devopsy.kinsta.cloud

Author: Chris Raethke

  • DevOps Security: Five steps to bridging the gap between teams

    DevOps Security: Five steps to bridging the gap between teams

    Enterprise security and DevOps teams have traditionally operated separately with little to no engagement, often making it difficult to quickly identify and respond to potential vulnerabilities in applications and software. In my last column, I highlighted the value of introducing security to the DevOps process to reduce bugs and vulnerabilities before code hits production. By moving security as close as possible to the code and data, coupled with tight feedback loops, organizations will be in a better position to support the growing complexity of building software.

    DevOps emphasizes an agile infrastructure that can change rapidly as new code is deployed, making it a breeding ground for bugs and vulnerabilities when security isn’t taken into consideration. So how do you close the DevOpsSec gap within your organization? The secret is to start simple, take small steps and earn easy wins. Below are five tips:

    1. Build a development team that cares about its code in production. Your developers must care about their code during development when they’re writing it, when adding new features, how it performs in production and when they create fixes for issues. The team should have complete ownership of the code, what I like to call “code love,” and be able to defend it as if it were their child.
    2. Implement peer code reviews. The initial way to encourage “code love” is through peer code reviews, which allow developers see what others are writing, encourages them to work together and fosters discussions among the team on how to improve processes. Additionally, with these review processes, teams will be able to identify bad practices early on and improve them.
    3. Introduce a test-driven development environment. Test-driven development environments mean reproducible testing and can then leverage a continuous integration (CI) server to encourage the team to run security tests every time code is submitted. Many organizations inconsistently do this, don’t do it well or bypass this step entirely. By having developers do more testing and reviews, you can more tightly integrate DevOps and security within the organization.
    4. Extend the automation. Once establishing the above, it’s time to extend the automation. Encourage your team to do code style and quality testing, which are additional tools to automate “code love”. Good clean code that is easy to read will always have fewer bugs. Additionally, introduce static security analysis to your CI server to help identify low hanging fruit and early-on implementation issues. Another option is to introduce abuse cases by having your team write malicious user stories. These are a great way to ensure the same issues don’t regress, and simultaneously serve as training material for new team members.
    5. Build firefighting teams. To ensure that everyone across the board cares about this process, pull members of the DevOps and security team and put them on-call together on a weekly basis. This collaboration will allow each team member to see the issues other teams face and how their needs overlap, building a deeper understanding of each others’ roles and processes. After “code love,” this is the second most important feedback loop you can introduce to your organization.

    To successfully initiate DevOpsSec within an organization, developers need to have clear parameters to work within to include the security team in the software development lifecycle (SDLC). By breaking down organizational silos and encouraging the cross-pollination of DevOps and security teams, they’ll be able to gain a better understanding of the issues they each deal with and naturally introduce joint solutions.

  • Why do you need to implement a DevOpsSec team?

    Why do you need to implement a DevOpsSec team?

    Just 20 years ago, organizations relied on a single wall of defense to secure their applications and networks. Fast forward to 2015 and that large fence is no longer adequate. With the proliferation of mobile, cloud and SaaS technology adding to the complexity of ever-advancing systems and networks, it becomes much more important that teams across an organization work together as one, toward a common goal. We’ve already seen enterprises adopting new methods of organizing internal structures to increase collaboration through DevOps, but as security continues to be top of mind for organizations, many are looking to further this approach by including the security team in the DevOps conversation. With a DevOpsSec team, organizations can work toward delivering software that is not just reliable, but also secure.

    Introducing security to DevOps provides the means to this protection by reducing the number of bugs and vulnerabilities during the build process before code hits production systems. Moving security as close as possible to the code and data will bring a large number of high value benefits to an organization.

    The first benefit of introducing security to DevOps is the enablement of team collaboration through tight feedback loops. Development, operations and security teams all have different goals and are motivated by different things, which are often contrary to the other teams. To ensure that these groups don’t work as adversaries within an organization, DevOpsSec encourages them to work together, pulling from all parties’ strengths and building a collaborative and engaging environment. This collaboration offers transparency into the assorted issues that arise within each team, establishing a deeper level of understanding and respect across the board.

    The second benefit is that DevOpsSec provides a wider perspective across previously siloed teams. As a result of greater team collaboration, Dev, Ops and Sec teams are able to gain more insight into how the other teams operate. This widened perspective decreases friction between them, further revealing common goals and generating more natural solutions. Overall, the assortment of perspectives results in more efficient strategies for the organization in keeping its systems secure.

    Lastly, the implementation of DevOpsSec ensures faster response time to issues. As applications and systems become more distributed and complex, it becomes more difficult to identify and fix bugs and vulnerabilities. Developers are writing and pushing code faster than ever before, and what used to be monthly or longer release cycles can now be measured in hours. This is due in part to the fact that code is being used both inside and outside our networks, requiring more thorough network security. The new normal will be found in developing DevOpsSec teams and moving the security as close as possible to the code and data. Through more continuous review processes and more ownership over code in production, the merging of DevOpsSec can mean faster times in closing feedback loops and will ultimately help organizations to operate more efficiently.

    So what will an organization look like after implementing DevOpsSec? As a result of the cross pollination between teams, organizations will have curated an elevated platform for innovative ideas, gained greater insights across teams and developed faster response times to help the business run smoother. With DevOpsSec in affect, organizations will better understand and anticipate security issues and the decisions required to diminish them.