First There Was DevOps…Then There Was DevSecOps

Created in 2009 by software developer Patrick Debois, the developer recognized the need for an enhanced tactical approach to evolve application innovation from start to finish. As a society, we are always seeking new ways to innovate as fast as possible. In all aspects of business, we aim to provide a product or service that delivers when needed to support the user. Most developers operate on a four-pronged approach and system before passing over to the operations team:

1. You have to introduce and plan the product from inception to begin the cycle.
2. Next, code it.
3. After you program and build the product.
4. Finally, you test it before releasing it to the operations unit.

It’s the role of a developer following the DevOps principles to create software at a fast speed to compete with the best available within the market. How they collaborated with the operations team often defined the success of the product before the next stages of development passed over to operations.

Mainly, the release of created software, deploying the product, operations maintaining the product and finally monitoring it for bugs etc and reporting back to development.

Essentially DevOps combines these two vital elements, bringing the developers and operation teams together instead of what was previously an independent effort on each part. Therefore, DevOps provides the bigger picture for both sides to understand how the product will best perform for the user.

This kind of approach was required because it was a necessity to progress technology further as users continued to increase in demand. These dynamics necessitated innovation and developers inspiring each other to push boundaries not seen before – to satisfy the customer who expects a streamlined product.

These products needed to be easy to use, navigate and purchase while the app’s features and functions expanded. Working at such high speeds to develop apps only increases the need for security. The rapid rise of malware and bad actors in general creates a necessity to test the resiliency and security of the product not only before release but also throughout the cycle.

Is DevSecOps a Type of Cyber Security?

Even though DevSecOps might fall, as a practice, under the umbrella of Cybersecurity, they are not the same.

DevSecOps is an approach for including security into the entire development lifecycle. It isn’t an afterthought or “bolt-on” after the fact. It is a way of developing solutions.

Without ‘Sec’ in DevOps, the whole process of developing software is at risk of stagnating or even imploding unless that buffer is in place to prevent any flaws in the system at any stage of the cycle.

1. You have to introduce and plan the product from inception to begin the cycle.
2. Next, code it.
3. After you program and build the product.
4. Finally, you test it before releasing it to the operations unit.

What are the key components of DevSecOps?

A security approach is at the heart of every product when DevSecOps as a framework is adopted. As we discussed earlier, DevSecOps professionals and teams that follow this approach operate by covering every aspect of the development cycle with consideration of what’s most important to the user of that application – keeping their data secure. But what’s also vital is how they work together as a team.

The first important component is adopting a more holistic perspective than perhaps was taken previously. Meaning everybody works together towards the common goal of implementing security tools and processes throughout the SDLC as agreed upon between operations, IT and development teams. This will save time, money and resources. A member of BCCS Cluster and expert in the two fields had this to say about the key differences:

We are very superficial about the way things used to be. To elaborate, previously because these concerns were separated into separate silos, there wasn’t much collaboration going on. Developers would launch it over the fence to the deployment team who would install it on a server farm and make it available to the end users.

Security, if it was considered formally, was usually in the form of audits or independent operations completed by the people in that silo. They didn’t talk to each other in real-time – only through post-mortem, or retrospectively. This meant that systems were more vulnerable to attacks over a longer period and that it costs money in the form of liability.

Plus, more specifically, in terms of rework or non-value added work that had to be done after the fact. This is in comparison to DEVSECOPS, an approach where those concerns were addressed very early on in the SDLC when and where it is much cheaper to resolve them.L. Eddie Smith, Kaunas lead at Komponent

This highlights the key point between the two i.e keeping each team in the loop at all times about all aspects of the development cycle right up to testing. A high level of communication will prevent bugs, breaches in security and any other potential delays. In addition, using automation as much as possible helps to prevent manual errors, often at a faster speed to test code, build quicker processes in the operations team and so much more. 

Conclusion

DeveSecOps is the next stage of the business revolution and yet still a work in progress because there are multiple ways you can approach the running of your business using this principle. Evolving from DevOps, it’s only natural that security is now a key consideration – regardless of the initial application idea, as organizations discover the most intelligent process to digitize the product and evolve the application in a modern and careful manner.

At BCCS, we have a wide range of experts that offer a variety of services to help integrate DevSecOps into your product cycle from start to finish, working together with your security and development teams to build the best DevSecOps approach to create applications that innovate the tech and financial industries.