DevSecOps Best Practices and Business Value - Part 1
June 24, 2020

Aliaksei Kulik
Exadel

DevSecOps brings together the best of DevOps with modern security practices. DevOps streamlines and accelerates the product development lifecycle, aiming to automate as much as possible. DevSecOps maintains this automation focus and incorporates security — with a goal of making each step secure and bringing in new tools and practices to make the entire product more secure as well.

With automation practices becoming more ingrained in software delivery processes, it is essential to integrate security. Leaving security as an afterthought could be very costly for a business and its customers. We've all read the headlines related to fines, reimbursement, and lost business that comes when a large company is compromised or breached.

Considering security separately from other DevOps processes can also lead to delays in the delivery of product features, because vulnerabilities must be assessed separately. These delays run counter to the goals and promises of most DevOps groups and organizations.

For example, if a large enterprise processes a large quantity of user data and stores that sensitive data on databases, it is critical to make sure early on that this kind of information can't be hacked. If hackers are able to take total system control and start to exploit the system's vulnerability by gaining access to the servers, this could lead not only to data loss but also to a large expenditure and fines.

That's why it is important to not only pay attention to product delivery automation and speed but also to add security to software updates, critical system vulnerabilities, and correct system access control, which DevSecOps practices assist with.

This 2-part blog will focus on some established and emerging ways that DevSecOps plays a role in product delivery organizations.

DevSecOps Business Value

Applying DevSecOps practices to product delivery has a positive impact on business in the following ways:

1. Ensuring the payoff of automation — by including security testing, it makes sure that vulnerability testing doesn't become a separate process that slows down feature delivery.

2. Avoiding System Compromise — utilizing all the tools in the DevSecOps handbook, makes an attack or compromise less likely. This limits the business' exposure and keeps customers happy.

3. Fast Reaction — when an incident does happen, having the appropriate monitoring in place helps to react quickly and address problems proactively, thereby reducing the risk of a catastrophic incident and helping prevent exposure of critical data.

DevSecOps can also assist with corporate compliance. If a company has sensitive data, it probably falls under some type of compliance structure. PCI-DSS, GDPR and HIPAA were all created to protect important data of various system users. PCI-DSS compliance, in the financial sector, ensures sensitive data security and system non-vulnerability for systems that need to store or use cardholder data. If the organization has non-compliant systems or code, it can be penalized, which can be quite financially painful and potentially lead to a loss of customers.

The General Data Protection Regulation (GDPR), a European privacy regulation issued in 2018, guarantees personal data protection. Before it, any internet resource could save personal data and organizations were not required to delete or manage this data. This could be true, even long after a user ceased using a system. Users also didn't have the right to request that their data be deleted.

Now, the GDPR obliges organizations, upon the user's request, to delete personal and other data from their storage systems. If the organization doesn't do this, it can be subject to substantial penalties. Applying DevSecOps practices can help organizations escape challenges with personal data security, which will ultimately help to decrease reputational and financial risks.

As DevSecOps practices are being implemented by enterprises of all sizes and industries. Baking security into every step of the delivery process is key for reducing costs in the long term and keeping happy, and safe, customers.

Go to DevSecOps Best Practices and Business Value - Part 2, providing DevSecOps best practices.

Aliaksei Kulik is a Senior DevOps Engineer at Exadel
Share this

Industry News

October 22, 2020

Puppet announced Puppet Comply, a new product built to work with Puppet Enterprise aimed at assessing, remediating, and enforcing infrastructure configuration compliance policies at scale across traditional and cloud environments.

October 22, 2020

Harness announced two new modules: Continuous Integration Enterprise and Continuous Features.

October 22, 2020

Render announced automatic preview environments which are essential for rapid and collaborative development of modern applications.

October 21, 2020

Conducto is launching a toolkit for simplifying complex CI/CD and data science pipelines, having raised $3 million in seed funding led by Jump Capital.

October 21, 2020

Snyk Intel vulnerability database will be integrated into IBM Cloud security capabilities to enhance security for enterprise workloads.

October 21, 2020

Accurics announced $20 million across seed and series A financing raised in the past six months, with Intel Capital leading the Series A and ClearSky leading the seed.

October 20, 2020

Splunk announced the Splunk Observability Suite, the most comprehensive and powerful combination of monitoring, investigation, and troubleshooting solutions designed to help organizations become cloud-ready and accelerate their digital transformation.

October 20, 2020

Tricentis announced Vision AI, the core technology that will now power Tosca.

October 20, 2020

MuseDev has extended its code analysis platform to deliver bug reports via Github's code scanning UI.

October 20, 2020

Digital Shadows announced the ability to detect exposed access keys.

October 19, 2020

StackRox and Robin.io announced a new partnership bringing together Robin’s application-focused approach to Kubernetes data management with StackRox’s Kubernetes-native security and compliance capabilities.

October 19, 2020

PubNub announced new Chat UI Kits to streamline chat development.

October 19, 2020

Secure Code Warrior announced support for GitHub’s new code scanning functionality in conjunction with a new collaboration with Snyk.

October 15, 2020

Couchbase announced version 2.8 of Couchbase Lite and Couchbase Sync Gateway for mobile and edge computing applications.

October 15, 2020

Kong unveiled the private beta release of Kong Konnect, a full-stack platform for cloud native applications delivered as a service.