This article is part of a larger piece that was published on the Dynatrace Blog. To read the original article in its entirety, click HERE.
Traditional application security measures are not living up to the challenges presented by dynamic and complex cloud-native architectures and rapid software release cycles. Security Boulevard reports that 95% of organizations say they’ve experienced at least one successful application exploit in the past year. One reason for this failure is traditional application security tools slow developers down. Sixty-six percent of companies say they “sometimes or occasionally” skip security scans to meet release deadlines, putting already vulnerable apps at greater risk.
Many organizations already employ DevOps, an approach to developing software that combines development and operations in a continuous cycle to build, test, release, and refine software in an efficient feedback loop.
Most often, security practices, like testing for and managing vulnerabilities, happen in a separate step, by a separate team, using separate tools–often at odds with the release schedule.
DevSecOps is the practice of integrating security into the DevOps workflow. Just as DevOps requires a lifestyle shift to integrate two teams at opposite ends of the delivery lifecycle, DevSecOps requires a similar mindset shift as teams integrate security tools and practices into this cadence.
As you think about how to evolve your processes to include security as an equal, third party in your development-operations partnership, it will be helpful to understand these six key ways that adopting DevSecOps can boost your entire software delivery life cycle.
1. Security happens during, not after development
Traditionally, application security testing sits as a discrete stage between development and operations. While DevOps practices have sped up this approach — develop, test and secure, operate — DevSecOps unites the three stages into one effort coordinated by a single team with access to the same data.
Rather than relying on post-development scans and assessments to find potential application security issues, DevSecOps integrates application security testing earlier in the development and operations workflow. This “shift left” approach to security enables developers to address issues before they reach production, which speeds up delivery and reduces risk.
2. Security can “shift left”—and “shift right”
While the ability to “shift left”, to address security in pre-production, helps improve efficiency during development, it is also vital that security practices “shift right”, by maintaining visibility into applications running in a production environment. Here’s why:
- Production is where most exploits take place. Applications are open to the internet and accessed by unknown entities, some of which may have malicious intent.
- Production is where off-the-shelf and home-grown applications run. These applications may not be subject to your usual pre-production testing regimen and may fall through the cracks.
Because application vulnerabilities can be addressed during development and evaluated in the run-time context of the production environment, the time and effort required to remediate those vulnerabilities is much less.
3. Security is by design, not tacked on
The most hardened applications are those for which security was a key consideration all along. DevSecOps practices ensure that applications do not rely on tacked-on protections by giving security staff a seat at the table and incorporating their input from the very beginning of app development and operations.
The result is security by design. Instead of discovering application vulnerabilities with post-release security solutions that slow software rollouts at best — and require recalls at worst — the DevSecOps approach makes security a native component of key application frameworks and functions.
4. Security is a shared responsibility
When considering DevOps vs DevSecOps, it becomes obvious that both look to integrate disparate processes using a combination of agility and automation. One contribution security can make to DevOps is to place emphasis on the idea that everyone is responsible for security.
DevOps teams’ relationships with security staff can range from apathetic to downright hostile if DevOps staff does not understand the importance of the security practices suggested or if they feel these practices obstruct their work. In a recent study by ESG, 27% of respondents admitted their application development and DevOps teams do not even work with their cybersecurity teams due to fear this will slow them down.
Truly implementing DevSecOps requires a cultural shift. Rather than simply joining three disparate disciplines under common management, DevSecOps expects every individual to exercise security best practices relevant to their role and to remain in a security-focused mindset. The result is a shared responsibility model that helps ensure a secure product.
5. Shared security intelligence breaks down silos
While DevOps looks to integrate once-disparate processes, DevSecOps looks to break down more of the long-established walls between organizational departments. These security “silos” — the data and applications that each department handles in its own specific way — create immediate inconveniences and signal deeper problems with observability and sharing of critical information.
DevSecOps efforts level the playing field by creating a framework of shared solutions, data, and security protocols that all teams leverage throughout the software delivery lifecycle. While use cases and customizations may vary for different processes, shared resources that integrate into a common workflow help to solve for silos at scale.
6. Integrated security enables automation
Both DevOps and DevSecOps prioritize simplifying processes through automation. For DevOps, automation streamlines design, testing, and deployment processes and increases the speed of application development.
Similarly, integrating application security earlier in the software development process enables teams to identify, resolve, and prevent application vulnerabilities early in pre-production, but also in production. This integrated approach makes it possible for teams to reliably automate vulnerability detection and security practices into a continuous delivery workflow.
