Cloud Computing Outlook Weekly Brief
Be first to read the latest tech news, Industry Leader's Insights, and CIO interviews of medium and large enterprises exclusively from Cloud Computing Outlook
Tristan Boutros, CTO, ASCAPEnterprise computing is going through a major transformation of infrastructure and technology delivery models, one that is at least as disruptive as the move from mainframe computing and sequential management to web-based architectures and iterative software development. Whether your technology organization is running applications that share content to millions of users or is supporting internal operations, the introduction of cloud computing as the go-to solution for running critical workloads has provided companies with rapid access to flexible and low-cost IT resources that were previously unavailable. This dramatic shift toward dynamic provisioning, serverless-computing and pay-as-you-go cost models has been driven largely by the benefits of speed, agility, and reduced cost through the use of cloud products and services using DevOps practices.
"The most effective DevSecOps programs start at the earliest points in the development process and follow the workload throughout its life cycle"
The alignment of development and operations teams through DevOps has made it possible to build customized software and business applications far more quickly than ever before. Unfortunately, security teams continue to be left out of the DevOps conversation as they are often seen as roadblocks to rapid development and production code pushes. While DevOps provides strategic benefits like breaking down the traditional silos between Developers, Testers, and various operations roles, many organizations fail to integrate their security programs into their development efforts, leaving them open to vulnerabilities and ongoing reactive security and risk processes.
Fortunately, DevSecOps is a growing movement to incorporate Security into DevOps practices to ensure loopholes and weaknesses are exposed early on through continuous monitoring, assessment, and analysis, so that remediation can be implemented far earlier than traditional DevOps efforts.
Most organizations today have heard of DevOps and many have begun to adopt its practices as a key enabler of software delivery. It is a combination of processes, cultural philosophies, and development tools that emphasize intense collaboration and communication between software engineering and infrastructure teams while automating an organization’s ability to deliver applications and services rapidly and more reliably. This includes several focal areas such as continuous integration, test driven development, automated provisioning, and continuous monitoring.
DevSecOps is an extension of this mindset and strives to automate core security tasks by embedding security controls and processes into the DevOps work flow, introducing security principles early in the development cycle and embedding security knowledge and practices directly into DevOps teams so that they can secure the pipelines they design and automate. Equally, DevSecOps strives to embed application development knowledge and automated tools and processes into security teams so that they can provide security at scale in the cloud by giving practitioners the ability to monitor and script security controls at a much larger and more dynamic scale than traditional data centers.
Embarking on a full-scale cloud transformation means changing the way processes and technology interact to accelerate the ability to respond to the market and deliver exceptional experiences to your customers. As such, security starts in development, and the most effective DevSecOps programs start at the earliest points in the development process and follow the workload throughout its life cycle.
A shift from DevOps to DevSecOps can transform the way an organization handles its development pipeline and provides a number of benefits between Development, Security, and Operations teams such as promoting collaboration, identifying vulnerabilities, and diminishing security threats earlier in the development process. Other benefits include:
Security can be integrated from the early stages of your DevOps processes, and not just as an afterthought at the conclusion of the software pipeline. It becomes a quality requirement, similar to other tests run as part of your software delivery process. Just as Continuous Integration accelerates testing and feedback loops to discover bugs earlier and improve software quality, DevOps processes can incorporate automated security and compliance checks.
As more and more of these tests are automated, there is less risk of introducing security flaws due to human error and tests become more efficient enabling more overall coverage, and consistent and predictable processes across teams. Therefore, as things do break, it’s easier to pinpoint and fix them in the development process.
By using tools that are shared across various technology teams and functions, especially automation tools, organizations gain visibility and control over the entire SDLC, creating a closed-loop process for testing, reporting, and resolving security concerns.
Many standard security processes get automated in DevSecOps. Vulnerability assessments, event monitoring, code security, account management and other tasks require less hands-on time. Security professionals can then focus on areas that need their dedicated focus, or shift towards more strategic risk and threat remediation.
Moving from DevOps to DevSecOps is a difficult process, but is one that can be executed in a few deliberate, but managed phases. Here are three primary steps that can help guide organizations along the DevSecOps journey:
Organizations can’t make changes before they understand what they’re currently working with. By performing threat modeling and risk assessments, security teams will better understand the types of assets they are protecting as well as their sensitivity levels, how they will be managed and monitored in the cloud, and what the most likely threats are for those assets. They will also have a better understanding of what controls are currently in place, and which ones will need modification when moving to the cloud and which are truly the highest priority to implement.
The next step is to discover the best ways to integrate security measures into the development process. Close examination of the development workflow and identifying the best ways to bring security practices and automation into the process ensures that any disruptions remain minimal. During this step, DevOps teams may need to rework some of their workflows, but the security team should strive to make their testing requirements and metrics work within the current framework.
Building a culture of continuous security and a formal DevSecOps program requires a commitment from development, security, and operations teams to work side by side with one another to embed security processes and controls into the entire DevOps workflow. The last step involves integrating security operations with the new DevSecOps approach. Monitoring and rapidly responding to any security concerns during development ensuring the same tight integration as other measures is key to a successful rollout.
DevSecOps is a logical extension of DevOps and one that can bring the entire development lifecycle together for organizations. Tightly integrating development and security provides the protection required to create secure applications, without running into roadblocks in workflow. As you get started with your journey towards DevSecOps please keep the steps outlined in this article in mind to help build a positive and productive feedback loop with stakeholders and you’ll enjoy more teamwork and security in no time.
