Shifting Left for DevOps Success
Filip Verloy Technical Evangelist discusses…
DevSecOps is a software development approach that incorporates security measures throughout the entire DevOps process. It emphasizes collaboration and integration between development, operations, and security teams to ensure that security practices are implemented at every stage of the software development lifecycle.
DevSecOps is a software development practice that adds cybersecurity (Sec) to DevOps, which is itself a combination of software development (Dev) and IT operations (Ops). Before the advent of DevOps, developers wrote code and turned it over to IT operations teams, which handled the process of deploying it onto production systems. As agile software development methodologies accelerated the pace of software code releases, these handoffs between organizations became unmanageable. To solve the problem, DevOps unified the development and deployment processes, along with the respective teams who handled the work.
The difficulty is that security does not disappear just because DevOps has sped up the process of writing and releasing code. If anything, the faster pace of development creates more security risk for applications. The chance that a vulnerability or malicious code will make it into production gets greater with DevOps.
DevSecOps offers a solution. It integrates security measures into each stage of the DevOps software development lifecycle (SDLC)—making security part of the continuous integration/continuous delivery (CI/CD) pipeline. Working with DevSecOps, developers, QA team members, and IT operations staff can attend to security issues as they arise. This is an improvement over the previous practice of introducing security steps late in the SDLC.
To understand how DevSecOps work, it’s first necessary to grasp how the DevOps workflow operates. There are of course many ways to implement DevOps. It’s an approach to software development, not a standard or a product. Indeed, DevOps is often depicted as an infinite loop that incorporates a wide variety of tools and practices. However, most DevOps teams use a five-stage CI/CD pipeline approach, into which DevSecOps embeds security:
It’s not entirely accurate to say that DevSecOps is simply DevOps with security measures thrown in. A DevOps process, on its own, almost always contains some security steps. The issue is how and where they are placed in the DevOps workflow. If DevOps isolates security as a discrete step at the end of the development process, that is not DevSecOps. There is security, for sure, but it’s not an optimal situation.
The implication of DevSecOps is that it’s DevOps, with security added as an integrated, collaborative part of the entire workflow. Security exists at each stage in the SDLC. It’s not, to borrow a phrase from the old days of coding, “thrown over the wall.” It’s important to note, however, that DevSecOps also implies the use of special tools and automation.
DevSecOps delivers two interrelated benefits: It speeds up the development of secure software. And, the software itself is more secure than it would have been under traditional development workflows. On the first point, security almost always slows down the cycle of developing, testing, and releasing software. If security steps come later in the cycle, the slowdown is all the more pronounced. In the worst case, if security teams detect vulnerabilities or the presence of malicious code after deployment to production, that results in a long, costly, and potentially public remediation process.
Fixing security problems in software was also traditionally a point of friction between developers and security teams. Developers might have an “it’s not my job” attitude about security and resent the intrusion and task-switching involved in rewriting insecure code. This dynamic, coupled with security’s tendency to slow things down, often led to security being de-emphasized or ignored outright—a move that negatively affected security posture.
DevSecOps reduces the likelihood of this outcome. With the ability to streamline and automate security in the DevOps CI/CD workflow, DevSecOps makes it possible to execute more security tests and controls on software before it reaches production. The resulting software should be more secure than code produced in the traditional way. In production, DevSecOps enables more rapid patching of vulnerabilities. This will occur if the DevSecOps workflow includes vulnerability scanning, including the ability to identify and patch common vulnerabilities and exposures (CVEs).
DevSecOps matters today because of a dangerous confluence of trends in technology. As software development and releasing speed up, the cyber threat environment grows more serious. More code is exposed to ever-graver threats. It’s not a good combination for today’s businesses, many of which depend on software for strategic differentiation and their overall business models. They cannot accept high levels of risk exposure. DevSecOps is a necessity in this context.
Security has always been important for organizations that create software. The need for security is only getting more intense, however, as malicious actors grow in sophistication. At the same time, software makers face pressure to release code at a faster pace than ever before. This requirement is potentially at odds with security, but DevSecOps offers a way forward. With DevSecOps, software makers can execute a rapid SDLC while maintaining a strong security posture.
Experience the speed, scale, and security that only Noname can provide. You’ll never look at APIs the same way again.