In software development, delivering a product that just works isn’t enough. People are trusting companies with their trade secrets and their personal information. That level of trust has to be met with the highest respect and with the lofty goal of providing the safest software that businesses can engineer. That’s why DevSecOps was born.
DevSecOps is an evolution of DevOps that merges the open communication channels and automation of DevOps methodologies with a focus on cybersecurity. It’s like building a house to make it impenetrable.
Cybersecurity is a growing concern, but we can no longer have the luxury of delaying our projects to meet our security goals. As such, we are in dire need of methodologies that help us keep our optimal pace while providing a security-conscious product. That’s what DevSecOps seeks to accomplish.
But What is DevOps?
DevOps is an abbreviation of the terms development and operations. It’s a concept used to represent a collaborative or shared approach to the tasks performed by a company’s application development and IT operations teams.
There are dozens of approaches to DevOps but, in its broadest meaning, DevOps is a philosophy that promotes better communication and collaboration between traditionally siloed teams.
Development teams and operation teams both share the same goal (deliver the best product possible within a time frame), but the way how they approach that goal varies greatly and can be at odds with one another.
Developers engineer solutions. They create, innovate and change the product as new features are introduced to the project. A development environment is unstable, always in flux. And that’s a good thing, as it’s a state that naturally breeds creativity
Production environments are a stark contrast. In production your product is live, and it’s being delivered to the end user. As such, stability and reliability are key. Operations are in charge of making sure that things run smoothly.
In siloed environments, the developer team and the operations team rarely communicate, if at all. Developers deliver their code and it can take days or even weeks for operations to assess if it’s compatible with the production environment.
Disconnection between teams can lead to delays, bugs, and other issues. This is all the more depressing once you realize that it’s actually a fairly common problem in software development.
A quick example: A friend of mine is working as a developer in a private firm. He was implementing a few changes to their contract software. Since they were migrating their version control, he chose to send the code by email.
Three days later, operations contacted him and let him know that they didn’t receive the code. Turns out that operations had implemented a new security policy where emails with code were automatically deleted.
No one was at fault, as my friend did what he always did, and operations did what they always did. The problem was the lack of communication between both teams.
DevOps culture enforces a set of good practices that facilitates communication between teams. Delivering software through a container (like Docker) is an excellent example. With a container you create the required environment before deploying an app, saving time and minimizing the risk of incompatibility.
Security Risks in A Serverless World
In the last few years, we’ve seen a systematic increase in cyberattacks, with alarming peaks in 2020 and 2021. In the same way, cloud computing, AI, and other forms of technology are evolving with each passing day, so too are cybercriminals and their techniques.
Remote work, serverless solutions, and other technologies that rely on connectivity come with a caveat. Anything that’s connected can be accessed under the right circumstances, and those connections can be exploited. It’s the nature of the beast.
Taking your critical data offline is hardly a solution. The benefits of being able to access your information from anywhere far outstrip the risks. In a world that demands faster deliveries and excellence, every tool that speeds up the development process helps. You can’t be competitive in the 21st century without connectivity.
In this context, security teams are faced with greater demands. In contrast to a pre-cloud era, technology is moving at a faster pace, and security experts have to constantly be on the lookout for potential vulnerabilities, both in the code and in the process.
It’s not uncommon to find that security teams are understaffed. Security experts have a set of very specific skills, and the demand for this kind of talent far outstrips the market’s availability.
The combination of all these factors exposes modern businesses to attacks, which is why companies need to turn to alternative solutions to meet these challenges.
Adding Security to DevOps
If a dedicated fully-staffed security team isn’t a solution, then what can you do to protect your projects? You can adopt a set of practices that guarantees security throughout the development process.
Much like how DevOps was originally a set of loose practices shared by highly skilled senior engineers which were adopted into a methodology, DevSecOps is a set of proven security practices that helps teams develop safer software.
The DevSecOps model seeks to integrate security objectives as early as possible in the software lifecycle. You take the cooperative framework of DevOps and put security front and center, turning it into a shared responsibility for all teams in the project.
DevSecOps means thinking about application and infrastructure security from the start. But it also means automating security gates to prevent security engineering from slowing down the DevOps workflow.
In a DevSecOps environment security shouldn’t be handled by separate teams. Instead, developers and operations, with the help of security experts, each do their part to meet their security goals, finding gaps and exploits to be fixed and patched.
Obviously, a huge part of the success of DevSecOps relies on having the right tools for the job. Using safe libraries, choosing a secure IDE (integrated development environment), and creating safe pipelines.
But tools aren’t enough. To successfully create a DevSecsOp environment you need to induce cultural changes in your team:
- All members should have a shared understanding of what security is and why it’s important.
- All teams should learn and understand good security practices.
- Security should be a KPI used to assess the team’s output.
- Security tests have to be implemented throughout the process.
The integration between development, operations, and security needs to happen at the management level as well. When the push towards security isn’t fully aligned and integrated into all levels of the process, you end up with management-level clashes. For DevSecOps to work, everyone has to be on the same page.
Why are we so interested in DevSecOps? Simply put, because the market is becoming more competitive by the minute, and the usual quality versus speed trade-off no longer holds true. We need better methodologies that can provide top-tier deliveries in record time. And that’s precisely what DevSecOps offers.
If you enjoyed this, be sure to check out our other DevOps articles.
