DevSecOps: Automating Security at the Core of Application Delivery

Digital technologies are disrupting business models, revolutionizing business processes, and introducing new ways of working across industries – not just in retail or banking. The new breed of employees, comprising a growing number of millennials, uses multiple devices to access information – including corporate communications and workflows.

28-May-2018

It is predicted that by 2020, more than 20 billion devices will be connected to the internet. What does this means for enterprises?  One weak link in the security chain can allow cyber adversaries to exploit critical data.

 

As organizations increasingly shift to DevOps and agile delivery models to innovate faster, the risk of cyber security quickly amplifies. Traditional security practices can result in poorly designed applications and introduce vulnerabilities in the DevOps environment, driving up costs and putting organizations at risk. According to Computer Weekly, in 2017, 65% of organizations experienced malware-related breaches and 55% phishing-initiated breaches. How can organizations tighten security while boosting innovation using DevOps?

 

DecSecOps is the answer to building resilient software resistant to cyberattacks. It involves creating a ‘Security as Code’ culture with ongoing, flexible collaboration between release engineers and security teams. How does it work? DevSecOps identifies security challenges early in the development process by incorporating - logging and event monitoring, configuration and patch management, user and privilege management, and vulnerability assessment - into DevOps processes. This keeps business ahead of the curve by helping them perform threat modelling exercises to gauge vulnerability levels of their assets. The result: ability to proactively curb security incidents rather than react to the attacks as in the case of Equifax - where data of 143 million customers was stolen.

 

Here are three ways in which DevSecOps helps companies proactively implement security at the speed of business:

 

Mitigate downtime and attacks by reducing the chances of misadministration:

By automating core security functions such as identity and access management (IAM), firewalling, and vulnerability scanning, DevSecOps reduces the need for manually configuring security consoles. Development teams can squeeze the application testing cycle by automating every security process and leverage new technologies such as interactive application security testing to automate the application vulnerability resolution process. This empowers security teams to determine their own processes and tools for distributed decision-making that promotes responsible innovation.

Fast-track speed of recovery in case of breach:

Recovering fast in case of a breach is critical to minimizing losses and ensuring business continuity. By leveraging standardized templates and cattle methodologies, DevSecOps expedites speed of recovery in the event of a breach. The practices enable the development of immutable infrastructure, which help tear down the compromised node, recognize application attack pattern, and build a new node with fresh credentials. In addition, DevSecOps environment enables proactive and pre-emptive threat hunting, ensuring continuous threat detection and consistent and measurable response to incidents.

Foster a culture of openness and transparency:

DevSecOps is a healthy model that makes everyone responsible for security.  Leveraging tools and techniques that enable security related decision making, different teams work together to leverage secure design patterns and automated security review of code. DevSecOps fosters a culture of collaboration, which means everyone is aware of everything in the DevOps cycle, enabling continuous monitoring and deployment of security initiatives.

 

DevSecOps champions the importance of pro-active customer-focused security that enables continuous planning and agile approach to delivery. Companies that fail to take DevSecOps approach are at risk of slower throughput and higher vulnerability. According to Gartner, DevSecOps will be embedded into 80% of rapid development teams by 2021. Integrating security practices into DevOps requires security and risk management leaders to take a seamless and transparent approach to the development process. Changing employee mindset through proper training and implementing processes to facilitate cooperation are key to the success of DevSecOps.