Incrementally Validating Security Policy Code Using Information From An Infrastructure As Code Repository
In an example, an apparatus may include a validation module configured to identify a security policy update from a security as code repository, wherein the identified security policy update is a candidate for deployment to a production environment having a plurality of attributes defined by an infrastructure as code repository; identify, from the plurality of attributes and using the infrastructure as code repository, individual attributes that correspond to the identified security policy update, wherein the identified individual attributes are identical to a subset of the plurality of attributes; generate a test environment based on the identified individual attributes; following deployment of the identified security policy update to the test environment, check for security exceptions or availability exceptions using the test environment; and output validation results based on a result of the checking.
1 . An apparatus comprising:
a processor;
a memory coupled with the processor, the memory storing instructions for incrementally validating network security policy updates prior to deploying the updates to a production environment, the instructions executable by the processor to cause the apparatus to:
i) identify a security policy update from a security as code repository;
ii) identify attributes that correspond to the identified security policy update;
iii) generate a test environment based on the identified attributes;
iv) following deployment of the identified security policy update to the test environment, perform a validation to check for security exceptions or availability exceptions using the test environment; and
v) output validation results based on a result of the checking.
2 . The apparatus of claim 1 , wherein the identified security policy update is a candidate for deployment to the production environment having a plurality of attributes defined by an infrastructure as code repository.
3 . The apparatus of claim 2 , wherein the identified attributes are identified from the plurality of attributes.
4 . The apparatus of claim 1 , wherein the instructions further cause the apparatus to repeat steps i) through v) for a next security policy update.
5 . The apparatus of claim 1 , wherein the test environment includes one or more functional domains having configuration details that correspond to configuration details of one or more corresponding functional domains of the production environment.
6 . The apparatus of claim 1 , wherein the instructions further cause the apparatus to identify configuration details of a production environment using the infrastructure as code repository.
7 . The apparatus of claim 6 , wherein the configuration details are based on a repository containing physical information about the production environment.
8 . The apparatus of claim 1 , wherein the instructions further cause the apparatus to:
deploy the security policy update to the test environment; and
check for security or availability exceptions using the test environment.
9 . The apparatus of claim 8 , wherein the instructions further cause the apparatus to determine whether to deploy the security policy update to the production environment based on results of the checking.
10 . The apparatus of claim 8 , wherein the security policy update is deployed using a continuous deployment (CD) pipeline.
11 . A method, comprising:
i) identifying a security policy update from a security as code repository;
ii) identifying attributes that correspond to the identified security policy update;
iii) generating a test environment based on the identified attributes;
iv) following deployment of the identified security policy update to the test environment, performing a validation to check for security exceptions or availability exceptions using the test environment; and
v) outputting validation results based on a result of the checking.
12 . The method of claim 11 , wherein the identified security policy update is a candidate for deployment to the production environment having a plurality of attributes defined by an infrastructure as code repository.
13 . The method of claim 12 , wherein the identified attributes are identified from the plurality of attributes.
14 . The method of claim 11 , further comprising repeating steps i) through v) for a next security policy update.
15 . The method of claim 11 , wherein the test environment includes one or more functional domains having configuration details that correspond to configuration details of one or more corresponding functional domains of the production environment.
16 . The method of claim 11 , further comprising identifying configuration details of a production environment using the infrastructure as code repository.
17 . The method of claim 16 , wherein the configuration details are based on a repository containing physical information about the production environment.
18 . The method of claim 11 , further comprising:
deploying the security policy update to the test environment; and
checking for security or availability exceptions using the test environment.
19 . The method of claim 18 , further comprising determining whether to deploy the security policy update to the production environment based on results of the checking.
20 . The method of claim 18 , wherein the security policy update is deployed using a continuous deployment (CD) pipeline.