DevSecOps Best Practices and Business Value - Part 1
June 24, 2020

Aliaksei Kulik
Exadel

DevSecOps brings together the best of DevOps with modern security practices. DevOps streamlines and accelerates the product development lifecycle, aiming to automate as much as possible. DevSecOps maintains this automation focus and incorporates security — with a goal of making each step secure and bringing in new tools and practices to make the entire product more secure as well.

With automation practices becoming more ingrained in software delivery processes, it is essential to integrate security. Leaving security as an afterthought could be very costly for a business and its customers. We've all read the headlines related to fines, reimbursement, and lost business that comes when a large company is compromised or breached.

Considering security separately from other DevOps processes can also lead to delays in the delivery of product features, because vulnerabilities must be assessed separately. These delays run counter to the goals and promises of most DevOps groups and organizations.

For example, if a large enterprise processes a large quantity of user data and stores that sensitive data on databases, it is critical to make sure early on that this kind of information can't be hacked. If hackers are able to take total system control and start to exploit the system's vulnerability by gaining access to the servers, this could lead not only to data loss but also to a large expenditure and fines.

That's why it is important to not only pay attention to product delivery automation and speed but also to add security to software updates, critical system vulnerabilities, and correct system access control, which DevSecOps practices assist with.

This 2-part blog will focus on some established and emerging ways that DevSecOps plays a role in product delivery organizations.

DevSecOps Business Value

Applying DevSecOps practices to product delivery has a positive impact on business in the following ways:

1. Ensuring the payoff of automation — by including security testing, it makes sure that vulnerability testing doesn't become a separate process that slows down feature delivery.

2. Avoiding System Compromise — utilizing all the tools in the DevSecOps handbook, makes an attack or compromise less likely. This limits the business' exposure and keeps customers happy.

3. Fast Reaction — when an incident does happen, having the appropriate monitoring in place helps to react quickly and address problems proactively, thereby reducing the risk of a catastrophic incident and helping prevent exposure of critical data.

DevSecOps can also assist with corporate compliance. If a company has sensitive data, it probably falls under some type of compliance structure. PCI-DSS, GDPR and HIPAA were all created to protect important data of various system users. PCI-DSS compliance, in the financial sector, ensures sensitive data security and system non-vulnerability for systems that need to store or use cardholder data. If the organization has non-compliant systems or code, it can be penalized, which can be quite financially painful and potentially lead to a loss of customers.

The General Data Protection Regulation (GDPR), a European privacy regulation issued in 2018, guarantees personal data protection. Before it, any internet resource could save personal data and organizations were not required to delete or manage this data. This could be true, even long after a user ceased using a system. Users also didn't have the right to request that their data be deleted.

Now, the GDPR obliges organizations, upon the user's request, to delete personal and other data from their storage systems. If the organization doesn't do this, it can be subject to substantial penalties. Applying DevSecOps practices can help organizations escape challenges with personal data security, which will ultimately help to decrease reputational and financial risks.

As DevSecOps practices are being implemented by enterprises of all sizes and industries. Baking security into every step of the delivery process is key for reducing costs in the long term and keeping happy, and safe, customers.

Go to DevSecOps Best Practices and Business Value - Part 2, providing DevSecOps best practices.

Aliaksei Kulik is a Senior DevOps Engineer at Exadel
Share this

Industry News

October 20, 2021

SonarSource added over 5,000 customers in the last 12 months, reaching the 15,000 commercial customers milestone in record time.

October 20, 2021

Actian announced the general availability of its newly released DataConnect 12 integration platform, demonstrating a continued focus on ease of use for complex data integration and data quality.

October 20, 2021

Salt Security announced new capabilities in its next-generation Salt Security API Protection Platform to secure GraphQL APIs.

October 20, 2021

vFunction announces the availability of the vFunction Application Transformation Engine and the expanded vFunction Modernization Platform, with new, advanced capabilities that enable enterprises to automatically assess, analyze, and manage the full modernization and migration process from start to finish.

October 20, 2021

Mage raised a $6.3 million seed round led by Gradient Ventures.

October 19, 2021

Couchbase announced its Couchbase Capella hosted Database-as-a-Service (DBaaS) offering on Amazon Web Services (AWS).

October 19, 2021

Checkmarx announced the launch of the Checkmarx Application Security Platform to help CISOs, AppSec teams, and developers address the growing and dynamic security challenges they face.

October 19, 2021

Tasktop announced Affinity Modeling for model-based integration in Tasktop Hub, helping Agile and DevOps software delivery teams reduce time to market and develop software faster.

October 19, 2021

Morpheus Data is continuing released version 5.3.3 targeted at enterprises trying to manage a complex mix of VMware, Kubernetes, and Public Cloud services.

October 19, 2021

Okta announced the availability of Okta Workflows as a standalone offering for all customers.

October 18, 2021

Red Hat announced a series of updates in its portfolio of developer tools and programs aimed at delivering greater productivity, security and scale for developers building applications on Red Hat OpenShift.

October 18, 2021

Pulumi released a public Registry that enables developers and infrastructure teams to apply “share and reuse” software principles to the modern cloud.

October 18, 2021

Fugue announced support for Kubernetes security prior to deployment.

October 18, 2021

Sysdig announced the addition of cloud security monitoring functionality to the Falco open source software project.

October 14, 2021

Red Hat announced the general availability of Red Hat OpenStack Platform 16.2, the latest version of its highly-scalable and agile cloud Infrastructure-as-a-Service (IaaS) platform.