DevSecOps Best Practices and Business Value - Part 1
June 24, 2020

Aliaksei Kulik
Exadel

DevSecOps brings together the best of DevOps with modern security practices. DevOps streamlines and accelerates the product development lifecycle, aiming to automate as much as possible. DevSecOps maintains this automation focus and incorporates security — with a goal of making each step secure and bringing in new tools and practices to make the entire product more secure as well.

With automation practices becoming more ingrained in software delivery processes, it is essential to integrate security. Leaving security as an afterthought could be very costly for a business and its customers. We've all read the headlines related to fines, reimbursement, and lost business that comes when a large company is compromised or breached.

Considering security separately from other DevOps processes can also lead to delays in the delivery of product features, because vulnerabilities must be assessed separately. These delays run counter to the goals and promises of most DevOps groups and organizations.

For example, if a large enterprise processes a large quantity of user data and stores that sensitive data on databases, it is critical to make sure early on that this kind of information can't be hacked. If hackers are able to take total system control and start to exploit the system's vulnerability by gaining access to the servers, this could lead not only to data loss but also to a large expenditure and fines.

That's why it is important to not only pay attention to product delivery automation and speed but also to add security to software updates, critical system vulnerabilities, and correct system access control, which DevSecOps practices assist with.

This 2-part blog will focus on some established and emerging ways that DevSecOps plays a role in product delivery organizations.

DevSecOps Business Value

Applying DevSecOps practices to product delivery has a positive impact on business in the following ways:

1. Ensuring the payoff of automation — by including security testing, it makes sure that vulnerability testing doesn't become a separate process that slows down feature delivery.

2. Avoiding System Compromise — utilizing all the tools in the DevSecOps handbook, makes an attack or compromise less likely. This limits the business' exposure and keeps customers happy.

3. Fast Reaction — when an incident does happen, having the appropriate monitoring in place helps to react quickly and address problems proactively, thereby reducing the risk of a catastrophic incident and helping prevent exposure of critical data.

DevSecOps can also assist with corporate compliance. If a company has sensitive data, it probably falls under some type of compliance structure. PCI-DSS, GDPR and HIPAA were all created to protect important data of various system users. PCI-DSS compliance, in the financial sector, ensures sensitive data security and system non-vulnerability for systems that need to store or use cardholder data. If the organization has non-compliant systems or code, it can be penalized, which can be quite financially painful and potentially lead to a loss of customers.

The General Data Protection Regulation (GDPR), a European privacy regulation issued in 2018, guarantees personal data protection. Before it, any internet resource could save personal data and organizations were not required to delete or manage this data. This could be true, even long after a user ceased using a system. Users also didn't have the right to request that their data be deleted.

Now, the GDPR obliges organizations, upon the user's request, to delete personal and other data from their storage systems. If the organization doesn't do this, it can be subject to substantial penalties. Applying DevSecOps practices can help organizations escape challenges with personal data security, which will ultimately help to decrease reputational and financial risks.

As DevSecOps practices are being implemented by enterprises of all sizes and industries. Baking security into every step of the delivery process is key for reducing costs in the long term and keeping happy, and safe, customers.

Go to DevSecOps Best Practices and Business Value - Part 2, providing DevSecOps best practices.

Aliaksei Kulik is a Senior DevOps Engineer at Exadel
Share this

Industry News

January 26, 2023

Ubuntu Pro, Canonical’s comprehensive subscription for secure open source and compliance, is now generally available.

January 26, 2023

Mirantis, freeing developers to create their most valuable code, today announced that it has acquired the Santa Clara, California-based Shipa to add automated application discovery, operations, security, and observability to the Lens Kubernetes Platform.

January 25, 2023

SmartBear has integrated the powerful contract testing capabilities of PactFlow with SwaggerHub.

January 25, 2023

Venafi introduced TLS Protect for Kubernetes.

January 25, 2023

Tricentis announced the general availability of Tricentis Test Automation, a cloud-based test automation solution that simplifies test creation, orchestration, and scalable test execution for easier collaboration among QA teams and their business stakeholders and faster, higher-quality, and more durable releases of web-based applications and business processes.

January 24, 2023

Harness announced the acquisition of Propelo.

January 23, 2023

Couchbase announced its Couchbase Capella Database-as-a-Service (DBaaS) offering on Azure.

January 23, 2023

Mendix and Software Improvement Group (SIG) have announced the release of Mendix Quality & Security Management (QSM), a new cybersecurity solution that provides continuous deep-dive insights into security and code quality to immediately address risks and vulnerabilities.

January 23, 2023

Trunk announces the public launch of CI Analytics.

January 23, 2023

Panaya announced a new Partnership Program in response to ongoing growth within its partner network over the past year.

January 23, 2023

Cloudian closed $60 million in new funding, bringing the company’s total funding to $233 million.

January 19, 2023

Progress announced the R1 2023 release of Progress Telerik and Progress Kendo UI.

January 19, 2023

Wallarm announced the early release of the Wallarm API Leak Management solution, an enhanced API security technology designed to help organizations identify and remediate attacks exploiting leaked API keys and secrets, while providing on-going protection against hacks in the event of a leak.

January 19, 2023

ThreatModeler launched Threat Model Marketplace, a cybersecurity asset marketplace offering pre-built, field-tested threat models to be downloaded — free for a limited time — and incorporated into new and ongoing threat modeling initiatives.

January 18, 2023

Software AG has launched new updates to its webMethods platform that will simplify the process by which developers can find, work on and deploy new APIs and integration tools or capabilities.