Azure DevSecOps Policy As Code
Helping Clients Secure Their Cloud Infrastructure From Internal and External Threats
Case Details
Client: Federal Agency
Tags: Cloud Security, DevSecOps, DevOps
Project Duration: 16 Months
Let’s Work Together for Development
Call us directly, submit a sample or email us!
The Story
The client was under an internal order to migrate its on-premise infrastructure to Microsoft Azure. For internal stakeholders, migrating to Azure from a familiar on-premise model represented many operational and security unknowns.
To help stakeholders mitigate these unknowns and better understand what security means in the cloud, members of our team established a strategic plan of action for the client.
What Did We Do
We kicked off the effort for the client by first identifying existing practices and areas of improvement needed. Next, we identified critical process improvements in the client’s security process implementation and then defined a roadmap for rolling those improvements based on a timeline that aligned with the client’s funding cycle.
Resource provisioning is paramount to the success of any technical initiative. Provisioning
After establishing the security implementation roadmap and conducting a gap analysis of existing infrastructure security posture, a policy baseline was establish around the Microsoft Azure Security Benchmarks to define a means of measuring compliance and quantitative improvements over time.
After successfully laying the baseline security policy plan and development strategy, members of our team presented to the client organizations Office of Cyber Information Security Operations (OCISO) and Change Review Board (CRB), receiving unanimous approval to move forward.
Efforts included the development, testing and deployment of version controlled policy-as-code (PAC) policies to address specific postures of the client’s environment.
The technical implementations and testing outcomes resulted in our efforts receiving final enterprise change control board approval to deploy to the production environment for deny mode enforcement.
Azure Security Policies Deployed
The Results
As a result of this effort, the client organization experienced several significant operational and security improvements.
