Managing security approval of services deployed in cloud platform using an extensible platform as a service
An extensible platform-as-a-service (PaaS) system is used during the software development lifecycle (SDLC) processes of an application. The system facilitates the process of getting security approval for the application. The system allows developers to use software bundles including software modules that are pre-approved. The system allows a developer to customize one or more software modules of the software bundle if necessary. The system monitors the development of the application to check if the developer customizes any software module to use a configuration that is not pre-approved. The system automatically generates a report noting the customization to the software module and requests the security team to review the modified configuration for security approval.
1. A computer-implemented method for managing security of applications, the method comprising:
storing a plurality of software bundles, wherein a software bundle includes a plurality of software modules, wherein at least a subset of the software modules of the software bundle have security approval;
receiving, from a user, a criteria for selecting configuration of a potential application;
providing a first software bundle matching the received criteria;
receiving a configuration of the application based on one or more software modules of the first software bundle;
monitoring software development life cycle (SDLC) processes of the application, the monitoring comprising determining whether one or more software modules included in the first software bundle have been customized;
responsive to determining that none of the software modules included in the first software bundle have been customized, automatically granting security approval to the application;
responsive to determining that the one or more software modules included in the first software bundle have been customized, generating a request for security approval based on the one or more software modules included in the first software bundle that have been customized; and
sending the generated request for security approval.
2. The computer-implemented method of claim 1 , further comprising:
generating a report identifying the one or more software modules included in the first software bundle that have been customized; and
sending the generated report with the request.
3. The computer-implemented method of claim 1 , further comprising:
responsive to receiving security approval, allowing the application to proceed through one or more SDLC stages.
4. The computer-implemented method of claim 1 , further comprising:
responsive to receiving security approval, allowing the application to proceed for deployment in a production environment.
5. The computer-implemented method of claim 1 , wherein the plurality of software bundles are stored by an extensible platform as a service (exPaaS) system configured to allow users to customize configurations of software modules via application programming interface (API), wherein the API tracks modifications made to configurations of software modules used by an application.
6. The computer-implemented method of claim 1 , wherein the criteria specifies one or more of:
a programming language for development of the application,
a version of a software artifact used by the application,
a communication protocol used for communications by a software module used by the application, and
an access permission of a file system used by the application.
7. The computer-implemented method of claim 1 , further comprising:
determining that a first software module of the first software bundle has a security vulnerability;
identifying one or more applications including the application using the first software bundle;
sending alerts to owners of the one or more applications, informing the owners of the security vulnerability; and
automatically applying a software patch to the first software module to fix the security vulnerability for the one or more applications.
8. A non-transitory computer readable storage medium for storing instructions that when executed by a computer processor cause the computer processor to perform steps comprising:
storing a plurality of software bundles, wherein a software bundle includes a plurality of software modules, wherein at least a subset of the software modules of the software bundle have security approval;
receiving, from a user, a criteria for selecting configuration of a potential application;
providing a first software bundle matching the received criteria;
receiving a configuration of the application based on one or more software modules of the first software bundle;
monitoring software development life cycle (SDLC) processes of the application, the monitoring comprising determining whether one or more software modules included in the first software bundle have been customized;
responsive to determining that none of the software modules included in the first software bundle have been customized, automatically granting security approval to the application; and
responsive to determining that the one or more software modules included in the first software bundle have been customized, generating a request for security approval based on the one or more software modules included in the first software bundle that have been customized; and
sending the generated request for security approval.
9. The non-transitory computer readable storage medium of claim 8 , wherein the instructions further cause the computer processor to perform steps comprising:
generating a report identifying the one or more software modules included in the first software bundle that have been customized; and
sending the generated report with the request.
10. The non-transitory computer readable storage medium of claim 8 , wherein the instructions further cause the computer processor to perform steps comprising:
responsive to receiving security approval, allowing the application to proceed through one or more SDLC stages.
11. The non-transitory computer readable storage medium of claim 8 , wherein the instructions further cause the computer processor to perform steps comprising:
responsive to receiving security approval, allowing the application to proceed for deployment in a production environment.
12. The non-transitory computer readable storage medium of claim 8 , wherein the plurality of software bundles are stored by an extensible platform as a service (exPaaS) system configured to allow users to customize configurations of software modules via application programming interface (API), wherein the API tracks modifications made to configurations of software modules used by an application.
13. The non-transitory computer readable storage medium of claim 8 , wherein the criteria specifies one or more of:
a programming language for development of the application,
a version of a software artifact used by the application,
a communication protocol used for communications by a software module used by the application, and
an access permission of a file system used by the application.
14. The non-transitory computer readable storage medium of claim 8 , wherein the instructions further cause the computer processor to perform steps comprising:
determining that a first software module of the first software bundle has a security vulnerability;
identifying one or more applications including the application using the first software bundle;
sending alerts to owners of the one or more applications, informing the owners of the security vulnerability; and
automatically applying a software patch to the first software module to fix the security vulnerability for the one or more applications.
15. A computer system comprising:
a computer processor; and
a non-transitory computer readable storage medium for storing instructions that when executed by a computer processor cause the computer processor to perform steps comprising:
storing a plurality of software bundles, wherein a software bundle includes a plurality of software modules, wherein at least a subset of the software modules of the software bundle have security approval;
receiving, from a user, a criteria for selecting configuration of a potential application;
providing a first software bundle matching the received criteria;
receiving a configuration of the application based on one or more software modules of the first software bundle;
monitoring software development life cycle (SDLC) processes of the application, the monitoring comprising determining whether one or more software modules included in the first software bundle have been customized;
responsive to determining that none of the software modules included in the first software bundle have been customized, automatically granting security approval to the application; and
determining that a first software module of the first software bundle has a security vulnerability;
identifying one or more applications including the application using the first software bundle;
sending alerts to owners of the one or more applications, informing the owners of the security vulnerability; and
automatically applying a software patch to the first software module to fix the security vulnerability for the one or more application.
16. The computer system of claim 15 , wherein the instructions further cause the computer processor to perform steps comprising:
responsive to determining that the one or more software modules included in the first software bundle have been customized, generating a request for security approval based on the one or more software modules included in the first software bundle that have been customized; and
sending the generated request for security approval.
17. The computer system of claim 15 , wherein the criteria specifies one or more of:
a programming language for development of the application,
a version of a software artifact used by the application,
a communication protocol used for communications by a software module used by the application, and
an access permission of a file system used by the application.