUTOMATING POLICY-DRIVEN PAM DEPLOYMENTS IN CI/CD PIPELINES

Abstract

As more organizations are adopting DevOps and continuous integration/continuous deployment (CI/CD) pipelines, the need for effectively securing sensitive credentials and critical systems using privileged access management (PAM) has grown. Implementation models of conventional PAMs are mostly manual, non-uniform, unreliable, result in compliance and security issues. This present paper wants to state that with Security as Code (SaC), it is possible to automate the way we deploy PAM products into CI/CD pipelines and enable consistent, auditable and scalable access control. Organizations can codify access policies and make them part of pipeline processes so that they are able to provision privileged access, enforce it in turn and monitor in real-time. The pattern is based on infrastructure-as-code (IaC), policy-as-code engines and PAM-based automation tools to reduce people-related errors, misconfigurations and ensure the infrastructure remains compliant with regulations at all times. The effectiveness of the approach is demonstrated by a proof-of-concept implementation where a reduced number of delegation errors, a better provisioning time and a higher audibility are found compared to traditional methods. The paper specifies how implementation of Security as Code in DevOps delivers access controls that not just are more secure, but are more efficient to manage operationally, and presents a replicable pattern of secure, automated access controls management in production software delivery systems.