Complying with The Executive Order Using Policy-as-Code For Infrastructure

Over the coming months we will see more in-depth recommendations from the Executive Order taking shape, however, there are already several that are straightforward enough for companies to address today. The EO lays out several basic practices including the utilization of MFA and encryption, both of which have been culprits of data leaks and breaches, yet they consistently fail to be in place across company cloud footprints. These issues can be addressed today using policy-as-code technology when placed in the hands of InfoSec teams and Risk Leaders.

Policy-as-code is the idea of writing code in a high-level language to make decisions based on data input. Open Policy Agent (OPA) is the most prolific “unified toolset and framework” for policy across the cloud native stack and can be easily adopted to build frameworks (there are other proprietary languages as well). When the InfoSec teams and Risk Leaders are empowered to use policy-as-code to govern infrastructure, the overarching business requirements can be met while ensuring that the bespoke requirements of individual business units, applications, and environments are also met. Here is one example derived from the EO:

*This is sample representation and not an actual policy

This shift from ‘inventory management’ at an individual resource level to a policy-centric approach allows enterprises to manage volume and change, and they can do it anywhere with policy-as-code. 

The Secberus Cloud Governance Platform gives enterprises the ability to leverage policy-as-code across the CI/CD pipeline and any cloud stack with policies that become the single source of truth for all IaaS/PaaS (IaC/ CaC). Policies can be mapped to regulatory compliances for real-time policy assessment, reporting, and posture visibility, and the business can make sure that controls are always in place as their cloud grows. Complying with the EO doesn’t have to be a burden; building your cloud infrastructure security framework can be done today with Policy-as-Code and Secberus.