Restricted environments can benefit from agile software development too

How developing applications in the public cloud and running them in high-security environments gives defense and security organizations the best of both worlds

Defense and security used to be at the forefront of innovation. It’s why we have military organizations to thank for everything from the internet and GPS to EpiPens and microwave ovens.

But today, innovation comes from non-classified environments, not classified ones. And sensitive yet critical environments are effectively decoupled from innovation.

Take this example. You’re a CIO tasked with developing an application to run on the highly regulated, restricted environment of a military aircraft carrier. There aren’t many developers with the security clearance to work with such highly classified information – let alone with expertise in agile, cloud-based software development. So it takes 18 months and more (and lots of money) to build the application. What’s more, once it’s implemented, it doesn’t perform as well as you hoped. And your department continues to lag behind its lower-security peers in innovation.

Grown in the innovation greenhouse of the cloud

Now imagine that the application was developed outside of the aircraft carrier, in the low-regulation world of the public cloud. The developers – cloud natives, working in a development center – continually tested and refined the software in agile sprints, air-gapping it back and forth for total security.

As a result, your application is efficient, scalable and makes use of technologies like AI, data analysis, automation and open source. Yet it still complies with the regulations and security restrictions of your top-secret environment. And you’re still in control.

Given what I said at the start of this blog, you’d be forgiven for thinking that this second scenario is impossible. But it’s a real-life example from one of our clients, a national security organization.

Its message is clear: just because your organization handles restricted information doesn’t mean its access to modern, agile, cloud-based software development must be restricted, too.

Introducing the Secure Software Factory

At Capgemini, we use two concepts to help our clients to have the best of both worlds: the “Secure Software Factory” and “Dev Low, Run High”.

Depending on the use case, our Secure Software Factory consists of a combination of public, sovereign and private cloud environments.

As the diagram shows, development happens in the low-regulation environment of a public cloud infrastructure. This speeds up the process, drastically reducing the release cycles and lowering costs.

The software is then handed to a secure operations team for use in their high-risk, highly regulated environment. And if there’s a problem, they pass it back to the developers to fix. But you cannot simply transfer data and software assets to and from a high-classification, high-security environment. You need an appropriate gateway to implement the necessary protective measures – especially when you’re transferring from a highly restricted or even isolated security environment. And once you have that gateway, you need to automate the process to manage the number of releases involved.

What we use and why

At Capgemini, we use containers hosted on the RedHat OpenShift platform to implement our Secure Software Factory for clients.

This has three big advantages:

Ease of compliance

When you push code from a high- to a low-level environment, you also push all the elements embedded in that code. That’s things like specific versions of the libraries needed to run the software, or the assets it depends upon to work.

As a result, you’ll need to comply with relevant regulation around supply chain security. This could include providing a signed Software Bill of Materials (SBOM) listing the component parts and software dependencies of a software package.

OpenShift simplifies and automates the process by providing binary artifacts that are eligible for an SBOM according to SLSA guidelines. This provides a secure, fully functional pipeline for continuous integration and deployment (CI/CD), speeding up software development. And if there’s a cybersecurity issue, it’s easy to see which parts of the package are affected.

Flexibility and control

Much like cloud sovereignty, the “Dev Low, Run High” principle is a spectrum. Running applications in containers allows us to deploy the finished product anywhere along that spectrum (see below). It also provides the control and transparency security regulations demand, particularly those applying to critical infrastructures under the EU’s Cyber Resilience Act (CRA)

Using containers also allows us to:

• create microservices that are faster and easier to change than larger-scale applications
• promote a flexible “stop at will, restart from scratch” approach to fixing bugs
• scan easily for security vulnerabilities

A strong ecosystem

OpenShift is the most mature and comprehensive container platform on the market. That means there are already lots of suitable software artifacts available – no need to reinvent the wheel! And the companies in the ecosystem understand the needs, including security controls, of highly restricted areas like defense.

Bringing innovation to border control

Now you know how the Secure Software Factory works, here’s another example of it in action.

The systems and data used in border control are subject to high security and data protection requirements.

At the same time, there’s high demand for innovative solutions, like AI-supported systems, to help simplify and speed up border entry and spot illegal immigration. But only specially authorized personnel – like officials at border checkpoints – are allowed to work on them.

That means the systems must be developed outside of the physical checkpoints, then imported into the high-security environment. To make sure clearance goes smoothly, this set-up usually happens locally, at the respective checkpoints.

The process allows border control staff to benefit from the speed, efficiencies and innovation of the cloud, all from within their highly secure “bubble”.

Part of a bigger picture

Hopefully this blog has got you thinking about how our Secure Software Factory could help you.

But the real story starts much earlier, when you’re preparing to modernize your operations. So, if you’re thinking about moving certain workloads to the cloud, why not consider how your restricted environments could experience the benefits too?