Puppet this week announced it has added a service that makes it easier to achieve compliance with benchmarks defined by the Center for Internet Security (CIS).
Yasmin Rajabi, global services strategy manager at Puppet, said the CIS Service offering from Puppet extends the ability to manage infrastructure as code into the realm of compliance. Via the service, analysts hired by Puppet will now scan infrastructure on behalf of customers and then generate a report identifying which machines do not meet CIS benchmarks.
The service also provides a list of the controls that pass or fail per node as well as scores intended to help IT teams triage issues, said Rajabi. If any drift from a previous level of compliance is detected, IT teams can then use Puppet tools to return those machines to a previous state, she noted.
The goal is to make available a service that automates what would otherwise be a time-consuming monotonous task internal IT teams normally would have to do themselves using scripts they would have to develop, she added.
Rajabi said Puppet decided to focus on CIS benchmarks because they are often considered foundational for any number of compliance mandates. Achieving CIS benchmark compliance is about 60% to 70% of the work that might be required to achieve mandates that are required in various vertical industry segments.
As IT environments become more complex many IT teams don’t have the time to manually assess their compliance with multiple mandates. However, because of audits many IT organizations wind up devoting a significant amount of time to compliance assessments. The CIS Service from Puppet offloads that tasks from IT departments in a way that produces reports that can be shared easily with an auditor, said Rajabi.
It’s not clear to what degree compliance is about to shift left along with cybersecurity. What is certain is in the wake of the COVID-19 pandemic IT teams will be looking to automate every process imaginable simply because there may be no other way to accomplish a task. Many IT organizations have already either frozen headcount or been forced to reduce the size of their existing IT staff. A service that outsources a compliance process to specialists that are better equipped to handle that task might be a timely alternative.
Whatever the motivation, most IT teams have no trouble finding ways to contribute to their organization that add a lot more value than achieving compliance. In fact, because most IT teams tend to give the compliance process short shrift because of other pressing demands on their time it’s likely mistakes will be made. Specialists who spend all their time on compliance assessments are likely to do a much better job in a fraction of the time. The challenge is making sure the IT staff doesn’t view that service as an existential threat to its existence. Of course, if they do, chances are high that the IT team in question has much bigger issues to address than simply making sure the right compliance report is being generated at the right time.