Secure DevOps - (DevSecOps)
Amit Kumar Tiwari
Head of Salesforce Architecture & Practice | Delivering largest Salesforce Implementation for Wealth | Architect Leader | FinTech | Design Thinker | DevSecOps Advocate | Salesforce SME | AgilePM | Open-Source Evangelist
Despite the best efforts by software companies, security breaches still occur. Since 2000, more than 3.5 billion people saw their personal data stolen. Part of the problem is that as software applications grow in codebase scale and complexity, so do the surface areas for security vulnerabilities and exploits.
When it comes to security for DevOps workflows, the DevSecOps is a practice.
DevSecOps (Development, Security, and Operations) – represents a natural
and necessary evolution (a change in Culture) in the way organizations
approach to the – 'Platform Design, Automation Process, and Tools' that
integrates “Security (Application & Infrastructure)” as a shared
responsibility throughout the entire development lifecycle.
Before moving more deeper in the DevSecOps, it’s important to understand the context:
Nowadays most of the organisations have their focus predominantly on the application development, this meant security is deemed to be less important than the other stages. Many organisations (within their adopted release train) are executing the ‘security checks’ at the end of the development cycle (almost as an afterthought) by a separate security team.
(This should manageable if software updates were released just once or twice a year. But as we are talking about Agile and DevOps?practices, aiming to reduce software development?cycles to weeks or even days; the traditional 'tacked-on' approach to security creates an unacceptable bottleneck for us)
By the time security team performed checks, the products would have passed through most of the other stages and been almost fully developed. So, discovering a security threat at such a late stage meant reworking countless lines of code, an agonizingly laborious and time-consuming task. Not surprisingly, patching became the preferred fix. Thus, security was viewed as merely a gut feeling that nothing would go wrong, rather than investing the necessary time and money to bolster it concretely in the pipeline.
The key is enabling development of secure software at the speed of Agile
and DevOps.
Here, the DevSecOps is a go-to practice – which pushes security as a shared responsibility of the Development, Test, Security, and IT?Operations teams, rather than the sole responsibility of a security silo. That should address security issues as they emerge, when they're easier, faster, and less expensive to fix (rather than handling repercussions of making a fix postproduction). And to handle all this without slowing down the software development?cycle – we need to work to bridge the gap exists between development and security teams – to the point where many of the security processes are automated to empower the development to avoid the mistakes up front (by the development team itself).
领英推荐
The idea is embracing the “shifting security left” and “shifting developers right” mentality, which moves security testing toward developers, enabling them to fix security issues in their code in near real time rather than 'bolting on security' at the end of the SDLC.
Modern Agile / DevOps software delivery is outpacing a compliance-driven, late lifecycle security process. While to stay ahead of cyberattacks – we need to keep regulations and security top of mind, maintaining speed and agility, and we need to work on it before it gets created a – “Security-Debt”.
DevSecOps helps to deal with the challenge to – Match Agile Delivery. Here are the keys ways –
It’s important to understand DevSecOps evolved to address the need to build in security continuously across the SDLC so that teams could deliver secure applications with DevOps speed and quality; and for that everyone involved in the SDLC has a role-to-play in building security into the DevOps Continuous Integration and Continuous Delivery (CI/CD) workflow.
In a nutshell – Security is “everyone’s responsibility” and implementing DevSecOps means creating a “Security as Code” culture.
Majorly DevSecOps can be get implemented on the following principles listed –
Once we have key activities in-place against the principles listed – following would be our key benefits from the (DevSecOps) model –
And this will also help to integrate active security audits and security testing into agile development and DevOps workflows so that security is built into the product, rather than applied to a finished product.
That's all for now! Hope this blog will help to all the teams who are thinking about – 'the Security within DevOps'. All the best for your DevSecOps journey!