“Infrastructure as Code” (IaC) in Cybersecurity

To make IT infrastructure easier and more reliable to build, configure and manage, a method called Infrastructure as Code (IaC) is used.

IaC means managing and provisioning infrastructure through code rather than manual processes. The relevant tools are becoming more important every day and continue to be widely used.

With IaC, configuration files are created that contain the infrastructure systems and the properties of the systems concerned, which makes configuration and provisioning easier. It also allows us to create the same environment every time. IaC also helps with configuration management by codifying and documenting our configuration settings.

From this starting point we must state very clearly that when securing IT systems, one must be fully active and take a proactive path. To achieve this, the IT infrastructure must first of all be built correctly and securely.

There are various tools used for IaC. The infrastructure-as-code and configuration tools widely used on the market include Ansible, Puppet and Chef. Another important infrastructure-building tool is Terraform (a provisioning tool). We can also put it this way: the infrastructure is created with Terraform, and the infrastructure created is configured with Ansible.

Naturally, in order to secure IT systems pre-emptively and build a more secure system infrastructure, the necessary steps must be taken while the systems are being set up, and the security of the system must then be maintained with the necessary monitoring tools.

So as not to remain merely on the defensive against cyber attacks and to be able to develop proactive measures, the line of defence should be built in multiple layers. Only in this way is it possible to create security measures that are both more successful and more stable.

The key security measures that can be taken with Ansible can be summarised as follows:

• Keeping administrator accounts to a minimum
• Access controls
• Minimising and controlling access to local systems
• Restricting access to users’ credentials
• Applying the principle of separation of duties
• Audit and logging features
• Avoiding a single anonymous super user
• Using Ansible Vault to manage secrets
• Separation of environments
• Defining roles and permissions
• Awareness and training
• Multi-factor authentication

In conclusion, when securing Ansible in a corporate environment, the principle of defence in depth, or overlapping security, should be applied resolutely. In this context, current developments, improvements and best practices should be followed and applied, and our systems should always be kept up to date. In addition, the NIST RMF (Risk Management Framework) should be used to provide, check and monitor the relevant measures, with continuous improvement in line with its updates. With these methods IT systems can be built securely, system security can be ensured more stably, and it becomes possible to pre-empt cyber attacks. Building systems securely from the moment they are set up gives us flexibility in security while also allowing us to be proactive.