Résumé

Even though modern IT systems get more and more secure over time, new security vulnerabilities and issues are discovered every day, causing significant economic loss and legal problems. Machine Learning (ML) systems are no exception. To ensure a robust, secure and privacy compliant system, the DevSecOps approach has been implemented on a prediction server for the eVIP (Energy Visualization Integration and Prediction) project. DevSecOps is known to be a methodology that enhances standard DevOps practices and tools by adding a security layer throughout the entire development lifecycle [1]. The eVIP project aims to predict the load curve of electric vehicles (EV) in a semi-private context related to hotels and restaurants in collaboration with OIKEN (regional Distribution System Operator). The eVIP prediction server has been developed and deployed to predict power consumption of pilot hotels for the next 15 minutes. This service enables the eVIP system to automatically set the amps of hotels’ charging stations. Using Vehicle to Grid (V2G) protocol, EV batteries can act as a temporary power supply for hotels to optimize peak consumption. Considering the complexity of machine learning systems, and the fact that it needs several improvement iterations, developers must ensure that no security breach is added by mistake to the code in between releases. To limit risks, we present a DevSecOps pipeline that automates redundant but essential tasks, including unit tests, API tests and security scans. This process automatically deploys updates in production and will identify and block deployment of insecure releases if a vulnerability is found

Détails

Actions