As a Vice President of Engineering (VPE), you have a big job. You’re responsible for realizing your company’s vision by developing and managing the engineering team, spending your time ensuring that the team is shipping products on time, executing the product roadmap, and optimizing internal processes. Depending on the size of your organization, you may also manage cross-functional teams, such as design, QA, and front and back end development teams. To do all of this well, you must balance speed to market with security infrastructure, because today security infrastructure is an essential component of maintaining brand trust. Security helps you ensure that your organization doesn’t let down customers and enables compliance with a wide range of regulations and requirements.
Compliance is an increasingly important component of your role as your company grows because compliance enables you to scale, and it helps you position your company as a secure service, an essential part of successful growth. Compliance means you need to be able to audit your deployment environments and return results that are easy to understand and actionable. As organizations increasingly adopt Kubernetes, many VPEs don’t think about k8s security, leaving them exposed to new security and audit concerns, and impacting trust both within the engineering team and extending to the rest of the company, and possibly to customers if there’s an incident that impacts end users. So how can you build Kubernetes and cluster configuration audits into your overall security and compliance frameworks?
The good news is that there’s a lot of existing tooling; these open source tools work well to test different parts of the overall Kubernetes configuration auditing, but it’s difficult to scale using multiple disparate tools, especially if you’re trying to audit multiple different clusters. It can also be hard to find and hire the right people, because there’s a significant lack of expertise in the Kubernetes market. The technology is still young, and resources are scarce. Experts who combine security and Kubernetes talent are even harder to find. Stitching together the right solutions internally to build an effective cluster configuration tool can be a drain on time for your team, and prevent you from meeting other pressing business goals.
Your organization has probably already started running applications in the cloud, or you’re planning to move to the cloud soon. Cloud native technologies (microservices, containers, and Kubernetes) enable you to build and run scalable applications in modern, dynamic cloud environments — and build and run applications on cloud native architecture. While this change helps you bring innovations to market faster and meet changing customer expectations, it also means building security into your environments and applications at the beginning and ensuring that you have Kubernetes configurations that are correct and consistent. It’s important to be able to audit your environments and ensure continuous availability, and understand which issues require immediate mitigation and which ones you need to address later. Setting the right policies to govern best practices for your Kubernetes environment will enable faster speed to market, and ensure relevant, actionable feedback early in the development process.
Audits are incredibly helpful for finding and addressing security concerns, and are an important part of the tools you use to ensure everything is running smoothly. The right auditing tools can also help you improve reliability and efficiency. Kubernetes is a complicated technology, presenting challenges as you seek to:
The right auditing tools, ones that help you enforce your Kubernetes policies automatically, can help you to manage your Kubernetes security posture, and audit the efficiency and reliability of the applications you deploy and the clusters they’re running on. These capabilities are really important for the teams and service owners who are responsible for configuration. Early feedback on issues turned up by an effective audit can help reduce the cost of fixing bugs or misconfiguration issues.
As a VPE, you need to balance metrics, speed to market, and ensure the security of your infrastructure. Your focus on meeting customer requirements while ensuring compliance helps drive both customer satisfaction and sales, increasing the success of your organization. By establishing that you are following cloud and Kubernetes best practices and running secure infrastructure, your sales team can position your company as a secure service.
Auditing your Kubernetes infrastructure gives you continuous visibility into your risks, ensuring that you not only understand any issues but also how to resolve them. The complexities of Kubernetes may leave many organizations unprepared to understand and ensure the security of their Kubernetes clusters. As a VPE, you need to both audit your Kubernetes configurations to maximize your visibility into issues across multiple clusters and control configurations to ensure that they meet the policies you’ve set up to protect your company. Maintaining visibility into and control over your Kubernetes environments can help you deliver secure products, faster, and meet your business goals.
