Acuity Health: Part 2 — Zero Trust DevSecOps & NIST SSDF

When engineering teams scale distributed cloud services in highly regulated sectors like healthcare, traditional perimeter defense completely collapses. Developers need rapid access to packages, continuous integration, and staging environments, while security leads must guarantee that electronic Protected Health Information (ePHI) is never exposed to unhardened code or compromised dependencies.

For lean engineering teams, the solution is not heavy manual gatekeeping. Instead, security must be built directly into the development infrastructure through Zero Trust Architecture (ZTA) and the NIST Secure Software Development Framework (SP 800-218 v1.1).

In this second installment of our Acuity Health Security Architecture series, we break down how to architect isolated development landing zones, enforce ephemeral build pipelines, and secure the software supply chain.

The Zero Trust Engineering Plane

Zero Trust principles (Never Trust, Always Verify; Assume Breach; Least Privilege) must apply to developer workstations and build infrastructure just as rigorously as production databases.

In a traditional setup, developer environments frequently share network routes with staging or internal database replicas. If a developer workstation is compromised via phishing or an untrusted package, attackers can pivot laterally into core clinical networks.

flowchart LR
    subgraph Untrusted ["Untrusted Internet & Public Registries"]
        PublicNPM["Public npm / NuGet"]
        Malicious["Compromised Dependency / Typosquat"]
    end

    subgraph DevPlane ["Isolated Dev Plane (Azure DevTest Labs)"]
        Workstation["Dev Workstation (MFA + Conditional Access)"]
        ArtProxy["Artifact Firewall & Cache (SCA Pre-Scan)"]
    end

    subgraph CIPlane ["Ephemeral CI/CD Plane"]
        Runner["Dynamic Ephemeral Agent (Runs in isolated vNet)"]
        Signing["Cryptographic Artifact Signing"]
    end

    subgraph ProdDMZ ["Production DMZ & Ingress"]
        APIGW["API Gateway (Policy Enforcement Point)"]
        AKS["Azure Kubernetes Service (Production)"]
    end

    PublicNPM -->|Filtered via HTTPS| ArtProxy
    Malicious -.->|Blocked by SCA Gate| ArtProxy
    ArtProxy --> Runner
    Workstation -->|Commit / PR| Runner
    Runner --> Signing
    Signing --> APIGW
    APIGW --> AKS

Architectural Controls in Practice

1. Logical Network Segmentation: Development infrastructure is hosted in dedicated Azure DevTest Labs isolated behind Network Security Groups (NSGs). Development subnets have zero routing paths to production Electronic Medical Record (EMR) databases or production telemetry.

2. API Gateways as Policy Enforcement Points (PEPs): All inbound and outbound traffic between internal tiers passes through API Gateways located within a Demilitarized Zone (DMZ). Traffic is authenticated via mutual TLS (mTLS) and scoped using granular Role-Based Access Control (RBAC).

3. Ephemeral Build Runners: Build agents are stateless and single-use. They spin up inside isolated containers for the duration of a single commit job, execute pre-build linters and scans, compile the artifact, sign it cryptographically, and immediately terminate. No persistent credentials or artifacts reside on the runner.

Operationalizing NIST SP 800-218 (SSDF v1.1)

The NIST Secure Software Development Framework organizes AppSec into four outcome-based pillars. Here is how lean teams translate those requirements into daily engineering workflows:

1. Prepare the Organization (PO)

• Security Champions: Appoint one lead engineer in each development squad to act as the primary security liaison. Champions review pull requests for security edge-cases and participate in monthly threat intelligence briefings.
• Contextual Training: Move beyond generic compliance videos. Developers receive hands-on training tailored to their stack, specifically targeting OWASP Top 10 and API-specific vulnerabilities like Broken Object Level Authorization (BOLA).

2. Protect the Software (PS)

• Cryptographic Signing: Every compiled binary or container image is signed using keys stored in an isolated Hardware Security Module (Azure Key Vault Managed HSM) via Cosign/Notary.
• Software Bill of Materials (SBOM): Every CI build automatically outputs a machine-readable SBOM in SPDX or CycloneDX format, cataloging every direct and transitive dependency.

3. Produce Well-Secured Software (PW)

• Approved Cryptographic Libraries: Developers are prohibited from implementing custom cryptography or ad-hoc authentication routines. Applications must consume hardened internal SDKs enforcing AES-256-GCM at rest and TLS 1.3 in transit.
• Automated Pre-Commit Linters: Linting rules catch unparameterized database queries, weak entropy sources, and hardcoded API secrets before code leaves the developer’s IDE.

4. Respond to Vulnerabilities (RV)

• Vulnerability Disclosure Policy (VDP): A clear security.txt and disclosure channel enables external ethical researchers to submit vulnerability reports safely.
• Strict Remediation SLAs:
  • Critical (CVSS 9.0–10.0): Remediate and deploy within 48 hours.
  • High (CVSS 7.0–8.9): Remediate within 14 days.
  • Medium/Low: Scheduled into the next sprint cycle (30-day window).

Hardening the Software Supply Chain

Modern applications are rarely built from scratch; 80% to 90% of a typical cloud service consists of third-party open-source packages. A supply chain attack that compromises an upstream npm or NuGet library can bypass traditional perimeter firewalls entirely.

sequenceDiagram
    autonumber
    actor Dev as Developer Workstation
    participant Art as Artifact Proxy (Nexus/Artifactory)
    participant SCA as SCA Engine (Trivy/Snyk)
    participant Reg as Upstream Registry (npm/NuGet)
    participant Runner as Ephemeral CI Runner

    Dev->>Art: Request Package: express@4.19.2
    alt Package Cached & Clean
        Art-->>Dev: Return Cached Package
    else Package Not Cached
        Art->>Reg: Fetch Upstream Package
        Reg-->>Art: Stream Package Tarball
        Art->>SCA: Trigger Automated Vulnerability & Malware Scan
        alt Vulnerability Found (Critical CVE / Malicious)
            SCA-->>Art: Quarantine Flag
            Art-->>Dev: 403 Forbidden: Package Blocked by Security Policy
        else Package Clean
            SCA-->>Art: Scan Passed (Signed)
            Art-->>Dev: Deliver Package
        end
    end
    Dev->>Runner: Submit Code Commit with Lockfile
    Runner->>Art: Fetch Verified Packages from Cache
    Runner->>Runner: Generate CycloneDX SBOM & Sign Container

Supply Chain Enforcement Rules

1. Proxy-Restricted Outbound Egress: Direct internet access to public package registries (npmjs.org, nuget.org, pypi.org) is blocked across all developer endpoints and CI runners. All dependency requests are routed through a managed artifact proxy.

2. Automated Quarantine on Ingestion: When a new dependency is requested, the artifact proxy runs an automated Software Composition Analysis (SCA) scan against the National Vulnerability Database (NVD) and commercial threat feeds. Any package containing known vulnerabilities with CVSS scores $\ge 7.0$ or suspicious heuristics (e.g., install scripts running base64-decoded network sockets) is immediately quarantined.

3. Deterministic Dependency Pinning: Pipelines mandate strict lockfiles (package-lock.json, packages.lock.json, Pipfile.lock). Dynamic semantic version ranges (e.g., ^1.2.0 or *) are blocked by CI linters to prevent silent, uncontrolled upstream updates.

Implementation Checklist: Part 1

Use this checklist to benchmark your development infrastructure against Zero Trust and NIST SSDF standards:

• Infrastructure: Development workloads run in isolated virtual networks with zero routable pathways to production data stores.
• Access Control: Source control repositories enforce mandatory MFA and conditional access based on device health.
• Pipeline Isolation: CI runners are 100% ephemeral, dynamically provisioned, and destroyed after each job.
• Supply Chain: Outbound package downloads route through an artifact caching proxy with automated SCA quarantine gates.
• Artifact Integrity: Build outputs generate automated SBOMs (CycloneDX/SPDX) and are cryptographically signed before container registry push.

[!TIP] Open-Source Reference Implementation: Looking for a working reference implementation of ephemeral quality gates, Gitleaks secret detection, and decoupled static publication pipelines? Explore SixFiveMil/hugo-devsecops-starter on GitHub.

Up Next in the Series

In Part 3: Threat Modeling at Sprint Velocity: STRIDE Gates and BOLA Defenses (releasing Tuesday, September 22), we move from infrastructure to application architecture:

• How to run lightweight 15-minute mini-STRIDE sessions during Agile backlog grooming.
• Mapping Data Flow Diagrams (DFDs) across clinical trust boundaries.
• Concrete code patterns to eliminate OWASP API1: Broken Object Level Authorization (BOLA) using cryptographically secure UUIDs and data-layer authorization context checks.