SOLUTION OVERVIEWTENABLE.CS & HASHICORPTERRAFORM CLOUDESTABLISH COMPLIANCE AND SECURITY GUARDRAILS IN THE DEVELOPMENT PROCESS BEFORE RUNTIME

BUSINESS CHALLENGE
Cloud services and applications are elastic, cost efficient, and most importantly,
enable organizations to respond quickly to shifting customer needs. But, with thebenefits of agility and efficiency, comes the challenge of protecting and securingresources and workloads in the public cloud.

TECHNOLOGYCOMPONENTS• Tenable.cs• HashiCorp Terraform Cloud

KEY BENEFITS• Identify and remove cloud flawsduring development before they
ever reach production.
• Take advantage of policies acrossall leading standards, or create
your own.

There are existing solutions designed to protect the cloud, but they are applied
too late. Risks identified in runtime are already exposed to attackers, and fixes
applied in runtime will be overwritten with the next code deployment. Additionally,
cloud environments are highly dynamic with new updates continuously released
into production and workloads scaling up and down based on customer demand.
Runtime-focused cloud security solutions aren’t sufficient to enable agile DevOps
principles because they are too disruptive to their automated development
processes. Moreover, they do not provide the necessary context for developers
to appropriately prioritize risks and remediate findings. These problems areexacerbated as developers embrace GitOps to automate the build and deployment
processes.
Finally, existing security solutions are unable to support the full Software
Development Lifecycle (SDLC) from development to operations, nor are they able tosecure cloud environments from Infrastructure as Code to cloud resources to cloud
workloads. Security teams need comprehensive, end-to-end capabilities to prevent
cloud exposures, continuously monitor for configuration drift and continuouslydetect new vulnerabilities.

• Improve communication between
security, cloud operations andDevOps for greater efficiency.
• Understand the security postureof cloud environments alongside
your on-prem assets.

SOLUTION
Tenable.cs and HashiCorp Terraform Cloud enable teams to codify cloud security
policies for infrastructure as code with automated enforcement and remediation
recommendations as part of their development workflow. For HashiCorp Terraform
Cloud users, it has never been easier to establish compliance and security
guardrails in the development process that ensures infrastructure is secure before
it is provisioned.
Tenable.cs can be used to evaluate your Terraform Cloud templates for security
violations to reduce risk before they are introduced into your runtime environment.
To accomplish this, Tenable.cs can be integrated as a “Run Task” that is triggeredeach time a Terraform Cloud plan is executed to find flaws and provide specificremediation recommendations.

VALUEHOW IT WORKSSECURE INFRASTRUCTURE AS CODE
Establish guardrails in automated GitOps and CI/CD processes

PLAN

that ensure secure deployments with minimal effort. It’s extremely

1.

APPLY
2.

3.

difficult to assess the setup and configuration of the 100 different
services in Amazon Web Services (AWS) to answer the question “arethese services configured securely?” Any misconfiguration in yourcloud environment can expose you to risks such as unauthorized

1. Submit a plan and apply run within Terraform Cloud

access to business critical assets. What makes it even more

2. Once the Terraform Cloud plan is executed Terraform Cloud cloudchallenging is that there is no one-time fix for misconfiguration

will trigger Tenable.cs for security policy evaluation

issues. In dynamic cloud environments, what’s secure today may bea risk tomorrow.

3. Results of the scan are available within Tenable.cs and Terraform
Cloud run can behalted if the Terraform Cloud run task is configured

LEVERAGE SPECIFIC REMEDIATIONRECOMMENDATIONS, INSTANTLY
Knowing the exact remediation steps can be time intensive andchallenging. Remediation guidance and recommendations areprovided to help with patching operations for specific Terraform
templates before being provisioned.

in “mandatory” mode and policy violations are found.

For More Information:
Please visit tenable.com
Contact Us:
Please email us at sales@tenable.com or visit
tenable.com/contact

PREVENT CLOUD POSTURE DRIFT
Many cloud assets are clones of one another and have a cascadeeffect on other copies. Once an asset is exposed, even if it was
short-lived, nobody can predict its blast radius before it isdecommissioned. Automatically propagate compliant, authorized
configuration changes from runtime to IaC.

POLICY ASSURANCE
It’s extremely difficult to enforce and be consistent with security
best practices in the cloud - the complexity of cloud and poor cloudsecurity policy knowledge cause misconfiguration in the cloudand lack of compliance. Ensure cloud environments are compliant
with policies from development through runtime, while addressing
remediations in IaC and container images.

ABOUT TENABLE
Tenable®️ is the Cyber Exposure company. Approximately 40,000 organizations around the globe rely on Tenable to understand and reducecyber risk. As the creator of Nessus®️, Tenable extended its expertise in vulnerabilities to deliver the world’s first platform to see and secure anydigital asset on any computing platform. Tenable customers include approximately 60 percent of the Fortune 500, approximately 40 percent ofthe Global 2000, and large government agencies. Learn more at tenable.com.

COPYRIGHT 2022 TENABLE, INC. ALL RIGHTS RESERVED. TENABLE, TENABLE.IO, NESSUS, ALSID,INDEGY, LUMIN, ASSURE, AND LOG CORRELATION ENGINE ARE REGISTERED TRADEMARKS OFTENABLE, INC. OR ITS AFFILIATES. TENABLE.SC, TENABLE.OT, TENABLE.AD, EXPOSURE.AI, ANDTHE CYBER EXPOSURE COMPANY ARE TRADEMARKS OF TENABLE, INC. OR ITS AFFILIATES. ALL
OTHER PRODUCTS OR SERVICES ARE TRADEMARKS OF THEIR RESPECTIVE OWNERS.

Solution Brief / T.cs HashiCorp / 050322