1CHAPTER

What Is DevSecOps?

DevSecOps integrates security practices into DevOps processes.

It is based on a “security-as-a-code” culture that fosters ongoing collaboration and communication between software developers and security teams.

In the past, software developers focused exclusively on DevOps, while security teams prioritized vulnerability detection, monitoring and management. However, this two-tiered approach has quickly become outdated.

Today’s organizations prioritize speed, agility and flexibility. This is reflected in the “continuous delivery” (CD) approach to software development.

CD creates software in short cycles. It requires DevOps teams to automatically build, test and prepare code. That way, DevOps teams will always have a deployment-ready build at their disposal.

DevSecOps takes CD one step further. It bridges the gap between IT and security. DevSecOps helps organizations eliminate departmental silos and use lean, agile security testing in software iterations – all without slowing down or interrupting the software delivery cycle.

2 CHAPTER

Why Is DevSecOps Necessary?

The global IT landscape has changed dramatically over the years.

Today’s organizations require agile cloud computing platforms, flexible storage and data solutions and other state-of-the-art technologies.

DevOps was once sufficient for software developers. But DevOps failed to account for security and compliance relative to software development.

Also, today’s hackers use advanced exploits to launch cyber attacks that can cripple an organization and put its employees and customers in danger. If software developers cannot identify cyber exploits, they risk releasing products that contain malware, viruses and other security flaws.

DevSecOps encompasses both DevOps and security. It promotes the integration of security into software development, and creates partnerships between software developers and security teams to drive meaningful business improvements.

With a DevSecOps approach, software developers and security teams work together to quickly identify and resolve security vulnerabilities before they can affect an organization’s key stakeholders. This helps an organization consistently deliver fast, agile and secure software iterations.

3 CHAPTER

DevSecOps Key Principles

DevSecOps represents a combination of security practices, tools and knowledge related to software development, testing and delivery.

It is founded on several key principles, including:

• Security: Cyber attacks are problematic for organizations worldwide, and software developers are frequently tasked with integrating authentication, authorization and encryption capabilities into their applications.  But software development and security are inherently different, and bridging the gap between the two remains a major issue for many organizations. DevSecOps promotes secure coding and risk-based security testing. It helps software developers incorporate security into their everyday processes, thereby eliminating the gap between software development and security.
• Continuous Learning: To prevent security vulnerabilities from affecting software production, software developers and security teams must identify the root causes of these issues. They also must learn from their mistakes to prevent future issues during the software delivery cycle.
•  Collaboration: Security teams should be involved with the day-to-day activities of software developers. If security teams and software developers maintain ongoing communication, they can plan, implement and test software appropriately. Together, security teams and software developers can collaborate throughout the software delivery cycle, ensuring that an organization produces reliable, secure software that meets or exceeds end user requirements.
•  Threat Intelligence: The cyber threat landscape is growing, and new cyber threats are discovered every day. Sharing threat intelligence gives software developers and security teams the ability to understand evolving cyber threats. These groups then can use threat intelligence to brainstorm solutions to address security dangers.
•  Compliance: Corporate security policies are prevalent, and software developers are responsible for understanding compliance operations to help end users manage security baselines. With DevSecOps, software developers can integrate real-time security alerts and notifications into their applications, so end users are updated any time compliance policy configurations change from a known approved state.
•  Speed: Organizations are often forced to choose between fast and secure software deliver. DevSecOps offers organizations the ability to deliver software quickly and securely. It allows software developers to build security into each stage of their development, testing and launch efforts. Plus, software developers can use automation tools and technologies to accelerate software delivery.

It may take many weeks or months for an organization to build a successful culture around DevSecOps. Fortunately, with the right people, processes and technologies, an organization can empower its software developers and security teams to take a ground-up approach to building a successful DevSecOps-centric culture.

4 CHAPTER

A Real World Example of DevSecOps

To better understand DevSecOps, let’s consider a real world example that illustrates how it can be used to help an organization speed up and improve its software delivery cycle.

In a DevOps environment that emphasizes CD, software developers may work diligently to produce software. These developers likely run automated testing for user interface (UI), load, integration and other software. Plus, they may automate the creation and replication of multiple testing environments.

Now, think about what may happen if the aforementioned software developers fail to identify security vulnerabilities.

In this scenario, security vulnerabilities may go undetected for an extended period of time. These vulnerabilities may negatively affect the end user experience, too. And once the security vulnerabilities are discovered, software developers must act quickly to identify and address these issues. Otherwise, these security vulnerabilities may continue to escalate, causing long-lasting problems for an organization, its software developers and its end users.

With a DevSecOps approach in place, the aforementioned situation can be addressed before it happens.

DevSecOps incorporates security testing into software iterations. Thus, each time that software developers evaluate a release, they can identify and address security vulnerabilities.

5 CHAPTER

Benefits of DevSecOps

There are many reasons why organizations choose DevSecOps for software delivery, such as:

• Cost Savings:DevSecOps helps software developers quickly detect and address security vulnerabilities throughout the software delivery cycle. It ensures software developers can limit the risk that costly, time-intensive security vulnerabilities will plague an organization and its end users.
•  Fast Recovery: Software developers can establish templates to speed up response and recovery and limit downtime, outages and other incidents.
•  Enhanced Threat Hunting: Even a single security flaw can put an organization, its brand reputation and its revenue in danger. Thanks to DevSecOps, software developers are better equipped than ever to identify security threats before they cause long-term damage.
•  Improved Overall Security: DevSecOps helps an organization reduce security vulnerabilities and bolster its security auditing, monitoring and notification efforts.
•  Transparent Culture: DevSecOps encourages software developers and security teams to work hand-in-hand, resulting in a culture of transparence and openness that leads to increased productivity and efficiency across an organization.
•  Constant Improvement: DevSecOps promotes continuous measurement. As an organization monitors its software successes and failures, it can determine the best steps to avoid problems during the software delivery cycle. Also, an organization can use metrics to find ways to speed up and improve its software delivery efforts and differentiate itself from the competition.

DevSecOps is quickly becoming a top priority for global organizations – because the sooner an organization prioritizes DevSecOps, the sooner it can integrate DevSecOps into its everyday operations.

6  CHAPTER

How Can DevSecOps Helps Organizations Address Business Challenges?

The business world moves quickly, and organizations that fail to keep pace risk falling behind the competition without a clear path to recovery.

Now, DevSecOps helps organizations address a variety of challenges, including:

Demand for Flexible, Efficient Infrastructure: Managed containers and serverless infrastructure are becoming commonplace for organizations that prioritize flexible, efficient IT environments. Yet organizations sometimes deploy managed containers and serverless infrastructure without thinking about security. Conversely, integrating security into DevOps processes helps organizations avoid system compromises.

 Departmental Silos: Security teams often focus solely on protecting an organization against malware, ransomware and other security vulnerabilities. Comparatively, software developers rarely understand the ins and outs of secure coding, and operations teams frequently lack sufficient security training. DevSecOps helps eliminate departmental silos that put an organization at risk of data breaches and other security compromises. Because DevSecOps integrates security into all areas of software development, security teams, software developers and other key stakeholders can work together to quickly and efficiently provide secure, reliable and high-performing deliverables.

 Operational Complexity: Software developers and security teams have different roles, and they often use different terminology, processes and systems as well. DevSecOps requires software developers and security teams to share responsibilities and use common workflows to drive continuous improvement and innovation. It also empowers software developers and security teams to understand each group’s respective challenges and work together to overcome operational issues and develop and deploy code securely.

 Human Error: Even a single mistake can have far-flung ramifications for an organization, particularly when it comes to software development and security. DevSecOps encourages automation, as it enables software developers and security teams to embrace tools and technologies that allow them to streamline everyday processes. With automation tools and technologies in place, software developers and security teams can reduce or eliminate human errors.

 Lack of Accountability and Measurement: Tracking code changes and measuring software delivery success is often difficult. DevSecOps encourages an organization to foster accountability and measurement. Software developers and security teams can establish benchmarks to track their day-to-day efforts, as well as monitor group performance. They can also create daily, weekly, monthly and annual reports to analyze their progress and determine how to achieve the optimal results.

 DevSecOps is a key differentiator for an organization. It encourages software developers and security teams to focus on strategic tasks and accomplish organizational goals faster and more efficiently. Perhaps best of all, it drives the development of a culture built on constant learning, improvement and innovation.

7 CHAPTER

DevSecOps Best Practices

Ready to implement DevSecOps? Here are six DevSecOps best practices to help your organization successfully integrate DevSecOps into its daily operations:

• Prioritize automation. Embed security controls and tests into every stage of the software development lifecycle. Over time, an organization can automate its security analysis and testing as well. Tools are available to help an organization automate security analysis and testing from source-code analysis to post-software deployment. Keep in mind, however, that not all security analysis and testing automation tools are created equal. An organization should evaluate security analysis and testing automation tools to find technologies that are easy to use and deliver meaningful results.
•  Analyze code dependencies. Software developers sometimes fail to analyze an application’s code dependencies. This mistake could create security flaws within an organization. 
•  For example, a recent survey of 1,000 commercial applications indicated that 96% of organizations rely on open-source software in applications. Among these apps, 60% contained security vulnerabilities. If an organization provides its software developers with tools to automate the management of open-source and third-party software components, it could help these developers identify and address security vulnerabilities faster than ever.
•  Start small. DevSecOps success usually won’t happen overnight. Instead, a slow, steady approach to DevSecOps is ideal. For instance, adding one or two security checks to a software delivery cycle is a great way to help developers get acclimated to security analysis. As software developers incorporate security into their regular workflows, these developers can then scale their security efforts accordingly.
•  Understand your DevSecOps requirements. In some instances, software developers and security teams may be overwhelmed by the sheer volume of DevSecOps tools and technologies available. To differentiate must-have DevSecOps tools and technologies from all others, focus on products that promote speed and accuracy. For instance, security tools should work quickly, but they should not result in false-positive alerts that can bog down software developers and security teams. On the other hand, with security tools that help software developers and security teams immediately diagnose risks, an organization likely won’t have to worry about significant interruption of software delivery cycles.
•  Use threat modeling. Although threat modeling cannot be automated, it is a crucial part of DevSecOps. Threat models can help software developers and security teams identify risks before a project gets underway. Plus, threat models empower an organization to understand its threats and determine how to eliminate these issues as quickly as possible. 
•  Offer training and support. Provide DevSecOps training and teach software developers how to use DevSecOps tools properly. Also, cross-train security teams and software developers. This ensures both groups understand exactly what it takes to make DevSecOps a part of their everyday efforts.

 DevSecOps is a work in progress, and new DevSecOps tools and technologies are in development. An organization that maintains flexibility can adapt to DevSecOps and capitalize on it both now and in the future.

8 CHAPTER

DevSecOps FAQ

What is the goal of DevSecOps? 

 DevSecOps is designed to make security a part of an organization’s software development workflow. With this approach, software developers and security teams work together to implement security controls into software. Then, an organization can quickly and consistently deliver secure code releases.

 Is there a difference between DevOps and DevSecOps?

 Yes. DevOps is designed to promote CD, and as such, has become increasingly important to organizations that want to streamline software development. Meanwhile, DevSecOps adds security to the DevOps formula. DevSecOps bridges the gap between security teams and software developers and integrates security into all aspects of software development. By doing so, DevSecOps ensures an organization can build, test and deploy software that is secure, effective and proven to perform.

 What are the barriers to DevSecOps adoption?

 Cultural and process issues are the two leading barriers to DevSecOps adoption. In a recent survey of IT and business leaders, just 24% of respondents said their organization’s culture and practices support collaboration between development, operations and security teams. Furthermore, the survey indicated only 24% of senior managers believed security should not be sacrificed in favor of time-to-market for software development and deployment.

Is DevSecOps a viable option for my organization?

 Absolutely. DevSecOps is a viable option for any organization, in any industry, at any time. In fact, with DevSecOps, an organization could reduce its costs, speed up software delivery cycles and enjoy other immediate and long-lasting benefits.

How can my organization implement DevSecOps into its everyday operations?

 There is no one-size-fits-all solution to successfully implement DevSecOps into an organization’s everyday operations. Typically, an organization needs to start small and gradually foster a culture built on DevSecOps principles. This organization also needs to be ready to make adjustments to keep pace in a rapidly changing global marketplace. If an organization has the right people, processes and technologies in place to support DevSecOps, it can achieve its desired results.

9 CHAPTER

Conclusion

DevSecOps empowers an organization to take a proactive approach to security. It encourages software developers to integrate security into their day-to-day efforts. At the same time, security teams can work with software developers to help an organization identify and resolve security vulnerabilities before they get out of hand. 

Expect the demand for DevSecOps to increase in organizations of all sizes and across all industries. As more organizations search for ways to detect and correct security issues early in the software development process, the demand for tools to support DevSecOps will increase accordingly.

 An organization that implements DevSecOps tools today could reap the benefits of that investment for a lifetime. By providing software developers and security teams with user-friendly and effective DevSecOps tools, an organization fosters a culture of collaboration, communication, transparency and openness. As a result, this organization creates an environment where developers and security teams drive ongoing improvement.

Sources:

https://www.zdnet.com/article/devsecops-what-it-is-and-how-it-can-help-you-innovate-in-cybersecurity/

https://www.redhat.com/en/topics/devops/what-is-devsecops 

https://www.devseccon.com/wp-content/uploads/2017/07/DevSecOps-whitepaper.pdf 

https://sd-magazine.com/securite-numerique-cybersecurite/devsecops-business-benefits-and-best-practices 

https://techbeacon.com/devsecops-9-ways-devops-automation-bolster-security-compliance/

https://www.tripwire.com/state-of-security/featured/devsecops-the-marriage-of-secops-and-devops/ 

https://www.bmc.com/blogs/what-is-devsecops-devsecops-explained/ 

https://stackify.com/devsecops-automate-security-testing/ 

https://www.veracode.com/blog/security-news/ca-technologies-research-shows-barriers-and-benefits-devsecops/

https://blog.aspiresys.com/infrastructure-managed-services/devsecops-best-practices-and-business-benefits/ 

https://www.sumologic.com/devops/devsecops-rugged-devops/