Security has been a friction point when discussing DevOps. This stems from the assumption that DevOps teams move too fast to handle security concerns. This makes sense if Information Security (InfoSec) is separate from the DevOps value stream, or if development velocity exceeds the bandwidth for existing manual InfoSec processes. However, DevSecOps is a methodology that offers a different take by thinking about application and infrastructure security from the very beginning.
In this article, we’ll look at how teams can secure their DevOps environments with the DevSecOps methodology and provide training materials that will help you secure your applications and environments. If you aren’t already familiar with DevOps, AGILE, and continuous delivery/continuous integration, the Cloud Academy Playbook provides an ideal start point for any team looking to quickly absorb and get started using the fundamental practices.
DevSecOps increases system security in the same way it increases quality. Simply put, it’s wrong to assume that high velocity means less stability or security. DevSecOps mandates automation. That allows teams to automate quality control measures, such as replacing manual testing with automated testing. The same thinking applies to replacing manual InfoSec processes with more scaleable and maintainable automated processes. Automating this work replaces the bottleneck (the source of the incorrect assumption) on InfoSec team members with a system of shared responsibility and enforcement.
Additionally, DevSecOps requires continuous delivery. Continuous delivery moves organizations from manual processes to automated deployment pipelines. That required a perspective shift in the day-to-day implementation thinking. Security is no different.
Shift left with automation
Automation changes the relationship between developers and InfoSec. Previously, InfoSec tests were performed manually at the end of the process. DevSecOps shifts those checks to earlier in the process and moves from individual to shared responsibility. Adopting automation enables teams to add more checks for run-time security concerns and downstream