The world of *Ops: DevOps, SecOps, and DevSecOps
Evolution of Software Development and Maintenance.
Most IT professionals in today’s world are aware of Agile methodology. The Agile methodology enables better collaboration between the customer and the IT. With Agile, the power of teamwork is being realized.
Agile is an iterative approach that concentrates on continuous delivery. The focus is to start small and get timely and constructive customer feedback for improvements.
The Agile principles looked great but they were mere guidelines. As the software development industry evolved with Agile, some issues were identified.
- Development, Operations & Security teams were working in independent silos.
- There was a dependency on the operations team to promote code through different environments.
- Implementation and Rollback plans were complex and there were high chances of failure.
- There was a dependency on the infrastructure team to provision repeatable and consistent environments (For ex: VMs, DBs, etc).
- Security reviews were done at the end of the software development life cycle. This introduced unnecessary delays and impacted time to market.
In comes DevOps?
DevOps is the union of development and operations teams to continuously provide value to customers. The concept of DevOps was coined in 2009. The objective was to increase collaboration between the development and operations team for fast reliable and smooth releases.
As part of DevOps, build scripts are automated to compile code after each commit. This phase is termed Continuous Integration (aka CI).
Once the codebase is compiled by CI, the builds are then deployed to different environments with the help of Continuous Deployment (aka CD) pipelines.
The releases are reliable and fast. There is no need to write complex rollback and implementation scripts for every release. Moreover, developers are not dependant on operations to deploy code onto different environments.
With the growing demand for Cloud infrastructure, IaC (Infrastructure as Code) is used to provision repeatable and consistent cloud infrastructure with the help of configuration files. This removes the dependency on the infrastructure team for provisioning cloud resources.
High-quality software was being built and shipped at a consistent pace, but there was a problem.
It’s a BIG BAD world out there
All of us are aware of the dangers, a security breach can cause to a business. We constantly hear about them. But, why do they happen?
- Hacking is easy — There are cheap tools available online which are easily accessible. Read “10 Hacking Tools You Think Would be Illegal But are for Sale Online” to surprise yourself.
- Security and Operations working in Silos — Hacker’s never targeted a team. They target loopholes that exist in a system. Security and Operation teams working in silos expose these loopholes. This is exactly the case with DevOps.
In comes SecOps
SecOps is the union of security and operations team to tackle security threats and breaches. The objective of SecOps is to build and support a security framework.
This security framework consists of automated and manual processes to safeguard businesses from security threats. It uses tried and tested ways to tackle any security threat or breach.
Primary responsibilities of SecOps are:
- Logging or Capturing important events
Automated jobs capture important events from all IT systems. A lot of thought goes behind designing these automated jobs.
Logging events is like a double-edged sword. Lack of information will make it extremely difficult to handle security breaches. On the other hand, logging everything results in a high cost of storage. It will also create unnecessary noise, which takes attention away from the main issue.
2. Automated tests
Logging alone is not enough. Every log serves a purpose. Automated tests scan these logs and generate alerts and warnings. These alerts are then actioned upon with the help of a service request or incident management process.
3. Security Policies
SecOps uses a combination of automated and manual ways to deploy security policies for various IT systems. For example — blocking vulnerable websites on work laptops.
These policies prevent accidental security breaches due to the negligence of office staff.
With the evolution of Cloud-based technologies, the risk of security breaches is more than ever. SecOps constantly updates access policies on cloud resources to limit security breaches.
Information Security Friction
On paper DevOps and SecOps seem to perfectly align with the Agile world, but there are no ideal scenarios. Security is not often the most loved team. The reason is Information Security friction.
Security audits and reviews of Development projects were still following the waterfall model. Each phase had a dependency on the previous stage. To be able to get Information Security assurance, a lot of time was invested during these sequential stages.
This is the primary reason for the security team not being to able to keep pace with the development timelines.
In Comes DevSecOps
The idea of DevSecOps is to remove Information Security friction by doing Information Security in an Agile way. This is also elaborated on in the DevSecOps manifesto.
The objective is to:
- Use Security as a Code to provide real-time insights to developers instead of scanners and pen tests at the end of the development lifecycle.
- The collaboration between Development and Security is given more attention over security only requirements.
- Proactive ongoing 24*7 Security monitoring is preferred over an Incident Management process.
All of the above is achieved by integrating Security into DevOps.
- Security design happens before the code is written. Once the code is pushed into the repository, a security review happens with the help of test cases (executed during CI). This provides real-time feedback to developers during the CI phase for any non-compliance to security standards.
- When the code is ready to be deployed onto different environments, more security tests run to ensure they abide by security policies.
The advantage of DevSecOps is that it pushes security to the left. It ensures security is given adequate attention, without impacting development timelines.
I have tried to touch on the concept of DevSecOps from different angles. I hope the article is helpful in understanding the concepts.
Constructive feedback will be appreciated.
References
- 10 Hacking Tools You Think Would be Illegal But are for Sale Online.
- Collection Is Not Detection and Other Rules for Modernising Sec Ops | Pluralsight
- (1) SecOps — Bringing Agility into Security — Atlassian Summit Europe 2017 — YouTube
- (1) When Security Meets Innovation: a Cross-Team Love Story — Atlassian Summit 2016 — YouTube
- What is DevSecOps? (redhat.com)
- DevSecOps: The Big Picture | Pluralsight
- What is DevSecOps? — DevSecOps
- Infrastructure As a Code
- DecSecOps : The Big Picture
- Security as a Code
- Information Security Friction
- Security to the left
- 31 Most used DevSecOps tools
- DevSecOps manifesto
- Devops Vs DevSecOps Comparison | Difference Between DevOps & DevSecOps Methodology (k2io.com)
P.S — Medium is an excellent platform to read, write and learn from fellow authors. If you want to join me in this journey, Join medium today.