3 DevOps Challenges that Demand a New Security Approach
November 19, 2018

Andrew Useckas
Threat X

Software developers and security teams have a well-known antagonistic relationship. Dev teams often feel plagued by the restrictive security standards placed on them by security teams that inhibit their ability to rapidly write applications, while security teams view developers as one of the biggest threats with which they have to grapple.

As DevOps proliferates organizations in the never-ending race to deliver more customer value, faster, security is being forced to rethink its approach. The goal of DevOps is to accelerate the development of software and apps by breaking down the long-established barriers between development and operations. As part of this transformation, it also requires organizations to collaborate with security teams and reevaluate how they approach security in a DevOps world.

There are three core challenges that must be addressed in order for security and DevOps to be in lockstep:

1. Speed

In a world of continuous delivery, security has to be able to keep up with the new pace of development. This is no easy feat as dev cycles are much shorter, going from months to weeks and, in some cases, even days. Therefore, security tools at the DevOps level must be easy to integrate and maintain in order to support a continuous delivery flow. Increased levels of automation, state-of-the-art threat modeling and real-time vulnerability alerts are required. It is also critical that security becomes a component of pre-deployment checklists in dev, staging and production environments. This “shift left” is a best practice for DevOps that all organizations should adopt.

2. Break Down Barriers

At the heart of DevOps success is breaking down long-established silos and creating cross-functional, collaborative teams. Security, development, and operations must work cohesively in pursuit of a common set of goals to deliver successful DevOpsSec. This mandates that security teams serve as consultants to DevOps teams rather than acting as a roadblock, telling developers to go back and fix bad code. One way to help solve this problem is to explore and expand the automation of security solutions.

3. Skills Gap

Security teams must learn new skills in order to understand and integrate technology into the dev process. With development predominantly happening in the cloud, security teams must now be knowledgeable in areas such as API and coding so they can support the new agile development process.

By addressing these three core challenges, security teams can support the growth and success of DevOps. Ultimately, security teams need to look at DevOps through the same lens as a customer-facing web app by establishing a set of standards and best practices. However, it is important to note that post-deployment application security is equally as important as during the development stage. So, getting DevOps security right is only part of the transformation that security teams must undertake.

Andrew Useckas is CTO of Threat X
Share this

Industry News

October 10, 2019

CloudBees launched a new partner program that expands ISV partners’ ability to align with CloudBees offerings and the global Jenkins community.

October 08, 2019

Nureva announced a key update to the Jira Software integration with Span Workspace, Nureva’s cloud-based digital canvas for visual planning and collaboration.

October 08, 2019

Fugue announced support for Open Policy Agent (OPA), an open source general-purpose policy engine and language for cloud infrastructure.

October 03, 2019

Redgate announced the launch of SQL Compare v14, the latest version of its industry standard tool for quickly and accurately comparing and deploying SQL Server databases.

October 03, 2019

Harness announced the release of Continuous Insights, a new capability of its CD platform that enables organizations to see clearly into software delivery performance across their engineering and development teams without needing to manually collect, correlate, and report metrics that might take days or weeks.

October 03, 2019

OutSystems and Workato announced a partnership aimed at allowing organizations to rapidly realize innovation, time to value, productivity, and mission-critical objectives through readily available application connectors.

October 02, 2019

Kong announced an acquisition and several new products.

October 02, 2019

Contrast Security announced the availability of .NET Core support on Contrast Community Edition (CE).

October 02, 2019

Checkmarx earned Amazon Web Services (AWS) Security Competency status for its Software Security Platform.

October 01, 2019

Parasoft announced the release of its newest product, Parasoft Selenic, a UI testing solution that makes Selenium smarter, to help organizations find real bugs faster.

October 01, 2019

Micro Focus announced the general availability of Deployment Automation 6.3, offering new deployment improvements for its Release Orchestration solution set.

October 01, 2019

Compuware announced enhancements to Topaz for Total Test and a partnership with OpenLegacy to help large enterprises speed mainframe software development and delivery while improving quality.

September 30, 2019

Deque Systems announced Axe Pro, a key addition to Axe, the web accessibility testing browser extension.

September 30, 2019

NIIT Technologies and mabl, Inc announced a partnership to deliver AI-driven automated solution for faster, economical and better application testing services.

September 30, 2019

Rockset announced the capability to analyze raw events from Apache Kafka in real time.