You are a security specialist contracted for an advisory position on behalf of IT-Master, a leading technology training company. Your primary responsibility is to collaborate with a team of IT experts to make IT security recommendations for an infrastructure project involving the electrical grid.
Specifically, you are to plan out a process of recommending, acquiring, and vetting applications of several types for use in the project. This software will include enterprise resource planning (ERP) software, configuration management database software (CMDB), customer relationship management software (CRM), and power system analysis software. It will also include controller and monitoring software for renewable energy sources such as solar and wind-based power generating devices.
Some of this software will be acquired from third-party developers, while in-house software engineers will develop others.
Ultimately, your goal will be security. There is zero tolerance for error when it comes to critical national infrastructure that is a potential cyber target. You will be responsible for making decisions such as defining security standards for software, application programming interfaces (API), third-party applications and libraries. Managing the acquisition process of middleware products is also your responsibility.
Your team will oversee the development pipeline of proprietary control software and perform testing and validation of that software. The need for a container environment versus a VM environment is typically dictated by the software requirements. To that end, you have decided upon the following methods.
Parameters:
- You have decided to implement all configuration management and customer relationship management databases inside Docker containers.
- Containers will be deployed using a lightweight enterprise service bus (ESB) architecture on top of a Kubernetes container orchestration engine as the deployment platform.
- GitLab is used as the CI/CD pipeline with built-in security scanning features.
- The registry must use TLS and container images must be verified before deployment.