3 DevOps Challenges that Demand a New Security Approach
November 19, 2018

Andrew Useckas
Threat X

Software developers and security teams have a well-known antagonistic relationship. Dev teams often feel plagued by the restrictive security standards placed on them by security teams that inhibit their ability to rapidly write applications, while security teams view developers as one of the biggest threats with which they have to grapple.

As DevOps proliferates organizations in the never-ending race to deliver more customer value, faster, security is being forced to rethink its approach. The goal of DevOps is to accelerate the development of software and apps by breaking down the long-established barriers between development and operations. As part of this transformation, it also requires organizations to collaborate with security teams and reevaluate how they approach security in a DevOps world.

There are three core challenges that must be addressed in order for security and DevOps to be in lockstep:

1. Speed

In a world of continuous delivery, security has to be able to keep up with the new pace of development. This is no easy feat as dev cycles are much shorter, going from months to weeks and, in some cases, even days. Therefore, security tools at the DevOps level must be easy to integrate and maintain in order to support a continuous delivery flow. Increased levels of automation, state-of-the-art threat modeling and real-time vulnerability alerts are required. It is also critical that security becomes a component of pre-deployment checklists in dev, staging and production environments. This “shift left” is a best practice for DevOps that all organizations should adopt.

2. Break Down Barriers

At the heart of DevOps success is breaking down long-established silos and creating cross-functional, collaborative teams. Security, development, and operations must work cohesively in pursuit of a common set of goals to deliver successful DevOpsSec. This mandates that security teams serve as consultants to DevOps teams rather than acting as a roadblock, telling developers to go back and fix bad code. One way to help solve this problem is to explore and expand the automation of security solutions.

3. Skills Gap

Security teams must learn new skills in order to understand and integrate technology into the dev process. With development predominantly happening in the cloud, security teams must now be knowledgeable in areas such as API and coding so they can support the new agile development process.

By addressing these three core challenges, security teams can support the growth and success of DevOps. Ultimately, security teams need to look at DevOps through the same lens as a customer-facing web app by establishing a set of standards and best practices. However, it is important to note that post-deployment application security is equally as important as during the development stage. So, getting DevOps security right is only part of the transformation that security teams must undertake.

Andrew Useckas is CTO of Threat X
Share this

Industry News

March 04, 2021

GrammaTech announced a technology partnership with GitLab, the single application for the DevOps lifecycle.

March 04, 2021

Exadel announced that Sun Capital Partners, a private investment firm, has completed an acquisition of the company.

March 04, 2021

Palo Alto Networks completed its acquisition of Bridgecrew, a developer-first cloud security company.

March 03, 2021

Red Hat announced the latest release of Red Hat Process Automation, which delivers new developer tooling, extended support for eventing and streaming for event-driven architectures (EDA) through integration with Apache Kafka, and new monitoring capabilities through heatmap dashboards.

March 03, 2021

Leaders of the software development industry announced the formation of the Value Stream Management Consortium (VSMC).

March 03, 2021

Delphix and GenRocket announced a technology alliance designed to fulfill the needs of enterprise customers who desire a comprehensive test data solution that improves software quality.

March 02, 2021

JFrog announced that its DevOps Platform tools – JFrog Artifactory and JFrog Xray – are available with native deployment templates for customers using AWS GovCloud (US) and Azure Government clouds.

March 02, 2021

Spectro Cloud announced support for existing Kubernetes environments, including clusters on public cloud services such as Amazon EKS, Azure AKS and Google GKE, has been added to the Spectro Cloud Kubernetes management platform.

March 02, 2021

Idera announced the acquisition of PreEmptive Solutions, LLC, a provider of application protection and security.

March 01, 2021

CloudBolt Software announced the launch of OneFuse Community Edition, a free version of its codeless integration platform for automating, integrating, and extending private and hybrid cloud infrastructures.

March 01, 2021

DBmaestro launched support for Snowflake, the Data Cloud company.

March 01, 2021

Platform9 closed Series-D funding with an additional $12.5 million for a total of $37.5 million.

February 25, 2021

Red Hat announced Red Hat OpenShift 4.7, the latest version of the company’s enterprise Kubernetes platform.

February 25, 2021

Granulate announced the release of its open-source platform, the G-Profiler, a production profiling solution that measures the performance of code in production applications to facilitate compute optimization.

February 25, 2021

Checkmarx announced the launch of KICS (Keeping Infrastructure as Code Secure), an open source static analysis solution that enables developers to write more secure infrastructure as code (IaC).