Gjensidige builds on GitHub and Azure to put security front-and-center in new application platform

Gjensidige also had to break down the silos that existed between its development and IT security teams. This required increased visibility into security checks within the development process (including the lack thereof), as required for all of those teams to work together more effectively. “To foster deep collaboration, we needed to first create a single source of the truth for all things security-related—visible to all stakeholders at all times,” says Aatif.

Finally, Gjensidige had to achieve all this in a way that wouldn’t impede Developer Velocity. “We wanted to build an application platform that’s secure by design—and one that developers would want to use,” says Oyvind Bergerud, Senior Security Architect at Gjensidige. “To achieve this, we had to think of our new application platform as a product, with developers as its end-users. They had to trust what we were going to deliver, knowing that we built it for them.”

Building a security-first application platform

Gjensidige built on the combined capabilities of GitHub Enterprise and Microsoft Azure to deliver a modern ‘DevSecOps’ environment that puts security front-and-center at all times—from developers writing code to running that code in a production environment. According to Aatif, the company’s DevSecOps approach is a natural evolution of where they were already headed—and another reason that Gjensidige decided to use Azure. “We were already doing DevOps, embracing the cloud, adopting Kubernetes, and so on,” he says. “The additional cloud services we used to achieve our security goals—namely, GitHub Advanced Security and Microsoft Defender for Cloud—are parts of the same ecosystem. Everything flows well and ‘just works’—regardless of whether we’re modernizing legacy applications or building new cloud-native ones.”

Gjensidige chose Microsoft for other reasons, as well. One was data residency, with two new Azure data centers in Norway providing an easy way to meet regulatory requirements. Microsoft’s own commitment to security was also compelling, giving Gjensidige confidence that they would be working with a company that understood it deeply, at all levels—from internal research and product development to running a global cloud platform. “Microsoft has a security-first mindset in all that they do,” says Aatif. “Having access to that same expertise as we built our own application platform was invaluable.”

In taking advantage of all that GitHub and Azure had to offer, Gjensidige relied deeply on training and other forms of skills transfer from Microsoft. Before Covid-19, they sent developers to classroom training at the Microsoft Technology Center in Norway. They also took advantage of courses offered through Microsoft Learn, enrolling all developers in the Azure Fundamentals class. Participation in the Microsoft Unified Support program provided access to additional guidance and expertise, such as access to Global Black Belts in various technology areas.

Prescriptive guidance provided by the Microsoft Cloud Adoption Framework for Azure also proved helpful, such as how to create landing zones for building new applications and modernizing existing ones enterprise scale. “The Cloud Adoption Framework gave us out-of-the box recipes for secure implementation—so we didn’t have to innovate anything new” says Ritesh Grover, Cloud Solution Architect at Gjensidige. “We simply aligned its policies to our requirements, hand-picked the recipes we needed, and implemented it. It gave us an easy way to ensure we’re doing things the same way Microsoft does.”

The Microsoft DevSecOps solution

Before getting into exactly what Gjensidige built and how it works, it’s worth examining the full Microsoft DevSecOps solution. At a high level, it serves two functions.

• The first function, illustrated across the top row of the diagram below, is about securing the developer workflow as code is being created.
• The second function, shown across the bottom row of the diagram, tends to the code after it's deployed in production.

“We use code scanning on every pull request, as a natural part of the developer workflow,” says Bergerud. “In fact, every time we’re pushing new code, it’s scanned several ways. Developers get instant feedback and can fix security issues on-the-fly, such as moving secrets out of code and into Azure Key Vault—as recommended in the Cloud Adoption Framework.”

Adds Falk, “As we move new projects into the Gjensidige Application Platform, we’re catching a lot of vulnerabilities in our open-source dependencies. Fortunately, we’re now able to stay on top of them and have setup alerts to notify teams when new vulnerabilities are found.”

Code scanning, secret scanning, and dependency review are all included with a GitHub Advanced Security license, at no additional cost. Because GitHub is open and flexible at all levels, the company was able to easily integrate several additional, third-party scan engines into its pipelines. For example, after an image is built and before it’s sent to Azure Container Registry, a GitHub action kicks-off a container scan using Trivy, a utility from Aqua Security. Another GitHub action kicks-off a scan of Terraform code using TFsec, another utility from Aqua Security.

Securing a Kubernetes environment at scale

The runtime environment for the Gjensidige Application Platform is based on Azure Kubernetes Service, a managed Kubernetes environment that gives the company integrated CI/CD, built-in scalability, and enterprise-grade security and governance. “We wanted to empower developers by segregating development tasks from infrastructure, so they can focus on what the business needs,” says Grover. “Containerization on Azure Kubernetes Service enables this quite well.” 

In adopting Kubernetes, Gjensidige had to adapt how it thought about application security at runtime. Once again, the Cloud Adoption Framework provided extensive guidance—for example, on topics like cluster and application security on Kubernetes. “The threat model today has changed, especially with increased use of open source,” says Grover. “This makes things like network micro-segmentation and securing individual containers essential for security. That way, if there’s a vulnerability, you get a contained one instead of an uncontained one.”  

Falk elaborates on how Gjensidige is achieving this with Azure Kubernetes Service. “In our Kubernetes cluster, we’re implementing a zero-trust environment and securing traffic between pods using network policy. This gives us fine-grained control over network flow, so that a malicious actor can’t easily get into our network and talk to a sensitive service.”

For this zero-trust approach to work, Gjensidige had to make it easy for developers to let their applications communicate. “We’re doing this through infrastructure as code, putting that code in GitHub, and giving developers access to it to open-up communication channels between individual containers,” explains Falk. “One thing I really like about Azure Kubernetes Service is how we can use managed identities for Azure resources to eliminate the need for developers to manage credentials. We wouldn’t have that in a bare-metal Kubernetes environment.”

From a security perspective, Gjensidige is also benefiting from how containerization on Azure Kubernetes Service makes patching easier. “By containerizing microservices, they're independent and it's easier to patch them separately,” explains Bergerud. “After we’ve patched the code and rebuilt its container, we can redeploy that container without touching or affecting anything else.”

Finally, Gjensidige is looking into how it can use additional third-party monitoring agents to scan running containers. “It’s easy to scan container images before they’re deployed, but threats can also be introduced while your containers are running,” says Bergerud. “We’re in the process of evaluating different solutions—Aqua being one of them—to scan containers within our production environment for threats that may have been introduced after deployment.” 

Security posture management and workload protection

Having taken steps to shift-left on security, the company still had to pull all security-related information together and make it visible to all, in a way that helps developers and IT security collaborate more effectively. That’s where Microsoft Defender for Cloud comes into play, which Gjensidige is using to continuously monitor and manage its security posture.

With Microsoft Defender for Cloud, results of the many security scans and other checks in the development pipeline are aggregated, augmented with additional information, and surfaced via security-specific dashboards in the Azure Portal. One such indicator calculated by Defender for Cloud is called ‘secure score’, which helps the Gjensidige security team understand its current security situation and work to improve it.

With secure score, Defender for Cloud continually assesses the company’s resources, subscriptions, and organization for security issues. It then aggregates all the findings into a single score so that Gjensidige can monitor its current security situation at a glance: the higher the score, the lower the identified risk level. The secure score is shown in the Azure portal pages as a percentage value, with underlying values also clearly presented. Defender for Cloud's recommendations page lists outstanding actions necessary to raise the secure score—including instructions for each recommendation to help remediate the specific issue.

“Secure score helps us see where we can do better, so we can then follow up with the appropriate teams,” says Bergerud. “It gives us a convenient, common set of security-related metrics and KPIs that we can collaborate on.”

Defender for Cloud also helps Gjensidige with regulatory compliance, providing a dashboard into the company’s compliance posture based on how they’re meeting specific compliance requirements. By default, every Microsoft Defender for Cloud subscription has the Azure Security Benchmark assigned. Gjensidige can also add standards such as NIST SP 800-53, SWIFT CSP CSCF-v2020, Azure CIS 1.3.0, and CMMC Level 3.

Results

Through developer-first tooling that integrates seamlessly into existing development workflows, Gjensidige’s modern DevSecOps solution is helping developers write more secure code, embrace security best practices, and respond quickly to software supply chain vulnerabilities. All stakeholders are empowered to collaborate on security as a shared responsibility, enabled by policy automation and deep, real-time visibility into the company’s security posture.

“Gjensidige today is a digitally native company; everything new that we do, we do in the cloud,” says Aatif. “New teams are being onboarded to our new application platform quickly, and as they are, they’re quickly finding and cleaning-up lots of vulnerabilities. In the past, there were more questions than answers. Today, security is baked-into our application platform from the moment a new repo is created. We’re a lot more confident about security today.”

As of December 2021, 13 development teams at Gjensidige have adopted the company’s new application platform, including Wehinger’s Cloud Analytics team. And even with security front-and-center as developers work, it hasn’t slowed them down. “Our new application platform is a joy to use,” he says. “In the past, security issues were often caught at the end of the development process, where they took a lot more time to fix. Today, with automated security controls embedded into their workflows, developers get instant feedback and can fix things right away. Such capabilities make us much more predictable in our deliveries to the business.”

While shifting-left has been a cultural change for developers, they’re finding it’s not as hard as some had thought. “We’re not forcing teams to use the Gjensidige Application Platform—it’s entirely their choice, and they can move to it at their own pace,” explains Aatif. “They know they’ll need to own what they build and, if its broken, they’ll need to fix it. We’re just providing a ‘happy path’ that uses self-service and automation to make their jobs easier and help them work faster. So far, not one team embarking on a new project has chosen a different path.”

In addition to increased Developer Velocity, the company’s move to Azure is empowering developers in other ways. Containerization on Azure Kubernetes Service lets them focus on business functionality instead of infrastructure, and they no longer need to implement their own mechanisms for logging or monitoring. “Many of the basic infrastructure needs that developers had to think about for every new project are now baked-into our application platform, ready to configure and use,” says Aatif.

Aatif also appreciates how the company’s new application platform is an open environment, enabling project teams to choose from a broad range of third-party tools. “Azure Kubernetes Service works great with other tools,” he says. “We use a lot of SaaS solutions that aren’t from Microsoft, including Splunk Cloud, Grafana, Prometheus, Confluence Cloud, and many others. They all integrate well with Azure, so it’s not an area we struggle with today.”

The company’s new application platform is also making life easier for Bergerud’s IT security team as well, which now works closely with security champions that are embedded in most development teams. “Before, risk assessments for a project were done by IT security,” explains Bergerud. “Today, they’re done by the individual development teams, with our support. In the past, we were the enforcers and goalkeepers, which didn’t work well. Now we’re more like coaches and consultants. Developers are taking more responsibility for security, knowing that we’re always there to help them if needed.”

Increased transparency into the development pipeline has been a major enabler in helping Bergerud’s IT security team shift to a more consultative role. “Through Microsoft Defender for Cloud, we can monitor the outputs of GitHub Advanced Security scans, view reports on container security, see where the vulnerabilities are, determine where we need to focus, and identify which teams may need our guidance,” says Bergerud. “Having such deep visibility into the development pipeline—with GitHub as our single source of the truth—has been a real game-changer for us.”

Although Aatif is pleased with the progress the company has made so far, he admits the work isn’t done. “We’ve made a good start over the past year, getting developers to take ownership for security and putting it front-and-center in their workflows,” he says. “Our mind-set today is ‘You built it… you own it… and if needed, you fix it.’ And we’ve given them the tools to do that. However, we’re not just building for today—we need to build for security in the future. Fortunately, we now have a powerful yet open DevSecOps platform to build on.”

Find out more about Gjensidige on Twitter and Facebook.