{"id":10272,"date":"2020-09-17T16:45:33","date_gmt":"2020-09-17T23:45:33","guid":{"rendered":"https:\/\/www.microsoft.com\/insidetrack\/blog\/?p=10272"},"modified":"2023-06-12T15:48:19","modified_gmt":"2023-06-12T22:48:19","slug":"enabling-secure-and-compliant-engineering-with-azure-devops","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/insidetrack\/blog\/enabling-secure-and-compliant-engineering-with-azure-devops\/","title":{"rendered":"Enabling secure and compliant engineering with Azure DevOps"},"content":{"rendered":"
This content has been archived, and while it was correct at time of publication, it may no longer be accurate or reflect the current situation at Microsoft.<\/p>\n<\/div>\n<\/div>\n
Microsoft Digital has implemented policy and security controls throughout our pipelines, delivering secure and compliant code across the entire pipeline process. We\u2019re ensuring that our engineers are working in an agile environment that adheres to all our policies, from start to finish.<\/p>\n
In a digital-transformation environment, where modern engineering principles require continuous integration and development of services, DevOps delivery models must be efficient and secure. Microsoft Digital has implemented policy and security controls throughout our pipelines, delivering secure and compliant code across the entire pipeline process. The goal is to implement properly applied controls across our entire development landscape, ensuring that our engineers are working in an agile environment that adheres to all our policies, from start to finish.<\/p>\n
At Microsoft Digital, we build and operate the IT services on which Microsoft runs. This environment consists of more than 900 individual services that combine to run Microsoft and provide productivity tools and experiences for our employees and customers worldwide. Microsoft Digital develops and supports these services with more than 3,000 engineers working in 3,800 Microsoft Azure Repos.<\/p>\n
Our move to the cloud and changing business requirements have increased demand for more rapid delivery of IT solutions. We\u2019ve moved to an agile delivery model, supported by our modernized services. Investments in modern engineering practices, such as continuous integration and continuous delivery (CI\/CD), have improved the product quality and created a new engineering culture at Microsoft Digital.<\/p>\n
In this development environment, change is continual. Our repos receive 1,000 pull requests, 7,000 commits, 2,800 builds, and 650 releases per day. In this context of rapid, constant change, we want to ensure that our service pipelines always remain within our parameters for security and policy application.<\/p>\n
Our mission is to enable our engineers to develop in a secure and compliant environment without having to implement or track security and compliance practices manually. Our engineering environment has grown substantially because of the growth and success of Azure DevOps adoption at Microsoft. However, with 2,800 builds and 650 releases per day, it\u2019s not possible to track and manage policies and configuration manually.<\/p>\n
We want an engineering environment that\u2019s unobtrusive to our engineers and enables them to innovate and trust that the system compiles and releases checked-in code in a manner that\u2019s always compliant and secure for the customer. One of our IT\u2019s organization\u2019s most significant overarching challenges is the growth and sprawl of IT service resources: determining where they are, who owns what, and how to ensure the effective release of first-class modern experiences for employees and partners. Our main challenges within the service pipeline include:<\/p>\n
To release secure and compliant modern services, we established a threefold starting point: understanding what is production code and what are production Azure resources; being able to run the compliance tooling consistently across all pipelines; and having clear ownership of our code and pipelines to drive accountability.<\/p>\n
Our approach, at its core, enables our engineers to get it right from the beginning, while addressing all challenges in the process. We want to remove manual processes where possible and enable engineering teams to be\u00a0green by default<\/i>\u00a0with the policies that we apply in our engineering system.<\/p>\nEstablishing a single service catalog<\/h3>\n
We use a service catalog to track the hierarchy and organizational hierarchy metadata for all the services that combine to run Microsoft. The catalog creates a single source of truth for service and organizational data. It also streamlines the compliance and onboarding experiences for other services like incident management and Azure DevOps. Using a service catalog gives us the ability to link production services, Azure DevOps code repositories, and Azure subscriptions. It also contains a structured hierarchy of our services as they relate to our business and clearly defines service ownership and dependencies.<\/p>\n
Our system uses the metadata that defines a service to initiate a set of compliance tasks. If a service has a user interface, accessibility policies must be applied to that interface. If it has web endpoints, it must undergo vulnerability scanning. If it has buildable code, that code must undergo static analysis. If the service contains Azure resources, policies from the Secure DevOps Toolkit for Azure must be applied.<\/p>\n
From the creation process forward, a repo must be mapped to a service. There is a hard mapping between our service catalog\u2019s structure and the structure within Azure DevOps. Every area path in Azure DevOps has a team and associated set of repositories. This structure gives us clear ownership of the code and its engineering artifacts from the beginning and also established a line of accountability for both compliance-scan remediation and incident response.<\/p>\n
Product builds and releases require specific compliance policies, so it\u2019s critical to identify the production environments accurately. We\u2019ve established a simple approach to determine what constitutes production code: we always host production code in the main branch of a repo. To create a build or release pipeline in Azure DevOps, you must do it under a service. We accomplish this by using a folder structure that matches our service tree hierarchy, and this allows us to have clear ownership for our thousands of build and release definitions. This approach is easy to implement, can be applied across the entire environment, and is easily identifiable.<\/p>\n
When deploying releases, only the main branch can be released to production. We use tags for Azure resources to identify production environments. We apply policies to the environment to ensure that only main builds can deploy to production, and that naming conventions are applied across environments. This helps us apply consistent stage naming. Enforced policies create an environment that guarantees 100 percent compliance in this area.<\/p>\n
We\u2019ve created an engineering system in which we have clear ownership of our engineering resources from the outset, can deterministically differentiate between production and nonproduction resources, and can centrally manage the environment. These three fundamentals, established and enforced from the start, produce significant benefits for our engineers and for Microsoft Digital as an engineering organization. These benefits include continuous integration with security controls, which means no build-up of technical debt, and automated and enforced policy management. Other benefits include more secure pipeline definitions, increased policy-release velocity, end-to-end visibility of compliance status, and reduced effort for engineering teams to engage in secure and compliant DevOps practices across the entire organization.<\/p>\n
We\u2019ve established a robust framework for pipeline compliance management at Microsoft Digital. With modern engineering tools and design patterns, we\u2019re moving quickly toward a defined and enforced method for pipeline compliance by using an Azure DevOps predeployment gate and artifact filter. Our automated processes and code-based deployments are creating an agile and more managed environment for running our business processes. As we move forward, we\u2019re building a deeper level of built-in automation and gates to further refine the pipeline without requiring human intervention or manual processes. Compliance by default is a continually evolving goal as policies change, and our teams are assessing our environment and applying new toolsets to ensure 100 percent compliance across Microsoft Digital.<\/p>\n","protected":false},"excerpt":{"rendered":"
This content has been archived, and while it was correct at time of publication, it may no longer be accurate or reflect the current situation at Microsoft. Microsoft Digital has implemented policy and security controls throughout our pipelines, delivering secure and compliant code across the entire pipeline process. We\u2019re ensuring that our engineers are working […]<\/p>\n","protected":false},"author":146,"featured_media":10274,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"_hide_featured_on_single":false,"_show_featured_caption_on_single":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[1],"tags":[],"coauthors":[674],"class_list":["post-10272","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","m-blog-post"],"jetpack_publicize_connections":[],"yoast_head":"\n