{"id":5598,"date":"2018-05-24T14:27:37","date_gmt":"2018-05-24T13:27:37","guid":{"rendered":"https:\/\/ee.yelkdev.site\/?p=5598"},"modified":"2023-09-25T10:23:44","modified_gmt":"2023-09-25T09:23:44","slug":"rethinking-production-systems","status":"publish","type":"post","link":"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/","title":{"rendered":"Rethinking production systems"},"content":{"rendered":"

Amidst the talk about pipelines and production systems, and despite the parallels drawn between production lines in manufacturing and software engineering, the industry seems to have lost the true meaning of \u2018production\u2019.\u00a0Reflecting on this leads us back to a clearer separation between production and the product.<\/span><\/p>\n

In this post I’ll look at why pipeline security matters, and it’s followed by a second post<\/a> on the practical steps you can take to improve the security of your pipelines.<\/span><\/p>\n

The dictionary definition of \u2018production\u2019 is \u2018the action of making or manufacturing from components or raw materials, or the process of being so manufactured\u2019.<\/i><\/span><\/p>\n\"Rethinking-_Production_Systems\"\n

However, if you ask almost any software delivery team, they\u2019ll tell you that \u2018production\u2019 is where the system runs with real data and real users. \u2018Production\u2019 is an environment; in fact, it\u2019s the last in a series of environments (such as development, testing, staging, etc.) that are all used to deliver software.<\/span><\/p>\n

However, the side effect of this is that we can easily forget to treat the production line<\/i> as a production system<\/i>.<\/span><\/p>\n

Pipelines are production systems\u2026 literally!<\/span><\/h3>\n

In the most literal sense, pipelines are production systems. And despite what we might call it, \u2018production\u2019 is not an environment, it is a process. Of course, the product we build is critically important – it\u2019s the reason we\u2019re there in the first place. But it\u2019s vital that we don\u2019t lose sight of the value we gain from our delivery pipelines, and the implications that has for us in how we operate them.<\/span><\/p>\n

For example, how many build pipelines have you worked with that were properly monitored? How many pipelines have their logs and metrics fed into ELK or Grafana, or produce reliable audit events to trace activity in the various stages in the production line? How many pipelines have you worked with that permitted any authenticated user to run any job? How many even required authentication?<\/span><\/p>\n

Pipelines are intrinsic to the product<\/span><\/h3>\n

Well-managed pipelines are intrinsic to high quality, secure software. For example, we can\u2019t produce reliable performance test results unless we can be confident that our performance testing environment accurately reflects production. By the same token, we can\u2019t produce secure software if we can\u2019t trust the security of the process by which it was produced.\u00a0<\/span><\/p>\n

A good example of this can be found in food safety, where product packaging contains clear warnings about allergens – particularly those that can mean the difference between life and death. It\u2019s one thing to say ‘may contain traces of nuts or peanuts’; but it\u2019s an entirely different situation to offer a ‘nut free’ product. Both of those statements are as much about the production process as the product itself, and both matter a great deal to the end user.<\/p>\n

Securing the production line<\/span><\/h3>\n

Life and death isn\u2019t always at stake; however, there are many other factors to consider. Build pipelines produce the software that runs in the live environment, and often have the ability to deploy directly to that environment. Failing to adequately secure such powerful tools leaves us open to costly compromise.<\/span><\/p>\n

With all the talk of GDPR, it\u2019s easy to forget that personal data isn\u2019t the only thing worth protecting, nor is it the only thing attackers are interested in (as Tesla found out when its exposed Kubernetes cluster was abused for cryptocurrency mining).<\/span><\/p>\n

So how do we go about securing the production line? A good starting point is to threat model our pipelines in the same way we do for the software we\u2019re building. A well-constructed threat model will highlight areas of risk that need our attention and drive prioritisation of any improvements, leading to in an increasingly secure pipeline based on risk.<\/span><\/p>\n

Unless we can provide a production line that is secure enough for our needs, we cannot build software that is secure enough for our needs. For some practical steps you can take to secure your pipelines, read my second post<\/a>.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Amidst the talk about pipelines and production systems, and despite the parallels drawn between production lines in manufacturing and software engineering, the industry seems to have lost the true meaning of \u2018production\u2019.\u00a0Reflecting on this leads us back to a clearer separation between production and the product. In this post I’ll look at why pipeline security […]<\/p>\n","protected":false},"author":76,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"categories":[5],"tags":[],"location":[397],"class_list":["post-5598","post","type-post","status-publish","format-standard","hentry","category-our-thinking"],"acf":[],"yoast_head":"\nRethinking production systems | Equal Experts<\/title>\n<meta name=\"description\" content=\"Amidst the talk about pipelines and production systems, and despite the parallels drawn between production lines in manufacturing and software engineering, the industry seems to have lost the true meaning of \u2018production\u2019. Reflecting on this leads us back to a clearer separation between production and the product.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Rethinking production systems\" \/>\n<meta property=\"og:description\" content=\"Amidst the talk about pipelines and production systems, and despite the parallels drawn between production lines in manufacturing and software engineering, the industry seems to have lost the true meaning of \u2018production\u2019.\u00a0Reflecting on this leads us back to a clearer separation between production and the product.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/\" \/>\n<meta property=\"og:site_name\" content=\"Equal Experts\" \/>\n<meta property=\"article:published_time\" content=\"2018-05-24T13:27:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-09-25T09:23:44+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.equalexperts.com\/wp-content\/uploads\/2018\/05\/Rethinking-_Production_Systems.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1170\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Stuart Gunter\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"Rethinking production systems\" \/>\n<meta name=\"twitter:creator\" content=\"@EqualExperts\" \/>\n<meta name=\"twitter:site\" content=\"@EqualExperts\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Stuart Gunter\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/\"},\"author\":{\"name\":\"Stuart Gunter\",\"@id\":\"https:\/\/www.equalexperts.com\/#\/schema\/person\/5a21b96defd660dd42e1692ce9f7ff88\"},\"headline\":\"Rethinking production systems\",\"datePublished\":\"2018-05-24T13:27:37+00:00\",\"dateModified\":\"2023-09-25T09:23:44+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/\"},\"wordCount\":674,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.equalexperts.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.equalexperts.com\/wp-content\/uploads\/2018\/05\/Rethinking-_Production_Systems.jpg\",\"articleSection\":[\"Our Thinking\"],\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/\",\"url\":\"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/\",\"name\":\"Rethinking production systems | Equal Experts\",\"isPartOf\":{\"@id\":\"https:\/\/www.equalexperts.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.equalexperts.com\/wp-content\/uploads\/2018\/05\/Rethinking-_Production_Systems.jpg\",\"datePublished\":\"2018-05-24T13:27:37+00:00\",\"dateModified\":\"2023-09-25T09:23:44+00:00\",\"description\":\"Amidst the talk about pipelines and production systems, and despite the parallels drawn between production lines in manufacturing and software engineering, the industry seems to have lost the true meaning of \u2018production\u2019. Reflecting on this leads us back to a clearer separation between production and the product.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/#primaryimage\",\"url\":\"https:\/\/www.equalexperts.com\/wp-content\/uploads\/2018\/05\/Rethinking-_Production_Systems.jpg\",\"contentUrl\":\"https:\/\/www.equalexperts.com\/wp-content\/uploads\/2018\/05\/Rethinking-_Production_Systems.jpg\",\"width\":1170,\"height\":720,\"caption\":\"Rethinking-_Production_Systems\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.equalexperts.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Rethinking production systems\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.equalexperts.com\/#website\",\"url\":\"https:\/\/www.equalexperts.com\/\",\"name\":\"Equal Experts\",\"description\":\"Making Software. Better.\",\"publisher\":{\"@id\":\"https:\/\/www.equalexperts.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.equalexperts.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.equalexperts.com\/#organization\",\"name\":\"Equal Experts\",\"url\":\"https:\/\/www.equalexperts.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.equalexperts.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.equalexperts.com\/wp-content\/uploads\/2018\/08\/Equal_Experts_Logo_CMYK_Colour.jpg\",\"contentUrl\":\"https:\/\/www.equalexperts.com\/wp-content\/uploads\/2018\/08\/Equal_Experts_Logo_CMYK_Colour.jpg\",\"width\":719,\"height\":340,\"caption\":\"Equal Experts\"},\"image\":{\"@id\":\"https:\/\/www.equalexperts.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/EqualExperts\",\"https:\/\/www.linkedin.com\/company\/equal-experts\/?viewAsMember=true\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.equalexperts.com\/#\/schema\/person\/5a21b96defd660dd42e1692ce9f7ff88\",\"name\":\"Stuart Gunter\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.equalexperts.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d595653748eebaf4ac1bf9e2abf7ddb48ce96f3bb5f6d30790d80149119dfe5e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d595653748eebaf4ac1bf9e2abf7ddb48ce96f3bb5f6d30790d80149119dfe5e?s=96&d=mm&r=g\",\"caption\":\"Stuart Gunter\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Rethinking production systems | Equal Experts","description":"Amidst the talk about pipelines and production systems, and despite the parallels drawn between production lines in manufacturing and software engineering, the industry seems to have lost the true meaning of \u2018production\u2019. Reflecting on this leads us back to a clearer separation between production and the product.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/","og_locale":"en_GB","og_type":"article","og_title":"Rethinking production systems","og_description":"Amidst the talk about pipelines and production systems, and despite the parallels drawn between production lines in manufacturing and software engineering, the industry seems to have lost the true meaning of \u2018production\u2019.\u00a0Reflecting on this leads us back to a clearer separation between production and the product.","og_url":"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/","og_site_name":"Equal Experts","article_published_time":"2018-05-24T13:27:37+00:00","article_modified_time":"2023-09-25T09:23:44+00:00","og_image":[{"width":1170,"height":720,"url":"https:\/\/www.equalexperts.com\/wp-content\/uploads\/2018\/05\/Rethinking-_Production_Systems.jpg","type":"image\/jpeg"}],"author":"Stuart Gunter","twitter_card":"summary_large_image","twitter_title":"Rethinking production systems","twitter_creator":"@EqualExperts","twitter_site":"@EqualExperts","twitter_misc":{"Written by":"Stuart Gunter","Estimated reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/#article","isPartOf":{"@id":"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/"},"author":{"name":"Stuart Gunter","@id":"https:\/\/www.equalexperts.com\/#\/schema\/person\/5a21b96defd660dd42e1692ce9f7ff88"},"headline":"Rethinking production systems","datePublished":"2018-05-24T13:27:37+00:00","dateModified":"2023-09-25T09:23:44+00:00","mainEntityOfPage":{"@id":"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/"},"wordCount":674,"commentCount":0,"publisher":{"@id":"https:\/\/www.equalexperts.com\/#organization"},"image":{"@id":"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/#primaryimage"},"thumbnailUrl":"https:\/\/www.equalexperts.com\/wp-content\/uploads\/2018\/05\/Rethinking-_Production_Systems.jpg","articleSection":["Our Thinking"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/","url":"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/","name":"Rethinking production systems | Equal Experts","isPartOf":{"@id":"https:\/\/www.equalexperts.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/#primaryimage"},"image":{"@id":"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/#primaryimage"},"thumbnailUrl":"https:\/\/www.equalexperts.com\/wp-content\/uploads\/2018\/05\/Rethinking-_Production_Systems.jpg","datePublished":"2018-05-24T13:27:37+00:00","dateModified":"2023-09-25T09:23:44+00:00","description":"Amidst the talk about pipelines and production systems, and despite the parallels drawn between production lines in manufacturing and software engineering, the industry seems to have lost the true meaning of \u2018production\u2019. Reflecting on this leads us back to a clearer separation between production and the product.","breadcrumb":{"@id":"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/#primaryimage","url":"https:\/\/www.equalexperts.com\/wp-content\/uploads\/2018\/05\/Rethinking-_Production_Systems.jpg","contentUrl":"https:\/\/www.equalexperts.com\/wp-content\/uploads\/2018\/05\/Rethinking-_Production_Systems.jpg","width":1170,"height":720,"caption":"Rethinking-_Production_Systems"},{"@type":"BreadcrumbList","@id":"https:\/\/www.equalexperts.com\/blog\/our-thinking\/rethinking-production-systems\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.equalexperts.com\/"},{"@type":"ListItem","position":2,"name":"Rethinking production systems"}]},{"@type":"WebSite","@id":"https:\/\/www.equalexperts.com\/#website","url":"https:\/\/www.equalexperts.com\/","name":"Equal Experts","description":"Making Software. Better.","publisher":{"@id":"https:\/\/www.equalexperts.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.equalexperts.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/www.equalexperts.com\/#organization","name":"Equal Experts","url":"https:\/\/www.equalexperts.com\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.equalexperts.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.equalexperts.com\/wp-content\/uploads\/2018\/08\/Equal_Experts_Logo_CMYK_Colour.jpg","contentUrl":"https:\/\/www.equalexperts.com\/wp-content\/uploads\/2018\/08\/Equal_Experts_Logo_CMYK_Colour.jpg","width":719,"height":340,"caption":"Equal Experts"},"image":{"@id":"https:\/\/www.equalexperts.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/EqualExperts","https:\/\/www.linkedin.com\/company\/equal-experts\/?viewAsMember=true"]},{"@type":"Person","@id":"https:\/\/www.equalexperts.com\/#\/schema\/person\/5a21b96defd660dd42e1692ce9f7ff88","name":"Stuart Gunter","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.equalexperts.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d595653748eebaf4ac1bf9e2abf7ddb48ce96f3bb5f6d30790d80149119dfe5e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d595653748eebaf4ac1bf9e2abf7ddb48ce96f3bb5f6d30790d80149119dfe5e?s=96&d=mm&r=g","caption":"Stuart Gunter"}}]}},"_links":{"self":[{"href":"https:\/\/www.equalexperts.com\/wp-json\/wp\/v2\/posts\/5598","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.equalexperts.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.equalexperts.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.equalexperts.com\/wp-json\/wp\/v2\/users\/76"}],"replies":[{"embeddable":true,"href":"https:\/\/www.equalexperts.com\/wp-json\/wp\/v2\/comments?post=5598"}],"version-history":[{"count":0,"href":"https:\/\/www.equalexperts.com\/wp-json\/wp\/v2\/posts\/5598\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.equalexperts.com\/wp-json\/wp\/v2\/media?parent=5598"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.equalexperts.com\/wp-json\/wp\/v2\/categories?post=5598"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.equalexperts.com\/wp-json\/wp\/v2\/tags?post=5598"},{"taxonomy":"location","embeddable":true,"href":"https:\/\/www.equalexperts.com\/wp-json\/wp\/v2\/location?post=5598"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}