A Language to Speak Dev[Sec]Ops
April 23, 2020

Chetan Conikee

From SecOps to DevSecOps and SecDevOps, there seems to be an unending stream of new buzzwords in systems technology. With all this jargon, increasingly stories can read more like inside baseball rather than an intentional strategy.

To understand insertion of "Security" into "‘DevOps", we need to reminisce about the origins of term "DevOps". Fredric Paul of New Relic did a phenomenal job of mapping events leading to the inception of this popular term.

To appreciate DevOps, we need to deconstruct the language structure used by it's practitioners. In order to do this let's briefly detour to Denis Villeneuve's sci-fi space-encounter movie called Arrival where the primary protagonist is a linguistics professor who goes by the name Dr. Banks.

The four important concepts from linguistics that help Dr. Banks decode the language of heptapods (aka the alien ship) are

1. Discreteness
It might seem that the most important question to focus on when trying to analyze an unknown language is "what does this mean?" For a linguist, however, the most important question is "what are the units?" This is not because meaning is not useful, but because, while you can have meaning without language, you cannot have language without units.

2. The Swadesh List
A good field linguist knows you can't just jump to abstract concepts like purpose without establishing the basics first.
But what are the basics? A list of basic concepts first put together in the 1950s by linguist Morris Swadesh.
They include concepts like I and you, one and many, as well as objects and actions in the observable world like person, blood, fire, eat, sleep, and walk.

3. Minimal Pairs
A minimal pair is a pair of words that differ in meaning because one sound has changed. The existence of a minimal pair shows that the differing sound is a crucial element of the language's structure.

4. The Sapir-Whorf Hypothesis
Most simply explained as the idea that the language you speak influences the way you think. This idea is controversial, since it has been demonstrated that languages do not restrict or constrain what people are able to perceive.

In order to rationalize these concepts from a systems engineering standpoint, we would need to pay homage to the linguists of "DevOps".

1993 — Yukihiro "Matz" creates Ruby

Ruby was born in 1993, conceived in a discussion between Yukihiro Matsumoto ("Matz") and a colleague. They were discussing the possibility of an object-oriented scripting-language. Matz stated in ruby-talk:00382 that he knew Perl, but did not like it very much; that it had the smell of a "toy" language. He also discussed that he knew Python, but didn't like it because it wasn't a true object-oriented programming language. Having looked around and not found a language suited for him, Yukihiro Matsumoto decided to create his own. After spending several months writing an interpreter, Matz finally published the first public version of Ruby (0.95) to various Japanese domestic newsgroups in December, 1995

2005 — Luke Kanies creates Puppet using Ruby

Google and Amazon have long used software that automatically configures swathe of machines driving their online services. But these tools were never available to the outside world.

In 2005, Luke Kanies set out to provide Google-like IT automation for the rest of us, founding an open source project he called Puppet.

2007 — Jesse Robbins creates Chef using Ruby

Two years later, he had some competition from the man once known as Amazon's "Master of Disaster." Jesse Robbins came by the name not because he broke things, but because he fixed them. He oversaw the operation of all Amazon websites. His new venture, Opscode, grew up around an open source project called Chef.

What is the Common Strand Between These Linguists?

"Matz" created Ruby, Luke (Puppet) and Jessie (Chef) used Ruby's meta-programming constructs to reason about systems, leading to inception of Puppet and Chef respectively.

Like Dr. banks, Luke and Jessie applied —

Discreteness to reason about creating and orchestrating system units (host, storage, network, compute), The Swadesh List and Minimal Pairs to create basic concepts (provision host with compute capacity, attach storage and then network to other hosts), and The Sapir-Whorf Hypothesis leading to formation, provisioning and de-provisioning of cloud networks.

DevOps teams that deploy software are also responsible for maintaining security by design. In practice, though, teams too often neglect security or paste it on at the last moment. Thus, the idea to build security in from the start — via a process known as Dev[Sec]Ops — was born.

As J. Wolfgang Goerlich, a cybersecurity strategist at Creative Breakthroughs Inc., states roughly one in four DevOps teams integrate and automate some level of security controls. "This integration is generally performing scans and checks against the static code, the application and the underlying environment composition."

But this level of automation often requires tuning and adjustments to ensure it keeps pace with DevOps. For example, he said, traditional code-level scans take several days. "That's not effective when DevOps is changing the code on a daily or even hourly basis," Goerlich said.

Effective Dev[Sec]Ops teams secure without slowing, and they add continuous security without exceeding the team's capacity to change, he said. "It's paradoxically fast and slow, with security controls being added slowly while tuned to execute very quickly."

Inserting Security in CI/CD is beginning to look more like a Rube Goldberg Machine

It's time for us to hit the reset button and approach security from a linguist standpoint. Learning from our devops predecessors, we need to create a simple language that influences each step in CI/CD without compromising its velocity.

How can we apply these concepts of linguistics to define security of an application?

We at ShiftLeft are attempting to define — Discreteness to reason about application security units (inputs, outputs, flows, data and open source used), The Swadesh List to create basic concepts (understand a flow from an input connected to one or more outputs, with data initialized in scope, using an open source library), Minimal Pairs to represent how a flow treats sensitive data and The Sapir-Whorf Hypothesis leading to define security from the perspective of connected application topology.

*Credits to Arika Okrent, linguist and author of In the Land of Invented Languages

Chetan Conikee is Founder and CTO of ShiftLeft
Share this

Industry News

April 18, 2024

SmartBear announced a new version of its API design and documentation tool, SwaggerHub, integrating Stoplight’s API open source tools.

April 18, 2024

Red Hat announced updates to Red Hat Trusted Software Supply Chain.

April 18, 2024

Tricentis announced the latest update to the company’s AI offerings with the launch of Tricentis Copilot, a suite of solutions leveraging generative AI to enhance productivity throughout the entire testing lifecycle.

April 17, 2024

CIQ launched fully supported, upstream stable kernels for Rocky Linux via the CIQ Enterprise Linux Platform, providing enhanced performance, hardware compatibility and security.

April 17, 2024

Redgate launched an enterprise version of its database monitoring tool, providing a range of new features to address the challenges of scale and complexity faced by larger organizations.

April 17, 2024

Snyk announced the expansion of its current partnership with Google Cloud to advance secure code generated by Google Cloud’s generative-AI-powered collaborator service, Gemini Code Assist.

April 16, 2024

Kong announced the commercial availability of Kong Konnect Dedicated Cloud Gateways on Amazon Web Services (AWS).

April 16, 2024

Pegasystems announced the general availability of Pega Infinity ’24.1™.

April 16, 2024

Sylabs announces the launch of a new certification focusing on the Singularity container platform.

April 15, 2024

OpenText™ announced Cloud Editions (CE) 24.2, including OpenText DevOps Cloud and OpenText™ DevOps Aviator.

April 15, 2024

Postman announced its acquisition of Orbit, the community growth platform for developer companies.

April 11, 2024

Check Point® Software Technologies Ltd. announced new email security features that enhance its Check Point Harmony Email & Collaboration portfolio: Patented unified quarantine, DMARC monitoring, archiving, and Smart Banners.

April 11, 2024

Automation Anywhere announced an expanded partnership with Google Cloud to leverage the combined power of generative AI and its own specialized, generative AI automation models to give companies a powerful solution to optimize and transform their business.

April 11, 2024

Jetic announced the release of Jetlets, a low-code and no-code block template, that allows users to easily build any technically advanced integration use case, typically not covered by alternative integration platforms.

April 10, 2024

Progress announced new powerful capabilities and enhancements in the latest release of Progress® Sitefinity®.