A Language to Speak Dev[Sec]Ops
April 23, 2020

Chetan Conikee
ShiftLeft

From SecOps to DevSecOps and SecDevOps, there seems to be an unending stream of new buzzwords in systems technology. With all this jargon, increasingly stories can read more like inside baseball rather than an intentional strategy.

To understand insertion of "Security" into "‘DevOps", we need to reminisce about the origins of term "DevOps". Fredric Paul of New Relic did a phenomenal job of mapping events leading to the inception of this popular term.

To appreciate DevOps, we need to deconstruct the language structure used by it's practitioners. In order to do this let's briefly detour to Denis Villeneuve's sci-fi space-encounter movie called Arrival where the primary protagonist is a linguistics professor who goes by the name Dr. Banks.

The four important concepts from linguistics that help Dr. Banks decode the language of heptapods (aka the alien ship) are

1. Discreteness
It might seem that the most important question to focus on when trying to analyze an unknown language is "what does this mean?" For a linguist, however, the most important question is "what are the units?" This is not because meaning is not useful, but because, while you can have meaning without language, you cannot have language without units.

2. The Swadesh List
A good field linguist knows you can't just jump to abstract concepts like purpose without establishing the basics first.
But what are the basics? A list of basic concepts first put together in the 1950s by linguist Morris Swadesh.
They include concepts like I and you, one and many, as well as objects and actions in the observable world like person, blood, fire, eat, sleep, and walk.

3. Minimal Pairs
A minimal pair is a pair of words that differ in meaning because one sound has changed. The existence of a minimal pair shows that the differing sound is a crucial element of the language's structure.

4. The Sapir-Whorf Hypothesis
Most simply explained as the idea that the language you speak influences the way you think. This idea is controversial, since it has been demonstrated that languages do not restrict or constrain what people are able to perceive.

In order to rationalize these concepts from a systems engineering standpoint, we would need to pay homage to the linguists of "DevOps".

1993 — Yukihiro "Matz" creates Ruby

Ruby was born in 1993, conceived in a discussion between Yukihiro Matsumoto ("Matz") and a colleague. They were discussing the possibility of an object-oriented scripting-language. Matz stated in ruby-talk:00382 that he knew Perl, but did not like it very much; that it had the smell of a "toy" language. He also discussed that he knew Python, but didn't like it because it wasn't a true object-oriented programming language. Having looked around and not found a language suited for him, Yukihiro Matsumoto decided to create his own. After spending several months writing an interpreter, Matz finally published the first public version of Ruby (0.95) to various Japanese domestic newsgroups in December, 1995

2005 — Luke Kanies creates Puppet using Ruby

Google and Amazon have long used software that automatically configures swathe of machines driving their online services. But these tools were never available to the outside world.

In 2005, Luke Kanies set out to provide Google-like IT automation for the rest of us, founding an open source project he called Puppet.

2007 — Jesse Robbins creates Chef using Ruby

Two years later, he had some competition from the man once known as Amazon's "Master of Disaster." Jesse Robbins came by the name not because he broke things, but because he fixed them. He oversaw the operation of all Amazon websites. His new venture, Opscode, grew up around an open source project called Chef.

What is the Common Strand Between These Linguists?

"Matz" created Ruby, Luke (Puppet) and Jessie (Chef) used Ruby's meta-programming constructs to reason about systems, leading to inception of Puppet and Chef respectively.

Like Dr. banks, Luke and Jessie applied —

Discreteness to reason about creating and orchestrating system units (host, storage, network, compute), The Swadesh List and Minimal Pairs to create basic concepts (provision host with compute capacity, attach storage and then network to other hosts), and The Sapir-Whorf Hypothesis leading to formation, provisioning and de-provisioning of cloud networks.

DevOps teams that deploy software are also responsible for maintaining security by design. In practice, though, teams too often neglect security or paste it on at the last moment. Thus, the idea to build security in from the start — via a process known as Dev[Sec]Ops — was born.

As J. Wolfgang Goerlich, a cybersecurity strategist at Creative Breakthroughs Inc., states roughly one in four DevOps teams integrate and automate some level of security controls. "This integration is generally performing scans and checks against the static code, the application and the underlying environment composition."

But this level of automation often requires tuning and adjustments to ensure it keeps pace with DevOps. For example, he said, traditional code-level scans take several days. "That's not effective when DevOps is changing the code on a daily or even hourly basis," Goerlich said.

Effective Dev[Sec]Ops teams secure without slowing, and they add continuous security without exceeding the team's capacity to change, he said. "It's paradoxically fast and slow, with security controls being added slowly while tuned to execute very quickly."

Inserting Security in CI/CD is beginning to look more like a Rube Goldberg Machine


It's time for us to hit the reset button and approach security from a linguist standpoint. Learning from our devops predecessors, we need to create a simple language that influences each step in CI/CD without compromising its velocity.


How can we apply these concepts of linguistics to define security of an application?

We at ShiftLeft are attempting to define — Discreteness to reason about application security units (inputs, outputs, flows, data and open source used), The Swadesh List to create basic concepts (understand a flow from an input connected to one or more outputs, with data initialized in scope, using an open source library), Minimal Pairs to represent how a flow treats sensitive data and The Sapir-Whorf Hypothesis leading to define security from the perspective of connected application topology.

*Credits to Arika Okrent, linguist and author of In the Land of Invented Languages

Chetan Conikee is Founder and CTO of ShiftLeft
Share this

Industry News

April 19, 2021

Harness announced end-to-end integrations with Amazon (AWS) GovCloud, Microsoft Azure, and Google Cloud Platform (GCP) to help DevOps and engineering teams perform multi-cloud software deployments.

April 19, 2021

The latest release of Redgate’s database monitoring tool, SQL Monitor, now supports Amazon EC2 and RDS, and Azure SQL Database and Azure Managed Instances as well as on-premises SQL Server.

April 19, 2021

CodeLogic announced $16 million in Series A funding.

April 15, 2021

Docker announced general availability of the Docker Desktop for Mac [Apple Silicon], enabling developers to leverage the advantages of the latest Macs powered by the M1 chip and extending the reach of their Docker collaborative application development platform to a new architecture.

April 15, 2021

Software AG announced new innovations of its webMethods platform for APIs, Integration and Microservices. With this release, companies can simplify and accelerate their digital transformation initiatives while also speeding their adoption of cloud.

April 15, 2021

Skuid, a toolkit for creating unique and adopted Salesforce experiences, introduced the Skuid Chicago release, a set of features and enhancements providing more declarative support to app designers and builders.

April 14, 2021

SmartBear has integrated TestComplete, its UI test automation tool, with BitBar, its native mobile device cloud.

April 14, 2021

Elastic announced an expanded strategic partnership with Confluent to deliver the best integrated product experience to the Apache Kafka and Elasticsearch community.

April 14, 2021

Threat Stack announced its ability to support AWS Graviton2-based instances through the Threat Stack Cloud Security Platform.

April 13, 2021

Broadcom and Google Cloud announced a strategic collaboration to accelerate innovation and strengthen cloud services integration within the core software franchises of Broadcom.

April 13, 2021

Nylas announced the launch of Components, JavaScript UI/UX solutions that allow developers to bring productivity features to market faster without needing to design front-end elements from scratch.

April 13, 2021

Perforce Software announces its new version control desktop client — Helix Sync — enabling non-coders such as artists and designers to version digital assets, with a simple drag-and-drop UI.

April 12, 2021

ShiftLeft introduced ShiftLeft CORE, a unified code security platform.

April 12, 2021

GrammaTech announced a new version of its CodeSonar SAST (static application security testing) product that helps developers build safer and more secure code without disrupting workflows.

April 12, 2021

Panaya announced a strategic partnership with Being Guided, a Salesforce Consulting Partner, specializing in the CRM and Salesforce ecosystem, to bring Panaya's ForeSight solution to a wider audience.