For organizations developing software, the Software Development Life Cycle (SDLC) encompasses multiple components and devices that access critical assets such as code, secrets, and test data. Ensuring these assets are protected is essential for compliance with international standards like ISO/IEC 27001.

This blog post explores how different components of the SDLC—company-owned machines, contractor devices, and Continuous Integration/Continuous Deployment (CI/CD) environments—can be effectively integrated into the Information Security Management System (ISMS) without relying on traditional Mobile Device Management (MDM) or Unified Endpoint Management (UEM) solutions. We will outline the mandatory requirements addressed by our solution, EDAMAME, and demonstrate how we secure all devices, regardless of the criticality of access. References to specific ISO/IEC 27001 controls are provided throughout.

Understanding Critical Assets in the SDLC

Under ISO/IEC 27001, any component that accesses critical assets must be included in the ISMS. This ensures a systematic approach to managing sensitive information and mitigating risks. Proper classification of critical assets within the context of the SDLC is of paramount importance for an enterprise.

1. Code

Criticality: Code can be proprietary and contain intellectual property. Unauthorized access or leakage can lead to competitive disadvantages or security vulnerabilities. Companies often segment access based on employees' roles to control different levels of code criticality.
Access Points: Developer machines, code repositories, and CI/CD systems.

2. Secrets

Criticality: Secrets include passwords, API keys, certificates, and other credentials. Compromise can lead to unauthorized access to systems and data breaches. Some secrets used in production are critical, while others with limited impact can be considered non-critical by the company.
Access Points: Developer environments, CI/CD pipelines, and configuration files.

3. Test Data

Criticality: Test data may include customer or patient information, especially in industries like healthcare. Under regulations such as Hébergeur de Données de Santé (HDS) in France, the Health Insurance Portability and Accountability Act (HIPAA) in the US, the European Union General Data Protection Regulation (GDPR), or the California Consumer Privacy Act (CCPA), this data is highly sensitive.
Access Points: Testing environments, developer machines, and CI/CD systems.

Understanding Endpoints in the SDLC

Developer Machines

Developer machines are used by software engineers to write, test, and debug code. These machines may be:

Corporate Devices: Owned and managed by the organization.
Personal Devices: Owned by employees (Bring Your Own Device - BYOD).
Contractor Devices: Owned by third-party contractors working with the organization.

CI/CD Runners

CI/CD runners are servers or virtual machines that automate tasks in the software delivery pipeline, such as building code, running tests, and deploying applications. These can be:

Self-Hosted Runners: Hosted within the organization's infrastructure (in the cloud or on-premises).
Cloud-Based Runners: Provided by cloud services like GitHub or GitLab.

How Endpoints Interact with Critical Assets

Development and Testing

Data Access: Developers and CI/CD systems may need to access critical test data for testing and validation.
Code Repositories: Source code needs to be pulled to developer machines or CI/CD systems to be modified, compiled, or tested.
Secrets Management: Even if stored in a vault, secrets are pulled into developer machines or CI/CD systems when required for testing or building.

All components of the SDLC—company-owned machines, contractor devices, and CI/CD environments—must be included in the ISMS based on their access to critical data.

Mandatory Controls for ISMS Inclusion in ISO/IEC 27001 Compliance

To ensure compliance, the following controls must be implemented on all endpoints belonging to the ISMS, regardless of ownership:

1. Access Control

Least Privilege Principle

Requirement: Users should have the minimum access necessary to the critical asset.
Implementation: Assign roles and permissions carefully.
References: ISO/IEC 27001: A.9.1.2

Multi-Factor Authentication (MFA)

Requirement: MFA for accessing systems handling critical assets.
Implementation: Use MFA solutions compatible with all device types.
References: ISO/IEC 27001: A.9.4.2

2. Encryption

Data at Rest

Requirement: Encrypt critical assets stored on devices.
Implementation: Use full-disk encryption tools.
References: ISO/IEC 27001: A.10.1

Data in Transit

Requirement: Secure data transmission channels.
Implementation: Use HTTPS, SSH, and VPNs.
References: ISO/IEC 27001: A.13.2.3

3. Endpoint Protection

Antivirus and Anti-Malware

Requirement: Protect against malicious software.
Implementation: Install and update security software.
References: ISO/IEC 27001: A.12.2.1

Firewall Configurations

Requirement: Control network traffic.
Implementation: Enable firewalls on all devices.
References: ISO/IEC 27001: A.13.1.1

Regular Updates and Patch Management

Requirement: Keep systems up to date.
Implementation: Enforce update policies across devices.
References: ISO/IEC 27001: A.12.6.1

4. Monitoring and Logging

Audit Logs

Requirement: Record access and activities.
Implementation: Use logging solutions that work across different devices.
References: ISO/IEC 27001: A.12.4.1

5. Secure Configuration

System Hardening

Requirement: Disable unnecessary services.
Implementation: Apply configuration standards.
References: ISO/IEC 27001: A.12.6.2

Configuration Management

Requirement: Maintain secure configurations.
Implementation: Use tools to enforce settings.
References: ISO/IEC 27001: A.12.5.1

Why the Admin-Down Approach of MDM/UEM is Unfit for SDLC

Traditionally, organizations have relied on Admin-Down approaches, particularly through Mobile Device Management (MDM) and Unified Endpoint Management (UEM) systems, to implement the security measures required for ISO/IEC 27001 compliance. These solutions depend on total control of the devices by an administrator, setting secure but rigid constraints around the SDLC. However, these methods often fall short in addressing the dynamic and diverse nature of modern software development environments. Here’s why the Admin-Down approach is unfit for SDLC:

1. High Administrative Burden

Resource Intensive: IT teams are required to manage, monitor, and enforce security policies across every device. This constant oversight demands significant time and resources, which can strain organizational budgets and reduce overall efficiency.

2. User Resistance

Perceived Restrictions: Strict administrative controls can make users feel micromanaged, leading to frustration and decreased morale.
Potential Workarounds: Users may seek ways to bypass security measures to regain control over their devices, inadvertently creating security vulnerabilities.

3. Incompatibility with Contractor Devices

Legal and Privacy Issues: Enforcing administrative controls on non-corporate devices can lead to privacy concerns and potential legal complications, especially when dealing with contractor-owned hardware.

4. Limited Flexibility for Developers

Restricted Access: Developers often require elevated privileges to perform their tasks, such as installing software, debugging, or accessing specific system resources. Admin-Down tools may prevent developers from performing necessary actions, hindering productivity and innovation.
Bypassing Controls: The rigidity of Admin-Down approaches can lead developers to disable MDM/UEM controls to regain necessary access, creating security vulnerabilities.

5. Scalability Challenges

Operational Costs: As organizations grow, scaling Admin-Down solutions to accommodate more devices and users becomes increasingly complex and costly.
Maintenance Overhead: Continuous updates and policy enforcement across a growing number of devices can overwhelm IT teams.

Introducing EDAMAME: The No-UEM User-Up Approach

EDAMAME offers a distinct alternative to Unified Endpoint Management (UEM) solutions. It is designed to empower users while ensuring compliance with ISO/IEC 27001 controls. By shifting the responsibility of security compliance to the users in a supportive and guided manner, EDAMAME overcomes the limitations of Admin-Down strategies without relying on invasive device management tools.

Key Features of EDAMAME

User Empowerment

Users install the EDAMAME app on their devices, which guides them through meeting the required security controls, such as enabling encryption or updating antivirus software. This user-centric approach ensures that security measures are applied appropriately without imposing unnecessary restrictions.

Continuous Compliance Verification

The EDAMAME app continuously verifies that the device complies with the organization's security policies aligned with ISO/IEC 27001 controls. This proactive monitoring ensures that devices remain secure over time, adapting to new threats and compliance requirements.

Access Control Integration

If a device becomes non-compliant, EDAMAME integrates with access control systems to automatically restrict access to critical assets until compliance is restored. This dynamic approach minimizes security risks by ensuring that only compliant devices can access sensitive data.

Privacy-Preserving

EDAMAME collects only the essential information required to verify compliance, thereby respecting user privacy. This approach makes EDAMAME ideal for both personal and contractor-owned devices, ensuring seamless integration without intrusive data access.

Applying ISO/IEC 27001 Controls Across All SDLC Endpoints with EDAMAME

The EDAMAME solution empowers users to meet ISO/IEC 27001 controls on their devices, ensuring that compliance is maintained across all endpoints. Here's how EDAMAME applies these controls effectively:

1. Access Control Enhancement

User Responsibility: Users ensure that their devices meet access control requirements, such as enabling MFA and adhering to the least privilege principle.
Dynamic Access Management: EDAMAME integrates with authentication systems to grant or revoke access based on real-time compliance status.

2. Encryption Enforcement

Guided Implementation: The EDAMAME client assists users in enabling full-disk encryption and securing data in transit.
Compliance Verification: Continuously verifies that encryption standards are maintained on the device.

3. Endpoint Protection

User-Led Updates: Users are prompted to install antivirus software, enable firewalls, and apply security patches.
Automated Compliance Checks: EDAMAME monitors these protections and informs users of any required actions.

4. Monitoring and Logging

Transparent Logging: EDAMAME collects compliance status without intrusive monitoring, respecting user privacy.
Centralized Reporting: Administrators receive compliance reports, enabling them to demonstrate adherence to ISO/IEC 27001 requirements without managing individual devices.

5. Secure Configuration Management

User Guidance: Provides instructions for system hardening and secure configurations.
Compliance Assurance: Ensures that devices adhere to the organization's security policies through user participation.

Benefits of the User-Up Approach with EDAMAME

Adopting EDAMAME's User-Up approach offers numerous advantages over traditional Admin-Down methods. Below is a comparison table highlighting the key benefits.

Reduced Administrative Overhead

Efficiency: Administrators no longer need to push updates or enforce policies manually across diverse devices.
Scalability: The user-up model scales effortlessly, even as the number of users or devices grows.

Enhanced User Engagement and Responsibility

Ownership: Users take an active role in maintaining their device security, leading to better adherence to policies.
Awareness: Increased user involvement fosters a culture of security awareness within the organization.

Compatibility with Contractor Devices

Privacy Respect: Contractors can use their own devices without intrusive administrative controls, as EDAMAME's client ensures compliance without accessing personal data.
Ease of Onboarding: Quickly integrate contractors into the secure environment without complex device management procedures.

Minimized User Frustration

Autonomy: Users retain control over their devices, reducing frustration associated with restrictive administrative controls.
Seamless Workflow: EDAMAME operates unobtrusively, ensuring that security measures do not impede productivity.

Immediate Security Response

Real-Time Enforcement: Access to critical assets is automatically restricted if a device falls out of compliance, mitigating security risks promptly.
Dynamic Compliance: As soon as users rectify compliance issues on their devices, access is restored, minimizing downtime.

How to Implement EDAMAME: A Simple Guide

Implementing EDAMAME into your organization's SDLC is straightforward and designed to integrate seamlessly with your existing workflows. Follow these simple steps to elevate your security and productivity effortlessly:

Download the EDAMAME Application
Visit the relevant app store for your developers' devices—whether it's the Microsoft Store, App Store, Snap Store, Mac App Store, or Google Play—and download the EDAMAME Security application. This app is designed to secure developer workstations and contractor devices without disrupting their daily workflows.
Install and Configure
Install the EDAMAME application on all relevant devices, ensuring compatibility across Windows, macOS, Linux, iOS, and Android platforms. The installation process is lightweight and non-intrusive, allowing developers to retain the necessary administrative rights for their tasks while maintaining security.
Utilize the Open Source Helper for System Remediation
Leverage our open-source helper tools available on GitHub to assist with system remediation. These tools empower developers, who are natural problem solvers, to take an active role in addressing vulnerabilities and enhancing system security without extensive manual intervention.
Integrate EDAMAME in your CI/CD
Check our GitHub and install edamame_posture CLI command for Windows / Linux / macOS designed to harden and ensure safe access to code and secrets from any machines including test machines and CI/CD runners. Use the GitHub / GitLab wrappers for easy setup.
Monitor and Maintain
Use the EDAMAME Hub for continuous monitoring and logging of your security posture across the entire SDLC. Regularly review the dashboards and alerts to stay ahead of potential threats and maintain compliance with industry standards. This ongoing maintenance ensures that security evolves alongside your development processes.

EDAMAME is designed to be easy to integrate into your development workflow:

Free to Try: Businesses can experience the benefits of EDAMAME without upfront costs.
Self-Service Onboarding: Quickly and seamlessly integrate EDAMAME through our portal at hub.edamame.tech.
Open Source tools: Explore tools at github.com/edamametechnologies.

Conclusion

Achieving ISO/IEC 27001 compliance across all devices involved in the SDLC is essential but challenging. Traditional Admin-Down approaches often fall short due to high administrative overhead, user frustration, and incompatibility with non-corporate devices.

EDAMAME Technologies provides a User-Up solution that empowers users to take an active role in maintaining compliance. By ensuring that devices meet security controls and integrating with access control systems to restrict access when necessary, EDAMAME effectively balances security with productivity. This approach not only reduces administrative workload but also enhances user satisfaction and is compatible with contractor devices.

In an era where cyber threats are increasingly sophisticated and regulatory landscapes are ever-evolving, organizations cannot afford to leave any endpoint unsecured. Implementing a solution like EDAMAME, which leverages user responsibility and automated access control, is a strategic move toward robust security and compliance. By adopting this User-Up approach, organizations can confidently navigate the complexities of ISO/IEC 27001 compliance, protect their critical assets, and foster an environment where security and productivity coexist seamlessly.

Frank Lyonnet

Share this post