6 Best Practices for Successful DevSecOps Implementation
September 25, 2019

Sai Nikesh D
Veritis Group

DevSecOps has shown the IT industry an effective way to deal with security issues in DevOps lifecycle.

Unlike the traditional waterfall model that involved security at the end, the DevSecOps model calls for security integration right from the start and along the process chain till the end. This strategic shift in integrating security controls in the Software Development Lifecycle (SDLC) made a big difference to the industry in delivering rapid, yet secure code.

By doing so, DevSecOps addressed the most common concern that many firms had on DevOps journey i.e. faster code releases result in more vulnerabilities.

But successful security integration into DevOps pipelines through DevSecOps requires adoption of certain tools, resources and practices that can unite Dev, Ops and Security teams under the ambit of DevSecOps culture.

Here are 6 best practices for successful DevSecOps implementation:

1. Automation is key to securing CI/CD Pipeline

Speedy delivery is one of the key aspects of Continuous Integration (CI) and Continuous Deployment (CD) environment in DevOps. So, integrating security in this fast-paced environment requires automating security and embedding relevant controls and tests across the development lifecycle.

Automation has a very important role in achieving DevSecOps implementation, as evident in a 2018 survey that showed 4 percent of highly mature DevOps firms using automated security test cycles across the development cycle.

From doing source-code analysis to post-deployment monitoring, there are many tools and resources to help in security analysis and testing.

One needs to take extra care while automating security testing. If you have to do the Static Application Security Testing (SAST) for daily builds, then automated scans on entire source code every day consumes lot of time and keeps you away from daily deadlines.

Also, try to use automated Dynamic Application Security Testing (DAST) that can scan real-time vulnerabilities unlike SAST that checks only with-in-the code issues.

Adding automated security analysis to CI/CD pipelines stops the early entry of vulnerabilities and keeps the code secure through the development lifecycle.

2. Identify possible vulnerabilities and address code dependencies

Considering the possible vulnerabilities associated with open source usage, it's important to understand the open source usage for a successful DevSecOps strategy.

According to global surveys, a large number of companies continue to use open-source software in their apps despite the risks associated with usage of third-party software components. One of the 2017 surveys on around 1000 commercial applications found 96 percent of them having open-source components with more than 6 in 10 applications reporting security vulnerabilities. Despite this situation, only 27 percent of the organizations had automatic identification and solution tracking mechanism to tackle at least known vulnerabilities from open-source software.

Considering the developer time constraints to review code in open-source libraries or study the documentation, there should be dedicated automated processes for managing open-source and third-party software components. These processes help in early identification of possible open-source related vulnerabilities, thus reducing the impact on internal code dependencies. Thus, checking code dependency is crucial to DevSecOps implementation.

Utilities like Open Web Application Security Project (OWASP) can help you in scanning code and dependent open-source component libraries by working against the constantly-updated database of all vulnerabilities.

3. Let developers get accustomed to security checks in the workflow

Developers need to get accustomed to security checks as part of their normal workflow.

SAST tools are special to this case as they allow developers scan the code for any possible security checks while they write and give them instant feedback. This happens as part of developer usual workflow.

However, enabling multiple checks at a time for addressing a whole set of multiple security issues creates confusion among developers. So, it is recommended to turn on one or two security checks at a time and let developers realize the fact that security rules are also part of their process. Being aware of how security mechanism addresses errors in code builds developer confidence.

4. Choosing right tools is very important

Choosing right security tools is very important for the success of your DevSecOps process.

Security tools should be able to get integrated easily into the fast-moving CI/CD cycles and stand in a position to build gaps between development and security teams, rather than creating hurdles. They should ideally initiate scans and allow developers to focus on their core workflow, leaving the security aspect to them. They should be good in speed, and generate accurate and actionable results that shouldn't require a recheck either by developers or security teams, which is key to DevOps workflow.

Security tools should help developers identify and prioritize vulnerabilities while writing the code. Identification of vulnerabilities should be directly on the software itself and not on its signatures. Not just known vulnerabilities. Such tools should also be able to track unknown issues from anywhere such as open-source software components.

6. Implement threat modelling mechanism

It's important to implement threat modelling mechanism in the DevOps lifecycle as it helps developers view software in attacker perspective. Thus, developers will be extra careful in writing code and will be able to generate secure code.

Threat assessment also helps you identify possible vulnerabilities in your architecture and design, which might have been missed out by other security checks.

It also helps you understand the sensitivities of your internal assets and their vulnerability to possible threats.

Noteworthy is that threat modelling can often slow down the pace of your CI/CD pipeline and cannot be automated, but is a critical part of successful security integration.

6. Training on secure coding is critical

Experts believe that developers across many firms don't realize the fact that they are coding the insecure way.

Considering this fact, it's important to make a note of training developers on ways to deliver secure code. This happens to be one of the serious challenges to successful implementation of DevSecOps practices.

This might not have been a priority to developer teams until now, as they focus on coding. But achieving security in DevOps culture demands the requirement of making developers aware of security-related facts.

Firms need to take necessary measures and making needed investment on this area of training on secure coding for a succesful DevSecOps implementation.

Implementation of these six practices form key to the success of DevSecOps implementation and security challenge in a DevOps culture.

Sai Nikesh D is a Senior Strategy Content Writer at the Veritis Group
Share this

Industry News

October 22, 2020

Puppet announced Puppet Comply, a new product built to work with Puppet Enterprise aimed at assessing, remediating, and enforcing infrastructure configuration compliance policies at scale across traditional and cloud environments.

October 22, 2020

Harness announced two new modules: Continuous Integration Enterprise and Continuous Features.

October 22, 2020

Render announced automatic preview environments which are essential for rapid and collaborative development of modern applications.

October 21, 2020

Conducto is launching a toolkit for simplifying complex CI/CD and data science pipelines, having raised $3 million in seed funding led by Jump Capital.

October 21, 2020

Snyk Intel vulnerability database will be integrated into IBM Cloud security capabilities to enhance security for enterprise workloads.

October 21, 2020

Accurics announced $20 million across seed and series A financing raised in the past six months, with Intel Capital leading the Series A and ClearSky leading the seed.

October 20, 2020

Splunk announced the Splunk Observability Suite, the most comprehensive and powerful combination of monitoring, investigation, and troubleshooting solutions designed to help organizations become cloud-ready and accelerate their digital transformation.

October 20, 2020

Tricentis announced Vision AI, the core technology that will now power Tosca.

October 20, 2020

MuseDev has extended its code analysis platform to deliver bug reports via Github's code scanning UI.

October 20, 2020

Digital Shadows announced the ability to detect exposed access keys.

October 19, 2020

StackRox and Robin.io announced a new partnership bringing together Robin’s application-focused approach to Kubernetes data management with StackRox’s Kubernetes-native security and compliance capabilities.

October 19, 2020

PubNub announced new Chat UI Kits to streamline chat development.

October 19, 2020

Secure Code Warrior announced support for GitHub’s new code scanning functionality in conjunction with a new collaboration with Snyk.

October 15, 2020

Couchbase announced version 2.8 of Couchbase Lite and Couchbase Sync Gateway for mobile and edge computing applications.

October 15, 2020

Kong unveiled the private beta release of Kong Konnect, a full-stack platform for cloud native applications delivered as a service.