DevSecOps: It's not a very friendly acronym. It reeks of techno-babble, sounds a little military, and resists a consumer connection. But think again. This is a vital discipline that's directly relevant to every enterprise and every individual, particularly within cloud infrastructures, and has long deserved greater attention.
Maybe that's why we're now seeing greater research and more discussion devoted to the subject. But what's really at stake here? And what needs to happen next?
First, let's understand the context. Cloud computing has transformed the way organizations create and manage digital services, and that includes a big change in how software is developed and deployed. DevOps was designed to break down silos among development, quality assurance and IT operations, and speed innovation in the process. This meant teams outside the IT orbit took control, and the always-on public cloud certainly helped.
But there was one little hiccup — as lines around ownership and accountability got blurred, security got left behind. Flexibility, yes; competitive advantage, sure; innovation, absolutely. Protection? Not so much. So, moving forward, here's a blueprint for gaining security without compromising productivity.
DevSecOps is nothing more — and nothing less — than the process of uniting the two main stakeholders, DevOps and security, in a spirit of collaboration. Many organizations have multiple DevOps teams, especially with multiple business units. That's why it's important for the security practice to own the cloud security program, which can encompass uniform monitoring and central visibility across all public cloud environments.
Another obstacle here is that DevOps is heavily automated, which is a good thing, while many aspects of traditional security involve manual audits. If DevSecOps is to work, security must be similarly automated, but professionals in this field worry that this will give rise to endless alerts. However, there have been major advances, and solutions are available to implement a fully automated security workflow that not only detects alerts but greatly eases the immediate resolution of key issues.
With that as the foundation, here are some best practices to build upon.
Public cloud environments are constantly changing — that's actually a major advantage —and it's not feasible to manually audit the entire landscape for assets.
Automatic Threat Detection
The threat vectors in public cloud environments are the same as those in on-premises environments, but the approaches to detecting them are different.
Once any risks are detected, they need automatic or immediate remediation.
Again, the fact that DevOps has crashed barriers and demolished silos, all to speed development and deployment, is a good thing. It's time that security kept pace — and the tools to do that are now available.
Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.Allan Kristensen, Vice President of Solutions Engineering at RedLock, is a technology leader who embraces a customer-first approach to build and grow emerging technologies into market leaders. He has over 15 years of experience in building successful solutions engineering ... View Full Bio