Is your software infrastructure secure?

It is (Obviously!)

At least, this is what you would like to think. It is what your human brain tells you to think so you can sleep well at night. After all, you convince yourself, no one can access it, except my best employee.

But what about single point of failure?

This employee, even if he is the best, could very well not be your employee in the near future. He could change job, get sick, etc. While it is certainly a good idea to protect yourself against this single point of failure, do not forget that even if you have multiple employees taking care of your infrastructure, it also multiplies the human-based vulnerabilities…

Are you telling me my infrastructure will always be vulnerable?

Your infrastructure is vulnerable, and will probably always be. Making it less vulnerable is obviously important, but there will always be vulnerabilities. Updating your software dependencies is important, managing access rights to your infrastructure (on-boarding new employees and off-boarding previous ones) is important, as is applying the principles of least privileges. But in the end, this only reduces the attack surface, this will never bring it to zero.

So, how can I secure my infrastructure then?

Simply put: by knowing what happens with it, at all time and being able to redeploy it fast in a fully automated fashion. By properly monitoring it, you can tell if someone is trying to exploit it. You can get alerted on it. You can then apply proper counter measures. And if the attacker is smarter than your team, you can always reset your infrastructure by fully redeploying it from scratch with your full automation in place. The better your monitoring is, the more efficient your counter measures can be, the faster you can be back in business.

Conclusion

The reason we want to secure infrastructures is to protect the businesses they support. If you cannot fully protect them, you have to make sure you can fix them, and fast. Sometimes, it is difficult to get investments in projects to improve on those aspects, but the day the business will need to activate a disaster recovery plan or a business continuity plan, the business will thank you for your efforts in putting that into place instead of feature number 1000; because after all, those thousands of features might now be unavailable – Let’s keep those features available and serving your customers!