3 DevOps Challenges that Demand a New Security Approach
November 19, 2018

Andrew Useckas
Threat X

Software developers and security teams have a well-known antagonistic relationship. Dev teams often feel plagued by the restrictive security standards placed on them by security teams that inhibit their ability to rapidly write applications, while security teams view developers as one of the biggest threats with which they have to grapple.

As DevOps proliferates organizations in the never-ending race to deliver more customer value, faster, security is being forced to rethink its approach. The goal of DevOps is to accelerate the development of software and apps by breaking down the long-established barriers between development and operations. As part of this transformation, it also requires organizations to collaborate with security teams and reevaluate how they approach security in a DevOps world.

There are three core challenges that must be addressed in order for security and DevOps to be in lockstep:

1. Speed

In a world of continuous delivery, security has to be able to keep up with the new pace of development. This is no easy feat as dev cycles are much shorter, going from months to weeks and, in some cases, even days. Therefore, security tools at the DevOps level must be easy to integrate and maintain in order to support a continuous delivery flow. Increased levels of automation, state-of-the-art threat modeling and real-time vulnerability alerts are required. It is also critical that security becomes a component of pre-deployment checklists in dev, staging and production environments. This “shift left” is a best practice for DevOps that all organizations should adopt.

2. Break Down Barriers

At the heart of DevOps success is breaking down long-established silos and creating cross-functional, collaborative teams. Security, development, and operations must work cohesively in pursuit of a common set of goals to deliver successful DevOpsSec. This mandates that security teams serve as consultants to DevOps teams rather than acting as a roadblock, telling developers to go back and fix bad code. One way to help solve this problem is to explore and expand the automation of security solutions.

3. Skills Gap

Security teams must learn new skills in order to understand and integrate technology into the dev process. With development predominantly happening in the cloud, security teams must now be knowledgeable in areas such as API and coding so they can support the new agile development process.

By addressing these three core challenges, security teams can support the growth and success of DevOps. Ultimately, security teams need to look at DevOps through the same lens as a customer-facing web app by establishing a set of standards and best practices. However, it is important to note that post-deployment application security is equally as important as during the development stage. So, getting DevOps security right is only part of the transformation that security teams must undertake.

Andrew Useckas is CTO of Threat X
Share this

Industry News

December 06, 2022

The Cloud Native Computing Foundation® (CNCF®), which builds sustainable ecosystems for cloud native software, announced the graduation of Argo, which will join other graduated projects such as Kubernetes, Prometheus, and Envoy.

December 06, 2022

Wib announced API PenTesting-as-a-Service (PTaaS) designed to help organizations proactively cover the latest PCI-DSS 4.0 mandates for testing application security, APIs, and vulnerabilities in Business Logic.

December 05, 2022

Harness announced Harness Cluster Orchestrator to allow customers to optimize their Kubernetes cloud workload costs and realize up to 90% cloud cost savings with Amazon Elastic Compute Cloud (Amazon EC2) Spot instances from Amazon Web Services (AWS).

December 01, 2022

Salesforce introduced a new Automation Everywhere Bundle to accelerate end-to-end workflow orchestration, automate across any system, and embed data and AI-driven workflows anywhere.

December 01, 2022

Weaveworks announced that Flux, the original GitOps project, has graduated in the Cloud Native Computing Foundation (CNCF®).

December 01, 2022

Tigera announced enhancements to its cluster mesh capabilities for managing multi-cluster environments with Calico.

December 01, 2022

CloudBees achieved the Amazon Web Service (AWS) Service Ready Program for Amazon Elastic Compute Cloud (Amazon EC2) Spot Instances.

November 30, 2022

GitLab announced the limited availability of GitLab Dedicated, a new way to use GitLab - as a single-tenant software as a service (SaaS) solution.

November 30, 2022

Red Hat announced an expansion of its open solutions publicly available in AWS Marketplace.

November 30, 2022

Sisense announced the availability of the Sisense CI/CD Git integration module.

November 29, 2022

Codenotary announced TrueSBOM for Serverless, a self-updating Software Bill of Materials (SBOM) for applications running on AWS Lamda, Google Cloud Functions and Microsoft Azure Functions that is made possible by simply adding one line to the application source code.

November 29, 2022

Code Intelligence announced its open-source Command-Line Interface (CLI) tool, CI Fuzz CLI, now allows Java developers to easily incorporate fuzz testing into their existing JUnit setup in order to find functional bugs and security vulnerabilities at scale.

November 29, 2022

Parasoft announced the 2022.2 release of Parasoft C/C++test with support for MISRA C:2012 Amendment 3 and a draft version of MISRA C++ 202x.

November 28, 2022

Kasm Technologies announced the release of Kasm Workspaces v1.12, providing major enhancements to its portfolio of digital workspaces delivering Desktop as a Service (DaaS), Virtualized Desktop Infrastructure (VDI), Remote Browser Isolation (RBI), Open-Source Intelligence Collection (OSINT), Training/Sandboxes, and Containerized Application Streaming (CAS).

November 28, 2022

Cloud4C has achieved Amazon Web Services (AWS) DevOps Competency status.