3 DevOps Challenges that Demand a New Security Approach
November 19, 2018

Andrew Useckas
Threat X

Software developers and security teams have a well-known antagonistic relationship. Dev teams often feel plagued by the restrictive security standards placed on them by security teams that inhibit their ability to rapidly write applications, while security teams view developers as one of the biggest threats with which they have to grapple.

As DevOps proliferates organizations in the never-ending race to deliver more customer value, faster, security is being forced to rethink its approach. The goal of DevOps is to accelerate the development of software and apps by breaking down the long-established barriers between development and operations. As part of this transformation, it also requires organizations to collaborate with security teams and reevaluate how they approach security in a DevOps world.

There are three core challenges that must be addressed in order for security and DevOps to be in lockstep:

1. Speed

In a world of continuous delivery, security has to be able to keep up with the new pace of development. This is no easy feat as dev cycles are much shorter, going from months to weeks and, in some cases, even days. Therefore, security tools at the DevOps level must be easy to integrate and maintain in order to support a continuous delivery flow. Increased levels of automation, state-of-the-art threat modeling and real-time vulnerability alerts are required. It is also critical that security becomes a component of pre-deployment checklists in dev, staging and production environments. This “shift left” is a best practice for DevOps that all organizations should adopt.

2. Break Down Barriers

At the heart of DevOps success is breaking down long-established silos and creating cross-functional, collaborative teams. Security, development, and operations must work cohesively in pursuit of a common set of goals to deliver successful DevOpsSec. This mandates that security teams serve as consultants to DevOps teams rather than acting as a roadblock, telling developers to go back and fix bad code. One way to help solve this problem is to explore and expand the automation of security solutions.

3. Skills Gap

Security teams must learn new skills in order to understand and integrate technology into the dev process. With development predominantly happening in the cloud, security teams must now be knowledgeable in areas such as API and coding so they can support the new agile development process.

By addressing these three core challenges, security teams can support the growth and success of DevOps. Ultimately, security teams need to look at DevOps through the same lens as a customer-facing web app by establishing a set of standards and best practices. However, it is important to note that post-deployment application security is equally as important as during the development stage. So, getting DevOps security right is only part of the transformation that security teams must undertake.

Andrew Useckas is CTO of Threat X
Share this

Industry News

February 29, 2024

ManageEngine, the enterprise IT management division of Zoho Corporation, announced the integration between Endpoint Central, its flagship unified endpoint management solution, and Check Point's Harmony Mobile, a leading mobile threat defense solution, to help IT security teams automate the remediation of mobile threats.

February 29, 2024

Stack Overflow and Google Cloud announced a strategic partnership that will deliver new gen AI-powered capabilities to developers through the Stack Overflow platform, Google Cloud Console, and Gemini for Google Cloud.

February 29, 2024

The Cloud Native Computing Foundation® (CNCF®), which builds sustainable ecosystems for cloud native software, announced the graduation of Falco, a cloud native security tool designed for Linux systems and the de facto Kubernetes threat detection engine.

February 28, 2024

JFrog announced a new technology integration with Qwak, a fully managed ML Platform, that brings machine learning models alongside traditional software development processes to streamline, accelerate, and scale the secure delivery of ML applications.

February 28, 2024

ServiceNow, Hugging Face, and NVIDIA, announced the release of StarCoder2, a family of open‑access large language models (LLMs) for code generation that sets new standards for performance, transparency, and cost‑effectiveness.

February 28, 2024

GMO GlobalSign announced the availability of an Issuer for Kubernetes cert-manager.

February 27, 2024

MacStadium announced the launch of its online community to deepen the connections of application developers through knowledge sharing and collaboration.

February 27, 2024

Octopus Deploy announced the acquisition of Codefresh Inc.

February 26, 2024

Intel announced its new Edge Platform, a modular, open software platform enabling enterprises to develop, deploy, run, secure, and manage edge and AI applications at scale with cloud-like simplicity.

February 26, 2024

Tray.io announced AI-augmented API Management, a new Tray Universal Automation Cloud capability that turns any new or existing workflow into a reusable API, significantly decreasing the technical debt associated with the operational effort and costs of traditional API management (APIM).

February 26, 2024

Bitwarden Secrets Manager is now integrated with Ansible Playbook.

February 22, 2024

Check Point® Software Technologies Ltd. introduces Check Point Quantum Force series: an innovative lineup of ten high-performance firewalls designed to meet and exceed the stringent security demands of enterprise data centers, network perimeters, campuses, and businesses of all dimensions.

February 22, 2024

Tabnine announced that Tabnine Chat — the enterprise-grade, code-centric chat application that allows developers to interact with Tabnine AI models using natural language — is now available to all users.

February 22, 2024

Avaamo released Avaamo LLaMB™, a new low-code framework for building generative AI applications in the enterprise safely, securely, and fast.

February 21, 2024

CAST announced the winter release of CAST Imaging, an imaging system for software applications, with significant user experience (UX) enhancements and new features designed to simplify and accelerate processes for engineers who develop, maintain, modernize, complex software applications.