How to Support Agile Development with Zero Trust Best Practices

Originally published by TrueFort.

Written by Nik Hewitt.

What is agile development?

Agile software development is the practice of delivering small pieces of working software quickly to fix bugs, add features, enhance usability, and generally improve the customer experience. It lets development teams achieve their product goals in an ever-evolving technical and business environment. This is done through improving and reshaping software products via small windows of managed evolution called sprints.

The speed of agile development can be prone to leaving security out of the loop. Security best practices and testing are sometimes viewed as bottlenecks by busy development teams under pressure to meet their next sprint deadline. The constant push to new iterations can make it difficult to ensure security is appropriately integrated into the development process, leading to vulnerabilities and breaches.

As organizations adopt agile development methodologies, security teams face the challenge of keeping pace with the rapid iteration and deployment of new code. Third-party code is often utilized to save time and resources, and any nefarious code making unsanctioned calls can easily jeopardize application security. Also known as a supply chain attack, the infamous SolarWinds breach of early 2020 was caused by this method.

The benefits of Zero Trust

One solution to this problem is the adoption of Zero Trust security principles.

Zero Trust makes the assumption that all resources and devices are untrusted by default and require strict authentication and authorization before granting access. This approach can be used to secure both traditional data center and cloud-based environments, as well as mobile and IoT devices.

Six Zero Trust roads to agile success

Here are a few ways security teams and developers can support agile development with Zero Trust best practices:

• Implement microsegmentation: One of the key principles of Zero Trust is using microsegmentation to limit the attack surface and isolate sensitive resources. Beyond simple network segmentation and firewall rules, microsegmentation applies security controls to specific resources and services down to the individual workload level.
• Use identity-based access controls: Zero Trust security requires that all access is based on identity rather than device or location. This means developers should use identity-based access controls, such as multi-factor authentication and role-based access controls, to be sure that only authorized users can access sensitive resources.
• Utilize encryption: Encryption is an essential tool for protecting sensitive data. If possible, security teams should work with developers to ensure that all sensitive data is encrypted, both in transit and at rest, to protect against data breaches.
• Monitor and detect threats: Zero Trust security also requires continuous monitoring and detection of threats. Security teams can support developers by implementing security monitoring and threat detection tools to detect and respond to security incidents in real time. Any deviation from a standardized benchmark of best practices should be flagged for security teams to be able to respond efficiently.
• Continuously train the team: Security teams need to continuously train and learn about the latest security threats and best practices – knowledge than can then pass on to their colleagues in development when major incidents and changes in the protection landscape occur. This might include attending online security conferences, participating in security training programs, and staying updated with the latest security research.
• Foster a culture of security: Zero Trust requires a culture where all employees across the entire enterprise understand their role in keeping the organization secure. In an ideal scenario, security teams should work with developers to create a security-aware culture where security is integrated into all aspects of the development process. By implementing Zero Trust security principles, if necessary by default, security teams and developers can work together to ensure that security is integrated into the agile process and that new code can be deployed securely.

Zero Trust security principles provide a framework for securing agile development environments. It is always best practice for security teams and developers to work together to automatically implement microsegmentation, utilize identity-based access controls, use encryption, automate threat monitoring, and foster a culture of security.

By doing so, organizations can ensure that their applications and services are secure, even as they are frequently updated and deployed.