What is DevSecOps?

DevSecOps represents a natural and necessary evolution in the way development organizations approach security. In the past, security was 'tacked on' to software at the end of the development cycle, almost as an afterthought. A separate security team applied these security measures and then a separate quality assurance (QA) team tested these measures.

This ability to handle security issues was manageable when software updates were released just once or twice a year. But as software developers adopted Agile and DevOps practices, aiming to reduce software development cycles to weeks or even days, the traditional 'tacked-on' approach to security created an unacceptable bottleneck.

DevSecOps integrates application and infrastructure security seamlessly into Agile and DevOps processes and tools. It addresses security issues as they emerge, when they're easier, faster, and less expensive to fix, and before deployment into production.

Additionally, DevSecOps makes application and infrastructure security a shared responsibility of development, security and IT operations teams, rather than the sole responsibility of a security silo. It enables “software, safer, sooner”—the DevSecOps motto–by automating the delivery of secure software without slowing the software development cycle.

The two main benefits of DevSecOps are speed and security. Therefore, development teams deliver better, more-secure code faster and cheaper.

“The purpose and intent of DevSecOps is to build on the mindset that everyone is responsible for security with the goal of safely distributing security decisions at speed and scale to those who hold the highest level of context without sacrificing the safety required,” describes Shannon Lietz, co-author of the “DevSecOps Manifesto.”

When software is developed in a non-DevSecOps environment, security problems can lead to huge time delays. Fixing the code and security issues can be time-consuming and expensive. The rapid, secure delivery of DevSecOps saves time and reduces costs by minimizing the need to repeat a process to address security issues after the fact.

This process becomes more efficient and cost-effective since integrated security cuts out duplicative reviews and unnecessary rebuilds, resulting in more secure code.

DevSecOps introduces cybersecurity processes from the beginning of the development cycle. Throughout the development cycle, the code is reviewed, audited, scanned and tested for security issues. These issues are addressed as soon as they are identified. Security problems are fixed before additional dependencies are introduced. Security issues become less expensive to fix when protective technology is identified and implemented early in the cycle.

Additionally, better collaboration between development, security and operations teams improves an organization’s response to incidences and problems when they occur. DevSecOps practices reduce the time to patch vulnerabilities and free up security teams to focus on higher value work. These practices also ensure and simplify compliance, saving application development projects from having to be retrofitted for security.

A key benefit of DevSecOps is how quickly it manages newly identified security vulnerabilities. As DevSecOps integrates vulnerability scanning and patching into the release cycle, the ability to identify and patch common vulnerabilities and exposures (CVE) is diminished. This capability limits the window that a threat actor has to take advantage of vulnerabilities in public-facing production systems.

Cybersecurity testing can be integrated into an automated test suite for operations teams if an organization uses a continuous integration/continuous delivery pipeline to ship their software.

Automation of security checks depends strongly on the project and organizational goals. Automated testing can ensure that incorporated software dependencies are at appropriate patch levels, and confirm that software passes security unit testing. Plus, it can test and secure code with static and dynamic analysis before the final update is promoted to production.

As organizations mature, their security postures mature. DevSecOps lends itself to repeatable and adaptive processes. DevSecOps ensures that security is applied consistently across the environment, as the environment changes and adapts to new requirements. A mature implementation of DevSecOps will have a solid automation, configuration management, orchestration, containers, immutable infrastructure and even serverless compute environments.

DevSecOps should be the natural incorporation of security controls into your development, delivery and operational processes.

'Shift left' is a DevSecOps mantra: It encourages software engineers to move security from the right (end) to the left (beginning) of the DevOps (delivery) process. In a DevSecOps environment, security is an integral part of the development process from the beginning.

An organization that uses DevSecOps brings in their cybersecurity architects and engineers as part of the development team. Their job is to ensure every component, and every configuration item in the stack is patched, configured securely, and documented.

Shifting left allows the DevSecOps team to identify security risks and exposures early and ensures that these security threats are addressed immediately. Not only is the development team thinking about building the product efficiently, but they are also implementing security as they build it.

Security is a combination of engineering and compliance. Organizations should form an alliance between the development engineers, operations teams and compliance teams to ensure that everyone in the organization understands the company's security posture and follows the same standards.

Everyone involved with the delivery process should be familiar with the basic principles of application security. They should understand the Open Web Application Security Project (OWASP) top 10, application security testing and other security engineering practices. Developers need to understand threat models, compliance checks and have a working knowledge of how to measure risks, exposure, and implement security controls

Good leadership fosters a good culture that promotes change within the organization. It is important and essential in DevSecOps to communicate the responsibilities of security of processes and product ownership. Only then can developers and engineers become process owners and take responsibility for their work.

DevSecOps operations teams should create a system that works for them, using the technologies and protocols that fit their team and the current project. By allowing the team to create the workflow environment that fits their needs, they become invested stakeholders in the outcome of the project.

Implementing traceability, auditability and visibility in a DevSecOps process leads to deeper insight and a more secure environment:

• Traceability allows you to track configuration items across the development cycle to where requirements are implemented in the code. Traceability can play a crucial part in your organization’s control framework. This process helps to achieve compliance, reduce bugs, ensure secure code in application development, and help code maintainability.
  
  
• Auditability is important for ensuring compliance with security controls. Technical, procedural and administrative security controls need to be auditable, well-documented, and adhered to by all team members.
  
  
• Visibility is a good management practice in general, but very important for a DevSecOps environment. An organization should have a solid monitoring system in place to measure the heartbeat of the operation and send alerts. The system should be able to increase awareness of changes and cyberattacks as they occur. The system should provide accountability during the whole project lifecycle.