Answers: <p>As you stated, requirements will differ based on company and industry policy; for us, the adjustment from &quot;separation of duties&quot; to automated deployments has been rough. As interim steps, we've started:</p>
  <ol>
  <li><p>Requiring multiple &quot;sign-offs&quot; before deployment; this is accomplished by both reviews for the PR in Azure DevOps and an audit log in Octopus.</p>
  </li>
  <li><p>Monthly review of deployments by higher-ups.  This is mostly a rubber-stamp activity, but it satisfies auditors.</p>
  </li>
  </ol>
  
Answers: CC BY-SA 4.0
Answers: 2021-05-06T10:59:06.580Z
Answers: 2021-05-06T10:59:06.580Z
Answers: Stuart Ainsworth
Body: <p>How do you implement security requirements in CI/CD while taking care of security requirements? What are best practices here?</p>
  <p>Security requirements may differ, let's assume this simple level of security:</p>
  <ul>
  <li>Direct administrative access to target system shouldn't be given to the CI/CD system</li>
  <li>CI/CD system needs to be able to initiate deployment and show it's success/fail status (could be determined by a white box test routine i.e. without admin access rights placed on the CI/CD side)</li>
  </ul>
  
Tags: <continuous-deployment><security><devsecops>
Title: Continuous deployment strategies vs DevSecOps
UserDisplayName: Ta Mu
ThreadText: # Continuous deployment strategies vs DevSecOps
  
  (Asked by: username_0 on 2021-05-06)
  
  How do you implement security requirements in CI/CD while taking care of security requirements? What are best practices here?
  
  Security requirements may differ, let's assume this simple level of security:
  
  * Direct administrative access to target system shouldn't be given to the CI/CD system
  * CI/CD system needs to be able to initiate deployment and show it's success/fail status (could be determined by a white box test routine i.e. without admin access rights placed on the CI/CD side)
  
  **Tags:** continuous-deployment, security, devsecops
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2021-05-06. Score: 1
  
  As you stated, requirements will differ based on company and industry policy; for us, the adjustment from "separation of duties" to automated deployments has been rough. As interim steps, we've started:
  
  1. Requiring multiple "sign-offs" before deployment; this is accomplished by both reviews for the PR in Azure DevOps and an audit log in Octopus.
  2. Monthly review of deployments by higher-ups. This is mostly a rubber-stamp activity, but it satisfies auditors.
  
  
  ---
  
  