/>
X

DevSecOps is the new DevOps

In fast-moving DevOps environments, security needs to be thoroughly baked into the planning and design phases.
joe-mckendrick.jpg
Written by Joe McKendrick, Contributor on

"Shifting left," the latest buzzphrase for pushing responsibility and functionality to the beginning of the software development lifecycle, is a good idea, but more is needed -- especially in DevOps situations, in which software moves through fast, and in an automated fashion. Organizations with highly integrated security practices are well ahead with DevOps as well. 

Hence, the increasing emphasis on expanding the DevOps term to DevSecOps -- as explained in this Red Hat overview, DevSecOps means "thinking about application and infrastructure security from the start. It also means automating some security gates to keep the DevOps workflow from slowing down.".

building-6th-ave-nyc-photo-by-joe-mckendrick.jpg
Photo: Joe McKendrick

DevSecOps may seem like a dry, highly technical and siloed pursuit, but in practice, it is shaped by an open culture that seeks to deliver innovation at the rapid pace customers increasingly require. "Firms that are undergoing DevOps transformations want and need guidance on how to integrate security," state the authors of a recent survey released by Puppet, CircleCI and Splunk Inc.

The Puppet/CircleCI/Splunk survey, which involved 3,000 developers and managers, validates how DevSecOps enhances the entire DevOps practice. The survey finds that teams at higher levels of DevOps practices have automated their security policies, and they involve security teams very early in the software development lifecycle -- including the planning and design phases. 

Twenty-two percent of the firms at the highest level of security integration have reached an advanced stage of DevOps evolution, compared to only six percent of the firms with no security integration. 

Firms at the highest level of security integration, the survey shows, are able to deploy to production on demand at a significantly higher rate than firms at all other levels of integration - 61 percent are able to do so. Only 49 percent of organizations without integrated security can deploy on demand.  
A strong DevOps culture also supports stronger security, the survey finds. This is defined as "a culture of sharing, where teams collaborate using common tools and work towards common goals; where delivery teams have strong autonomy, yet it's relatively easy to cross organizational boundaries to get work done." 

What's the best path to DevSecOps? Cisco, a sprawling tech organization with a huge business stake in secure software delivery, has been employing DevSecOps methodologies to assess and improve the security posture across its many cloud-based outlets. In a recent post, Steve Martino, senior vice president and chief information security officer for Cisco, shared details of his company's journey:  

  • Establish a foundation."Using clearly defined guiding principles to drive security throughout the development process helps establish mutual trust among the engineering, operations and security teams," Martino writes.
  • Prove it out first. "At Cisco, we ran an Agile security hackathon with participants from the Information Security and application teams to first configure the most important security requirements - what we call the guardrails."
  • Automate your guardrails. "Provide an easy way for your teams to apply the guardrails, such as at the time of new account provisioning. Also develop simple scripting to retrofit those with existing accounts."
  • Continuously validate."As new resources are on-boarded or other changes occur, keep guardrails up-to-date with constant security validation and real-time monitoring of security logs. Consider creating security health reports based on specific scoring or grading criteria to send to department tenants on a regular basis." 

Related

OctoML CEO: MLOps needs to step aside for DevOps
octoml-diagram-2022

OctoML CEO: MLOps needs to step aside for DevOps

AI & Robotics
Microsoft is bringing its new 'Search highlights' to more Windows 11 PCs
pc-user

Microsoft is bringing its new 'Search highlights' to more Windows 11 PCs

Productivity
iPhone users: Google Chrome browser on iOS is getting these five new features
Scrolling through iPhone

iPhone users: Google Chrome browser on iOS is getting these five new features

Productivity