Moving from DevOps to DevSecOps: The Path to Security

Moving from DevOps to DevSecOps: The Path to Security

Security is now being analyzed during the development process to account for every variable.

Given the fact that software vulnerabilities cause the majority of data breaches, security must be a top priority for all organizations. An app feature that crashes unexpectedly is guaranteed to frustrate users, while a security vulnerability that facilitates a million-dollar data breach will have a profound, crippling impact on the company as a whole.

Security has changed drastically over the years, particularly its cost as threats rise in number and sophistication. Security is now being analyzed during the development process to account for every variable. If a bug is found at the end of the process, it is expensive to fix, and teams have to re-run and reevaluate their processes, causing delays in delivery. A security bug may also require “re-architecting,” which will require an even larger change to the functionality.

DevSecOps is a philosophy streamlines these processes by incorporating them alongside the devleopment process to help ensure that breaches do not happen. It enhances the collaboration between development and operations teams by placing security at the heart of the process and creating faster more efficient ways to safely deliver code in an agile architecture. Put simply, DevSecOps involves adding security to the existing DevOps process, whereby automated tests, non-functional requirements and compliance gating are incorporated into the standard DevOps cycle.

So how can organizations implement a fully functional DevSecOps philosophy?

Shift to the Left

Shifting the focus of security to the left in the development cycle essentially means that identifying vulnerabilities should be an integral part of the development process from the beginning. To do so, security cannot be the responsibility of a single team or person, but rather a shared initiative across IT operations, security and development teams. By making this shift in the software development lifecycle, the process will run both quickly and securely.

If it’s a shared responsibility, then it requires a shared knowledge of what and how to watch and implement. To be able to move left in the cycle with this shared knowledge, pipeline phases and gates need to be incorporated. By breaking down delivery into phases and gates, teams can include threat analysis as an iteration to make sure it happens, and they can incorporate non-functional requirements into the product features.

By adopting this “shifting left” philosophy, development will not only be accelerated, but it will also limit potential security threats in the future while addressing existing threats at the least cost with minimal damage to the platform.

Apply Continuous Automation

Apply continuous and focused automation such as linting is essential to the success of the DevSecOps environment. Automation, when woven into the software development life cycle from the start, can reduce the friction that occurs between security and development teams by quickly addressing existing and potential concerns at the lowest cost.

Adding automated security checks earlier in the process enables developers to work on code that is current, rather than doing a final threat push on 3-sprints of code where the developers are looking back on code that was written more than six weeks ago, which can be a difficult switch of context. By eliminating this challenge, both quality and hardening are built into the code far more effectively than to adding these in at the end of the process.

Incorporating Governance

Governance and DevOps are often at odds over how they make sure that there are no security issues before they go to release. Release orchestration tools can be introduced to solve this conflict, and criteria gates can be added to make sure that governance and DevOps work together.

When security testing is conducted in the development process is an important consideration in terms of lessening impact as well. Addressing security issues in completed code is much more cumbersome, and expensive, than addressing them while still coding. To combat this, governance also needs to be added into the beginning of processes so that it can be tracked throughout the entire lifecycle. Security teams can audit, monitor and coach the progress throughout the lifecycle as well.

Harden Your Microservices

In the world of legacy software, the number of interactions with other sources is not very high. In microservices, it is the opposite, and there is an added need to make sure all of these interactions are communicating with each other in a secure way.

Single-function modules that contain well-defined operations and interfaces are essential for successfully implementing a comprehensive DevSecOps approach. By constantly monitoring, upgrading and tweaking the microservice-based infrastructure, organizations will be better equipped for new developments.

There needs to be a concerted effort to stop leaving technical debt in the form of insecure computing. If you don’t have time to do it securely now, when will you? By going down the road of fully implementing DevSecOps philosophies, organizations will be armed with massive economic and technical advantages over less secure organizations.

To be able to keep pace in the constantly evolving landscape of software delivery in 2019, DevSecOps adoption is imperative. Failing to implement these philosophies will undoubtedly be the demise of many, and without doing so, they will no longer be relevant and competitive in the industry.

Featured

Featured Cybersecurity

Webinars

New Products

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure. 3

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening. 3

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation. 3