There's A Recipe For That

Back in the dark ages when I was a programmer, I became horribly fascinated with a tool called make. It was a tool for dealing with the complexities of, well, making finished executable code.The basic unit of executable code in those days (and these days, too, to some extent) was the .exe file, but putting an .exe file together meant compiling source code into object code and then connecting the object code with code libraries containing lots of other bits of object code coming from lots of other source code files. The key point here is that it kept track of dependencies. If something changed in one of the libraries, then it knew enough to know that anything that used those libraries needed to be reconnected with the newer version.

Make didn't know the dependencies by magic, of course. Nor did it know where to copy the various intermediate and final products of the work it initiated. Nor did it do any of the actual work of compiling or linking. You had to tell it all of this stuff by writing it all down in a thing called, none too surprisingly, a "make file."

It was a recipe designed to deal with complexities that were too hard to remember. And there could potentially be a great many complexities. The projects I was working on back in the '90s involved dozens of programmers, hundreds of separate modules, and something on the order of a half million lines of source code written in a few different programming languages.

Pretty much at the exact same time I was getting pretty good at vast and complex make files that relied on other monster make files and so on, the use of make files as a comprehensive solution was being undercut. Rather than linking in objects from libraries and the like, the new paradigm in applications was for the objects to be called up at run time on the system where the application was ultimately deployed. In the case of Windows, what was called up was a Dynamic Link Library, or DLL. In this brave new world, your application had to be smart enough to check whether a given DLL function was the correct version. Microsoft had an amusing propensity for releasing DLLs that had different functionality but the same version number, so the entire exercise had a charming futility about it.

But more to the point, the problem of getting the right versions of things working together at the same time had shifted. It was no longer a programming task that could be handled beforehand by the program developer, but was rather a task that had to be handled by whomever managed the target production system. Keeping the versioning right was now the job of the sysadmin.

By now, the sysadmin job is just that much more complex. Even in a relatively controlled environment where there aren't that many moving parts, getting things configured properly is tough going. Sysadmins are trying to deal with this, in part, by creating something called "devops." Like the make utility of old, devops is in large part about using tools to create programs (real programs, not scripts) that deal with elements of the production network environment as programmable objects.

Devops is at its core not really primarily focused on security. Its aim is to create automation of operations. But it has profound security implications when you consider how often misconfigured applications and components play a role in breaches. Remember that in the first Verizon Business Data Breach Investigations report that 62 percent of breaches were attributed to significant internal errors that either directly or indirectly contributed to a breach. By and large, we're talking about misconfigurations here.

To be honest, it's not entirely clear what the overlap is between commercial security configuration monitors, like BigFix, and open-source devops tools, like Puppet and Chef, but that's something I hope to explore during the next few weeks. Until then, here are a few thoughts from Jesse Robbins, the guy behind Chef, over at gocsi.com.

CSI Director Robert Richardson likes a good recipe fine but a good meal even better. Reach him at [email protected].