Secure your code signing process in five easy steps by Eddie Glenn for Dzone.com

We’ve discussed 5 things that might indicate that your company has a code signing problem. Remember, the problem isn’t with the code signing operation itself. Signing code is a well-recognised security best practice. However, the way that you do it can make all the difference in the success of your code signing efforts. What you need to look at is how your company secures machine identities throughout your code signing process.

How many types of machine identities does your organisation protect? Check out the Forrester report to see what analysts are saying.

In this blog, let’s take a look at 5 best practices that can help your company get your code signing problem under control.

1. Establishing Global Visibility

The first step in securing the code signing process is for your InfoSec team to establish complete visibility across the enterprise for all code signing activities. You need to know critical information, such as:

• Which code is being signed, no matter if it is for internal or external use.
• Which code signing certificates are being used, regardless of the certificate authority they come from, including internally generated certificates.
• Who signed code, which machine it was signed on, when it was signed, and which code signing tool was used.
• Who, if anyone, approved the code signing operation.

2. Centrally Securing all Code Signing Private Keys

The next step in establishing a secure code signing process is to move private code signing keys off of all developers’ computers, build servers, web servers, sticky notes, etc. Private keys should be stored in an encrypted, secure and centralized location. Private keys should never leave this location for any reason. You need to customize storage options for developers based on the type of code signing certificates that they are using. For example, Extended Validation (EV) certificates must be stored in a Hardware Security Module (HSM). In addition, some compliance regulations may require that the secure storage resides within a certain location. Therefore, you may need to offer multiple secure locations.

3. Defining and Enforcing Policy With Automation

One of the reasons that development teams resist corporate security policies is that the policies are often built around manual processes. This is particularly counter-intuitive for DevOps teams that are developing at speed and scale. Manual processes simply don’t match the requirements of their projects. Because of this, you should provide a code signing platform that allows every development team to define their own code signing policies and workflows, such as:

• Who is authorized to sign code?
• What code signing tools are authorized to be used?
• Which types of certificates are allowed?
• Who gives approval (based on certificate type or phase of software development)?

That platform should also be able to automatically enforce those defined policies through workflow automation. Integrating with third-party code signing tools that developers already use helps ensure easy adoption. You will want to pay particular attention to integrating with corporate platforms, such as active directory, ticketing systems, and other SIEM tools.

4. Be a Hero, Not an Obstacle

In many cases, managing code signing infrastructure, requesting code signing certificates and renewals, in addition to normal development tasks is a burden for software development teams. You can help them achieve more secure software delivery if you are able to replace this burden with an automated, flexible platform that supports their unique needs. Furthermore, your developers will require a solution that does not add additional burdens like rewriting build scripts, installing memory-resident programs, learning new tools, or slowing down their automated build processes by requiring code to be offloaded to a central server for signing.

5. Always Showing Compliance

Your function is to secure your company’s information, including code signing credentials. A part of the success of this effort will be showing that you are effectively achieving the end goal. It’s important that you can demonstrate that you have a secured code signing process across the entire enterprise. By having an irrefutable record of all code signing operations — such as knowing where all private keys are stored and knowing that policies are always enforced — helps you ensure compliance.

Are you following these best practices for your code signing process?

Brought to you by HunterTech,A Software & IT Services Company based in Bangalore,India helps clients with secure software and application development in major skill sets.

Source: Dzone