Development speed is the resounding force driving today’s enterprise technology world. This can be accomplished through automation, utilizing an MSP, cross training, and more. Sometimes, though, increasing development speed comes at the expense of security.
There are so many terms floating around IT worlds today. Just as you start to figure out DevOps, DevSecOps or Secure DevOps jumps onto your radar. It’s certainly not a new term by today’s standard of “new,” but it doesn’t have the same notoriety that DevOps has. Even managed service providers have specific offerings for DevOps, with security being offered as a different service.
DevSecOps is as simple as it sounds, it is the conscious integration of security into the DevOps process. With the news earlier this year about Meltdown and Spectre, having the most efficient security processes is critical. The mindset of both DevOps and DevSecOps is essentially the same, increase collaboration and efficiency.
Will Security Slow Down Development?
A core objective in today’s computing world is to speed up the development pipeline to keep up with a more demanding marketplace. Theoretically, adding security would slow this process down. However, adding security testing into the development process creates a safer development pipeline. Thus, there will be more confidence in releasing a product. Development teams won’t have to scramble to make changes when the security team finds problems after a release is live.
It’s better to be proactive with any software release. Adding security into the pipeline, through automation or training, speeds up releases, as security won’t be tacked on at the end.
More Collaboration
IT culture is undergoing a rapid cultural change in the way that it operates. DevOps promotes integration and breaking down IT silos, and it has been relevant to success in many modern businesses. However, security teams tend to be left out of this integration.
Sometimes, the security team is coming in after the code is live and things are already out of control. For example, a development team might need to do some image processing from a library, but the library they chose is vulnerable. It would be much easier for the development and operations teams to work with the security team to catch issues like this as earlier in the pipeline. Collaboration is far more efficient than pointing fingers. Collaborating with security teams will allow both sides to have more empathy for each other’s responsibilities. Secure code is something all teams are striving for, integrating security to DevOps is the natural next step to creating optimal software.
Cross-Training
Understanding the specifics of what your colleagues are looking for makes the entire software release process easier. Leaving security as the last step is illogical. Everyone in the development pipeline must follow security best practices. Security is everyone’s job.
Another way that this can be accomplished is by following a method that software developer Puppet has integrated. They have a three-day internal convention that has subject matter experts across the IT fields. Employees hear from operations, security, and development team members to see exactly what they’re looking for. This kind of creativity is an excellent way to learn the nuances each team is focusing on. Training along with open dialogue allows each team to know exactly what to expect, and how to help.
Automating security
Many development teams see containers as a necessary tool to optimize workloads. MSPs even offer containers within a larger DevOps umbrella. Containers make the development pipeline much simpler. It also allows developers to have an extensive community to work with, as Kubernetes is open source and there are components throughout GitHub and other development libraries.
As helpful as containers can be, they can also be a security risk with improper practices. It isn’t realistic to manually monitoring every change in code, every feature update, every environment, and every networking request. Automating this process is critical. There are container security solutions providers, like Twistlock, that can make container security easier. They can cover the entire deployment and development lifecycle.
Automating security can provide peace of mind, but it shouldn’t be the only focus. The entire development and deployment lifecycle may be safer, but your entire IT team needs to be aware of best security practices. Containers will drive innovation in your company if you’re able to use them properly, and there’s no excuse not to.
Doug Atkinson
An entrepreneur and executive with a passion for enterprise technology, Doug founded Solutions Review in 2012. He has previously served as a newspaper boy, a McDonald's grill cook, a bartender, a political consultant, a web developer, the VP of Sales for e-Dialog - a digital marketing agency - and as Special Assistant to Governor William Weld of Massachusetts.
- Solutions Review Best of 2018: Top Container Security Articles - December 20, 2018
- Logicworks and AVANT Communications Announce Alliance - December 19, 2018
- A Look at the Container Lifecycle and How to Keep it Secure - December 14, 2018
