The Future of Configuration Management Software is Policy Enforcement

The old way we’ve thought about configuration management software has passed — we need a new perspective that takes into account the importance of policy enforcement. Let’s dig deeper into what this means for DevOps, your overall security and compliance strategy, and IT. 

What is Configuration Management Software? 

Configuration management software helps organizations track and manage the configuration of their IT assets such as hardware, software, operating system configuration, application deployment settings and other configuration data. 

What is Policy Enforcement? 

Policy enforcement is the process of ensuring that users and systems comply with organizational and industry standard compliance policies. This includes policies for access control, data security, and network security. 

What is the Difference Between Policy Enforcement and Configuration Management?

Policy enforcement ensures that users and systems comply with organizational and standard compliance policies, while configuration management generally tracks and manages the configuration of individual IT assets settings. Both aim to accomplish a similar goal: an infrastructure working in compliance and harmony at scale. 

Why Policy Enforcement is the New Configuration Management 

Puppet (and other) platforms have been branded as configuration management platforms, aimed at use by skilled administrators to model their desired state, and then turn those models into reality. 

Configuration management used to be both the means and the end. 

This has now evolved, mostly due to a growing set of needs and increasing infrastructure/cloud presence. Today, policy enforcement handles the specifics, while configuration management has become simply a special case of policy enforcement.

👉 Dive deeper with our free eBook, "How a Policy as Code Approach to Compliance Benefits Your Organization" >>

Consider the changing approach of putting standards and compliance first as a way to think about IT. Why? 

• Policy enforcement is proactive. Where configuration management is focused on tracking and handling IT assets, policy enforcement takes management a step further by proactively enforcing compliance for users and systems.
• Policy enforcement is scalable. Policy enforcement supports scalability by applying rules to all users and systems, no matter the size, complexity or location. It’s not possible to scale successfully if every department, every person, every role has their own special rules. Generalities ensure that IT supports the business — not the other way around.
• Policy enforcement is more secure. While configuration management can track and manage assets, this doesn’t guarantee that the assets are secure or adhering to critical security policies. Policy enforcement is already a step ahead to make sure that security incidents are prevented in the first place. 

Problem Solving with Policy Enforcement 

The problems that policy enforcement solve are narrower and more goal-oriented than a broad platform might try to accomplish. This seems to indicate that organizations are getting specific and cutting out part and pieces of platforms that just aren’t necessary for their needs. 

Policies can address things like: 

• How infrastructure is configured overall
• How their infrastructure conforms to regulatory guidelines
• Workload placement and failover
• Security access and control
• How to orchestrate various tasks 

We’ll use the real-world example of a bank with a massive IT team that uses a configuration management-first approach. In this case, the IT team is continually growing to manage the exceptions, rules, and user needs of the organization. 

As the bank grows, the IT team grows. It’s not a lean way to work — policies are individualized rather than generalized. The concern with this model is that at a certain size, the bank is supporting the growth of an IT team, and not the other way around.

How to Move Beyond Configuration Management Software 

Configuration management software shouldn’t enable policy enforcement — it should be the other way around. This can help you to ensure that your systems are always in compliance with your organization's policies. 

To move beyond configuration management software, you need to ask yourself: what are you actually trying to accomplish? What are you trying to achieve by implementing this software? 

Don't let developers spin up individual solutions when the problem can be generalized across the organization with policy. It's tempting for developers to just "wing it" when they need to make a change to a system. However, this can lead to a patchwork of different solutions that are extremely difficult to manage and maintain and can cause significant overhead and technical debt. 

Start with a policy-first approach that all developers must follow. This will ensure that your systems are always in compliance with your organization's policies and that changes are made in a controlled and consistent manner. 

Try Puppet for Policy Enforcement 

See exactly what we mean by modern, scalable policy enforcement. Get a free demo of Puppet and we’ll show you how to refine the tasks that take place every day in your infrastructure: 

SEE PUPPET FOR POLICY ENFORCEMENT