Why One-Click Deployment May Be a Security Anti-Pattern

[johny899]

It's awesome the day you get to deploy your app with just a one click of the mouse! I know, I remember the first time I used a one-click deploy. Everything happened quickly, and I thought to myself, "This is fantastic! It went so fast." Later on, I did experience some security issues which got me thinking, could using one-click deployment put me at risk?

One-click Deployments Can Offer a Great User Experience​

The benefit of one-click deployment is time saved by allowing your application to be deployed quickly and with little need for manual intervention. Additionally, I like using this option because it reduces the amount of time and effort that goes into configuring and deploying new servers. Who wants to do that?

The downside of speed when using one-click deployment tools is that important settings can be overlooked. When you use these types of tools to configure everything for you, you might not know what configurations the tool used when you deployed your app. Have you ever deployed an app only to discover later that you missed certain options? I certainly have, and that’s where you can run into problems.

One-Click Deployments Can Create Security Vulnerabilities​

The use of "one-click" tools is not what causes security issues, but rather people relying too heavily on them. Apps have been released into production with weak passwords or wide-open access because the default settings appear correct.

The following are common issues I see often.

• Default settings being insecure
• A user granting too many permissions
• Images of software that are out of date
• Not having a defined process for updates and patches

Is One-Click Deployment Really Bad?​

When I utilize one-click deployment options I always audit my security settings after deploying the application, and this allows me both speed and security - does this seem reasonable to you?

How to Safely Use One-Click Deployments​

If you want to have it both easy and secure you should always:

• Review your default settings
• Run a security scan after performing one-click deployment
• Only grant your application the privileges it needs
• Document what the automated tool does

Summary​

So, should you consider using one-click deployments an anti-pattern for security? The answer to this is that as long as you monitor how your application(s) are being used or have automated usage monitoring, then yes. You should be aware of the potential risks associated with using any type of automated tool to deploy your application, especially if it has not been thoroughly verified as complete and intact. Speed is an essential aspect of the overall software development cycle, combining speed with security is much more critical.