If you don’t want an IT audit to be a massive source of stress, you need to take the necessary steps every day to ensure your environment is always in tip-top condition. But that can be a particularly labor-intensive task — unless you make smart use of automation. So how do you keep your IT environment compliant without having to constantly manage it yourself?
As is often the case, the answer lies in an internal developer platform with a built-in security layer. With Puppet’s automation software, you can define your organization’s compliance rules as configuration management code. Your servers then automatically check at set intervals whether their configuration still matches the desired state. If Puppet detects a deviation within the configuration it manages, it automatically corrects it, ensuring the server once again complies with the established policy.
By default, Puppet checks the state every half hour, but the frequency can be adjusted. Environments with little access and few deployments require less frequent checks — perhaps every hour or two. For clients whose IT environment is effectively a black box, one automatic check per day might be sufficient. More volatile environments, on the other hand, should be checked more frequently, perhaps even every 15 minutes.
Automatically comply with your chosen standard
Through an interface, you can easily select which standards your IT infrastructure needs to meet. Puppet then checks compliance automatically and generates a report. Maybe your company doesn’t need to comply with every rule within a standard. In that case, Puppet can also map any permitted deviations.
It’s also best not to perform these checks only in production IT and OT environments, but in development and testing environments too. Many companies don’t focus on these, because they are “only” used to develop and test tools rather than for production. But that can make these environments more susceptible to security incidents.
What about HashiCorp or Ansible?
So far, we’ve looked at how to achieve continuous compliance with Puppet. But as you know, BRYXX always takes an agnostic approach. Do you already use HashiCorp tools? You can automate compliance checks with those too. With Sentinel, you define policy as code, allowing you to automatically check Terraform and Vault configurations for compliance.
It is even possible to achieve continuous compliance with Ansible. By running an Ansible playbook regularly, you check each time whether the server configuration still complies with the rules. However, you do have to organize this process yourself, as Ansible doesn’t run playbooks automatically.
Vulnerability management
Regardless of which solution you use, vulnerability management remains essential. A server can be configured perfectly according to your established rules and still be vulnerable because the latest security updates haven’t all been installed.
You do not have to resolve those issues manually either. Most vulnerability detection scanners can be integrated with automation software. This software then automatically springs into action when the scanner detects a vulnerability, such as outdated software.
Consider your processes too
Continuous compliance is only one part of the picture. Even when your systems are continuously compliant, things can still go wrong, because security also depends on your processes. Consider a developer who is working with configuration management code and can then modify the production environment directly. That process needs to change. For example, you could require the developer’s code to be approved by a colleague before it reaches production. When these additional controls are also built into the platform, you create a much more secure process from development through to production.