DevSecOps: Get Started With Continuous Security Integration In Drupal

Companies usually refer to “continuous integration” when they talk about slimming down and speeding up processes and workflows. However, when it comes to security, not a lot of people use the same idea of continuous integration.

Interestingly, a study by the University of North Carolina shows that projects using an automated update process are updated 60% more often and are more secure than the baseline.

But how do I integrate security update processes continuously?

And how do I rock DevSecOps?

Challenges: Software components increase complexity, and secondly, you will need to outsmart all the hackers out there.

Goal: Build and deliver security across all components as a service with speed and at scale.

How to Add Continuous Security Integration in Drupal

Step 1

Think like a hacker:

1. AUTOMATE your processes.
2. Get rid of human failure.
3. Make security independent of available resources.

Step 2

To build the basis for automation, always consider the values of automated processes and which manual steps should be automated- Both for your client and yourself.

If you want to build a continuous delivery pipeline, it is essential to:

• use a code repository, like GIT, and
• integrate with other CI tools (Jenkins, Travis Ci, CircleCi…)

Furthermore, do not forget to make use of the benefits of automated code and penetration tests for stability.

Step 3

See the infrastructure as code. Make use of containers and ensure you’re using a scalable and secure Cloud system.

Step 4

Update your open source libraries! They need continuous updates, so you need to know your libraries well by using package managers and make sure to monitor security vulnerabilities.

You need to be aware of the fact that package managers only inform about updates, and that there are different vulnerability DBs. Although it’s not easy to ensure continuous update processes in Drupal, there are several options in the market that can make the process smooth. Read more about “automatic Drupal updates” discussion and become a part of a secure Drupal ecosystem.

Here’s a short checklist of the main steps:

• Allow your bots to update the dependencies
• Integrate with your tools and workflows
• Make the update process independent from available resources

Final Words

It will take some time and efforts until things get started and you might need to think about automating individual workflows, the kind of tools you want to use and how you’ll convince your customers about the importance of security update automation.

Doing all this will result in:

• an increased speed of your processes,
• a decrease in fragility, personnel and capital resources, and complexity,
• more transparency when including non-developers e.g. project managers,
• and valuable services for your customers.

So, what are you waiting for? Start your continuous security success story today by using the aforementioned checklists. If you have any questions, need assistance or want to learn more about “continuous security integration,” feel free to reach out. I look forward to hearing from you!

Author Bio: Johanna Anthes is responsible for Project and Marketing Management at “Drop Guard” – the Update Automation Solution for continuous Drupal security. Johanna can be reached out at [email protected]

Disclaimer: This is a guest post by Drop Guard. The opinions and ideas expressed herein are author’s own, and in no way reflect Cloudways position, opinion and policies.

Syed Hassan Raza

Hassan Raza is a CMS & Ecommerce Community Manager at Cloudways. It is his passion to help out web owners and share CMS related tips. Hassan is a fitness enthusiast and is an avid swimmer. You can email him at [email protected]

Get Connected on: Twitter Community Forum