Welcome!

@DevOpsSummit Authors: Liz McMillan, Zakia Bouachraoui, Pat Romanski, Elizabeth White, Yeshim Deniz

Related Topics: @DevOpsSummit, Containers Expo Blog, Cloud Security

@DevOpsSummit: Article

Performance Testers Secure IT | @DevOpsSummit #APM #DevOps #Microservices

The most important thing to think about is protecting personally identifiable information

Don't Feel Insecure! How Performance Testers Can Help Protect and Secure IT

Have you heard all the buzz about the latest security breach at the Office of Personnel Management? It has caused many government workers a lot of stress - and with good reason. The personal information of more than 21 million people is now in the hands of hackers. If you've worked for the government, or had a government background check in the last 15 years, you've probably been affected.

It's a big deal, yet also just the latest in a string of high-profile identity theft cases. Remember the Target fiasco from December 2013? It was the largest retail hack in history, affecting a whopping110 million people. They only just reached a settlement to create a $10 million fund for hacking victims. This all goes to show that, while security technology continues to improve, so do hackers. It's been a trend for quite some time.

Here's why: there is great profit in hacking. Rather than putting their skills towards the overall good, some hackers spend their time, energy and talent plotting how to get rich quick off of the misery of others. You can never be too careful. Security is on everyone's mind. Not too long ago, we talked about how beefed up security impacts load testing and we want to continue the conversation. How do you keep yourself and your company safe in the age of industrial and state-sponsored hacking?

Here are a few things you must know.

Don't Take It Personally: Protect Sensitive Information
When it comes to performance testing, the most important thing to think about is protecting personally identifiable information. If it falls into the wrong hands, we know what happens. You also need to be conscious of opening holes that allow hackers to get into the network and steal personal information. Follow your corporate standards and policies for security, as well as common best practices for strong passwords. Don't take shortcuts, as tempting as it can be. Keep these tips in mind when focusing on security:

1) Always Use Dummy Data for Testing Purposes
Never scrape names or credit card numbers from real users on your website and use them to create a bunch of scripts that test load and performance. All personal information used for load testing should be dummy data and not even remotely identifiable. That doesn't just mean eliminate names. Identities can be exposed even from metadata. Instead, invest in a dummy data generator. Be smart, and treat customer data as if it were your own.

2) Play It Smart in the Cloud
Companies tend to be more cautious when operating in the cloud. Conducting load testing from the public cloud is a great idea, but just make sure that you do it right. Remember, cloud based companies spend a lot of money on security and have entire teams monitoring security infrastructure all the time, and they probably have better resources at their disposal than you do. However, it's always a good rule of thumb to make sure that sensitive data never leaves the machines it was intended for. So keep that information out of the cloud when doing performance testing.

3) Communicate with Your Operations and Security Teams
If you conduct lowd testing from the cloud, work with your operations team to make sure that they know where your traffic will be coming from. Think about how they would react upon seeing a lot of network requests coming from cloud servers across the world. They may think it's a DDoS attack when in fact it's just your cloud-based load generators operating an organized test. They could accidentally do something that messes up your test and ruins hours of data gathering and monitoring. Don't distract them from their real job of finding and stopping the bad guys. Focus on working with them to put proper controls and identification parameters in place.

4) Control Any Public Tests
You will often need to test new software for performance with real users on live systems. This is often done publicly as part of a public beta or as an A/B test. Any public beta software should be shut down when no longer in use as these tests may not be fully vetted from a security perspective. Keep exposure brief and monitor it closely. When the test is complete, remove access instantly. You don't want a security hole to be discovered in temporary software that's a year old and not in use. For hackers, that looks like a pretty tempting access channel.

5) Keep All Software Patched and up to Date
Bring anything public-facing to the attention of your security team. They have processes to monitor software, update it, and control the environment. Check regularly for out-of-date apps that may contain active vulnerabilities, as unpatched software is one of the easiest ways for hackers to gain access to your systems.

Security First and Always
With all the recent hacks and security breaches, just discussing your security plan can be intimidating enough to put it off. Remember that the secret to security in performance testing is in the planning. With these tips in mind, you'll be well on your way to developing a security plan that protects the personal data of your company and users.

Photo: Pixabay

More Stories By Tim Hinds

Tim Hinds is the Product Marketing Manager for NeoLoad at Neotys. He has a background in Agile software development, Scrum, Kanban, Continuous Integration, Continuous Delivery, and Continuous Testing practices.

Previously, Tim was Product Marketing Manager at AccuRev, a company acquired by Micro Focus, where he worked with software configuration management, issue tracking, Agile project management, continuous integration, workflow automation, and distributed version control systems.

@DevOpsSummit Stories
"DevOps is set to be one of the most profound disruptions to hit IT in decades," said Andi Mann. "It is a natural extension of cloud computing, and I have seen both firsthand and in independent research the fantastic results DevOps delivers. So I am excited to help the great team at @DevOpsSUMMIT and CloudEXPO tell the world how they can leverage this emerging disruptive trend."
Digital transformation is about embracing digital technologies into a company's culture to better connect with its customers, automate processes, create better tools, enter new markets, etc. Such a transformation requires continuous orchestration across teams and an environment based on open collaboration and daily experiments. In his session at 21st Cloud Expo, Alex Casalboni, Technical (Cloud) Evangelist at Cloud Academy, explored and discussed the most urgent unsolved challenges to achieve full cloud literacy in the enterprise world.
CloudEXPO | DevOpsSUMMIT | DXWorldEXPO Silicon Valley 2019 will cover all of these tools, with the most comprehensive program and with 222 rockstar speakers throughout our industry presenting 22 Keynotes and General Sessions, 250 Breakout Sessions along 10 Tracks, as well as our signature Power Panels. Our Expo Floor will bring together the leading global 200 companies throughout the world of Cloud Computing, DevOps, IoT, Smart Cities, FinTech, Digital Transformation, and all they entail. As your enterprise creates a vision and strategy that enables you to create your own unique, long-term success, learning about all the technologies involved is essential. Companies today not only form multi-cloud and hybrid cloud architectures, but create them with built-in cognitive capabilities.
DevOpsSUMMIT at CloudEXPO, to be held June 25-26, 2019 at the Santa Clara Convention Center in Santa Clara, CA – announces that its Call for Papers is open. Born out of proven success in agile development, cloud computing, and process automation, DevOps is a macro trend you cannot afford to miss. From showcase success stories from early adopters and web-scale businesses, DevOps is expanding to organizations of all sizes, including the world's largest enterprises – and delivering real results. Among the proven benefits, DevOps is correlated with 20% faster time-to-market, 22% improvement in quality, and 18% reduction in dev and ops costs, according to research firm Vanson-Bourne. It is changing the way IT works, how businesses interact with customers, and how organizations are buying, building, and delivering software.
The benefits of automated cloud deployments for speed, reliability and security are undeniable. The cornerstone of this approach, immutable deployment, promotes the idea of continuously rolling safe, stable images instead of trying to keep up with managing a fixed pool of virtual or physical machines. In this talk, we'll explore the immutable infrastructure pattern and how to use continuous deployment and continuous integration (CI/CD) process to build and manage server images for any platform. Then we'll show how automate deploying these images quickly and reliability with open DevOps tools like Terraform and Digital Rebar. Not only is this approach fast, it's also more secure and robust for operators. If you are running infrastructure, this talk will change how you think about your job in profound ways.