6 Best Practices for Successful DevSecOps Implementation
September 25, 2019

Sai Nikesh D
Veritis Group

DevSecOps has shown the IT industry an effective way to deal with security issues in DevOps lifecycle.

Unlike the traditional waterfall model that involved security at the end, the DevSecOps model calls for security integration right from the start and along the process chain till the end. This strategic shift in integrating security controls in the Software Development Lifecycle (SDLC) made a big difference to the industry in delivering rapid, yet secure code.

By doing so, DevSecOps addressed the most common concern that many firms had on DevOps journey i.e. faster code releases result in more vulnerabilities.

But successful security integration into DevOps pipelines through DevSecOps requires adoption of certain tools, resources and practices that can unite Dev, Ops and Security teams under the ambit of DevSecOps culture.

Here are 6 best practices for successful DevSecOps implementation:

1. Automation is key to securing CI/CD Pipeline

Speedy delivery is one of the key aspects of Continuous Integration (CI) and Continuous Deployment (CD) environment in DevOps. So, integrating security in this fast-paced environment requires automating security and embedding relevant controls and tests across the development lifecycle.

Automation has a very important role in achieving DevSecOps implementation, as evident in a 2018 survey that showed 4 percent of highly mature DevOps firms using automated security test cycles across the development cycle.

From doing source-code analysis to post-deployment monitoring, there are many tools and resources to help in security analysis and testing.

One needs to take extra care while automating security testing. If you have to do the Static Application Security Testing (SAST) for daily builds, then automated scans on entire source code every day consumes lot of time and keeps you away from daily deadlines.

Also, try to use automated Dynamic Application Security Testing (DAST) that can scan real-time vulnerabilities unlike SAST that checks only with-in-the code issues.

Adding automated security analysis to CI/CD pipelines stops the early entry of vulnerabilities and keeps the code secure through the development lifecycle.

2. Identify possible vulnerabilities and address code dependencies

Considering the possible vulnerabilities associated with open source usage, it's important to understand the open source usage for a successful DevSecOps strategy.

According to global surveys, a large number of companies continue to use open-source software in their apps despite the risks associated with usage of third-party software components. One of the 2017 surveys on around 1000 commercial applications found 96 percent of them having open-source components with more than 6 in 10 applications reporting security vulnerabilities. Despite this situation, only 27 percent of the organizations had automatic identification and solution tracking mechanism to tackle at least known vulnerabilities from open-source software.

Considering the developer time constraints to review code in open-source libraries or study the documentation, there should be dedicated automated processes for managing open-source and third-party software components. These processes help in early identification of possible open-source related vulnerabilities, thus reducing the impact on internal code dependencies. Thus, checking code dependency is crucial to DevSecOps implementation.

Utilities like Open Web Application Security Project (OWASP) can help you in scanning code and dependent open-source component libraries by working against the constantly-updated database of all vulnerabilities.

3. Let developers get accustomed to security checks in the workflow

Developers need to get accustomed to security checks as part of their normal workflow.

SAST tools are special to this case as they allow developers scan the code for any possible security checks while they write and give them instant feedback. This happens as part of developer usual workflow.

However, enabling multiple checks at a time for addressing a whole set of multiple security issues creates confusion among developers. So, it is recommended to turn on one or two security checks at a time and let developers realize the fact that security rules are also part of their process. Being aware of how security mechanism addresses errors in code builds developer confidence.

4. Choosing right tools is very important

Choosing right security tools is very important for the success of your DevSecOps process.

Security tools should be able to get integrated easily into the fast-moving CI/CD cycles and stand in a position to build gaps between development and security teams, rather than creating hurdles. They should ideally initiate scans and allow developers to focus on their core workflow, leaving the security aspect to them. They should be good in speed, and generate accurate and actionable results that shouldn't require a recheck either by developers or security teams, which is key to DevOps workflow.

Security tools should help developers identify and prioritize vulnerabilities while writing the code. Identification of vulnerabilities should be directly on the software itself and not on its signatures. Not just known vulnerabilities. Such tools should also be able to track unknown issues from anywhere such as open-source software components.

6. Implement threat modelling mechanism

It's important to implement threat modelling mechanism in the DevOps lifecycle as it helps developers view software in attacker perspective. Thus, developers will be extra careful in writing code and will be able to generate secure code.

Threat assessment also helps you identify possible vulnerabilities in your architecture and design, which might have been missed out by other security checks.

It also helps you understand the sensitivities of your internal assets and their vulnerability to possible threats.

Noteworthy is that threat modelling can often slow down the pace of your CI/CD pipeline and cannot be automated, but is a critical part of successful security integration.

6. Training on secure coding is critical

Experts believe that developers across many firms don't realize the fact that they are coding the insecure way.

Considering this fact, it's important to make a note of training developers on ways to deliver secure code. This happens to be one of the serious challenges to successful implementation of DevSecOps practices.

This might not have been a priority to developer teams until now, as they focus on coding. But achieving security in DevOps culture demands the requirement of making developers aware of security-related facts.

Firms need to take necessary measures and making needed investment on this area of training on secure coding for a succesful DevSecOps implementation.

Implementation of these six practices form key to the success of DevSecOps implementation and security challenge in a DevOps culture.

Sai Nikesh D is a Senior Strategy Content Writer at the Veritis Group
Share this

Industry News

July 01, 2020

JFrog announced the launch of ChartCenter, a free, security-focused central repository of Helm charts for the community.

July 01, 2020

Kong announced a significant upgrade to open source Kuma, Kuma 0.6, available today.

July 01, 2020

Compuware Corporation, a BMC company, announced new capabilities that further automate and integrate test data and test case execution, empowering IT teams to achieve high-performance application development quality, velocity and efficiency.

June 30, 2020

Couchbase announced the general availability of Couchbase Cloud, a fully-managed Database-as-a-Service (DBaaS).

June 30, 2020

Split Software announced new capabilities designed to accelerate the adoption of feature flags in large-scale organizations.

June 30, 2020

WhiteHat Security announced a discounted Web + Mobile Application Security bundle to help organizations secure the digital future.

June 29, 2020

Puppet introduced the public beta availability of Relay, an event-driven automation platform.

June 29, 2020

D2iQ introduced KUDO for Kubeflow to simplify and accelerate machine learning (ML) deployments on Kubernetes.

June 29, 2020

Codefresh announced $27M in new funding led by Red Dot Capital Partners.

June 25, 2020

Micro Focus announced the general availability of Visual COBOL 6.0 and Enterprise Suite 6.0, providing versatile application, process and infrastructure modernization solutions for today’s enterprise developer.

June 25, 2020

SaltStack announced new features available in SaltStack Enterprise 6.3 that integrate best-of-breed IT monitoring and vulnerability management solutions, including Splunk, Tenable, Qualys, Rapid7, and Kenna Security.

June 25, 2020

Keysight Technologies has completed the acquisition of Eggplant from The Carlyle Group.

June 24, 2020

JFrog unveiled new capabilities to address the growing problem of software distribution bottlenecks. The newly introduced CDN-based and Peer-to-Peer software package distribution mechanisms empower companies to overcome the challenge of frequently delivering large volumes of artifacts to internal teams and external clients.

June 24, 2020

Copado announced its Summer 20 release to accelerate, optimize and measure innovation delivery on the Salesforce platform.

June 24, 2020

Bugsnag launched Stability Center, a centralized location that offers a holistic view into stability stats and trends across releases for multiple client and server-side applications.