Compliance-as-Code

What is compliance as code?

Compliance-as-Code can be summarized as the organizational capability to automate the implementation, verification, remediation, monitoring, and compliance status reporting. This automation comes in the form of code and is integrated into the code repositories used by Devs and Engineers. It becomes “just another piece of code.”

• Using code to describe, validate, (possibly) remediate, monitor, and report compliance requirements and status
• Measured against regulatory standards and internal governance
• Includes (but not limited to):
  • Security
  • Infrastructure configuration
  • Privacy
  • Policies: Government, finance, health, etc.
  • Licensing (i.e., Open Source)

Why use compliance as code?

Just as with any other *aC, precision and repeatability of code execution eliminate human error.

Introduction

To adopt cloud-native application patterns, companies must learn new skills and communicate effectively across team boundaries. A new architecture, platforms, and developer workflows mean evolving developer skillsets. While microservices allow teams to move independently, they also emphasize the degree to which software and the organization grow to resemble one another, also known as Conway’s law. To achieve a result in which many microservices are a cohesive system and still maintain velocity, an organization’s communication structures need to be highly functional and effective.

Introduction

In today’s increasingly demanding marketplace, companies are looking for ways to stay ahead of their competition. Development teams are faced with challenges preventing them from delivering solutions rapidly that meet the business’s expectations. Therefore, companies need to evolve their Application Lifecycle Management (ALM) practices to integrate business, development, QA, and operations functions in an efficient cycle for greater agility in delivering continuous value.

Releasing high-quality software more frequently represents a substantial competitive advantage, and it means a significant reduction in the amount of wasted time and effort within a company.

Introduction

Azure Key Vault is a managed service that offers enhanced protection and control over secrets and keys used by applications, running both in Azure and on-premises.

The Basics

Service Tiers

Azure Key Vault is currently offered in two service tiers: Standard and Premium. Key Vault in Standard tier is limited to secrets and software-protected keys, while Key Vault in Premium tier additionally supports keys stored in Hardware Security Modules (HSMs) and are FIPS 140-2 Level 3 validated.

Modern buildings are well isolated, which isn’t good if you are making a mobile phone call. Outside your house or office, the cellular signal is perfect, but inside it is another story, dropped calls, low-quality sound, etc. Even when your carrier has high coverage, there are situations inside buildings that prevent you from making a call.

Most mobile network providers (carriers) provide a solution for this, called WiFi Calling. By utilizing the existing WiFi network in your home or office, the mobile phone can make calls. The phone call is routed throw your Internet connection back to your carrier. Phone calls are not free and cost still money when WiFi Calling is enabled.

Today, when a website does not have an SSL/TSL certificate, web browsers give you a warning not secure. This warning not only scares people but also gives you a disadvantage in search engine ranking. On Azure, web sites have a default https-enabled URL, like https://sitename.azurewebsites.net/, but when you have a vanity domain configured, you are missing this secure connection. Luckily there are some free SSL/TLS certificate options to explore.

Let’s Encrypt

Wait, there is Let’s Encrypt, its free! Why are you not using this excellent service? Yes, that is true, but there are some downsides to use Let’s Encrypt (on Azure), like: