<p>As you stated, requirements will differ based on company and industry policy; for us, the adjustment from &quot;separation of duties&quot; to automated deployments has been rough. As interim steps, we've started:</p>
<ol>
<li><p>Requiring multiple &quot;sign-offs&quot; before deployment; this is accomplished by both reviews for the PR in Azure DevOps and an audit log in Octopus.</p>
</li>
<li><p>Monthly review of deployments by higher-ups.  This is mostly a rubber-stamp activity, but it satisfies auditors.</p>
</li>
</ol>

CC BY-SA 4.0
2021-05-06T10:59:06.580Z
2021-05-06T10:59:06.580Z
Stuart Ainsworth
<p>How do you implement security requirements in CI/CD while taking care of security requirements? What are best practices here?</p>
<p>Security requirements may differ, let's assume this simple level of security:</p>
<ul>
<li>Direct administrative access to target system shouldn't be given to the CI/CD system</li>
<li>CI/CD system needs to be able to initiate deployment and show it's success/fail status (could be determined by a white box test routine i.e. without admin access rights placed on the CI/CD side)</li>
</ul>

<continuous-deployment><security><devsecops>
Continuous deployment strategies vs DevSecOps
Ta Mu
# Continuous deployment strategies vs DevSecOps

(Asked by: username_0 on 2021-05-06)

How do you implement security requirements in CI/CD while taking care of security requirements? What are best practices here?

Security requirements may differ, let's assume this simple level of security:

* Direct administrative access to target system shouldn't be given to the CI/CD system
* CI/CD system needs to be able to initiate deployment and show it's success/fail status (could be determined by a white box test routine i.e. without admin access rights placed on the CI/CD side)

**Tags:** continuous-deployment, security, devsecops


---

## 1 answers

### Answer by username_1 on 2021-05-06. Score: 1

As you stated, requirements will differ based on company and industry policy; for us, the adjustment from "separation of duties" to automated deployments has been rough. As interim steps, we've started:

1. Requiring multiple "sign-offs" before deployment; this is accomplished by both reviews for the PR in Azure DevOps and an audit log in Octopus.
2. Monthly review of deployments by higher-ups. This is mostly a rubber-stamp activity, but it satisfies auditors.


---

