Making the Shift for a Complete Security Approach
November 18, 2019

Dan Hubbard
Lacework

In today's development lifecycle, fast, reliable and efficient define the model. DevOps is the driving force behind efficient software development as DevOps teams are now both reflecting and defining business models as they operate in a continuous cycle of development, integration, deployment and innovation. This coordination allows not only for organizations to be far more responsive, but also for speed to define the operations and data that function in runtime.

Microservices, container orchestration, virtualized machines; these and other tools have created an entire industry to support the fast, continuous development approach. But while efficiency and speed bring competitive advantages, something is still missing: security. With the luxury of speeds comes the by-product of overly pushed data during the development phase. This opens the question of which is more important — speed or security?

The reality is that while we all strive for fast and efficient solutions; the integrity and security of the work are compromised. The lack of coordination witnessed in recent cyber-attacks calls attention to the differing ideals of SecOps and DevOps teams.

In an attempt to merge these seemingly conflicting efforts, let's look at just a few of the latest security approaches and how to encompass the process of shifting left in order to apply concepts of security during the development and delivery stage.

Track Vulnerabilities vs. Being Vulnerable

Tracking vulnerabilities is a no-brainer but what you really want to know is how you have become vulnerable in the first place. This means you need to combine the latest vulnerabilities with your risk and exposures in your infrastructure. If you have a vulnerability that is open to the world that is a lot different than one that is sitting pre-deploy in your image repository.

As the lines between development and runtime overlap more and more, and because there is such a heavy reliance on the speed and output coming from DevOps, security has to operate at every point where data is created, transacted, integrated, and applied. Anything pushed into production that has a vulnerability creates the potential for a security issue later. Catching it while it's being created delivers demonstrable value because it reduces the burden on security operations teams and increases the availability of services.

What's needed is a complete approach not just a "unified" approach. Instead of pulling together functionality from various sources of IP, you can instead apply already underlying technologies to extend the security visibility and detection capabilities across everything an organization's infrastructure and data touch.

A Complete Security Approach

By extending security to the left side of the application continuum, developers participate in their organization's security approach; automation gives them the ability to actively contribute to effective security without placing constraints on speed or agility. The result is an organization-wide approach to the security and compliance of data and operations. This means:

Development teams can deploy services that have been developed with the discipline of security automatically embedded in their innate processes. Using the visibility and threat detection of a security platform, they can identify unexpected risks and threats much earlier in the development cycle. This also provides them with a greater understanding of where issues happen so they can create processes that eliminate them in the future. DevOps teams can rely on built-in security protections that are already blessed by the organization, which accelerates their development cycles.

Security teams will learn more from the results of anomaly detection and will benefit from continuous security and compliance in a way that gets them out of reactive mode and takes more control over DevOps and other IT operations. With some organizations pushing increasingly massive numbers of fixes and changes into production every day, security has to provide a way to monitor, detect, and alert. Complete, continuous security and compliance delivered with automation is the most effective way to do this.

Business teams are ultimately the biggest beneficiary of this modern approach. The dev process is accelerated, quality is improved, and compliance is monitored and addressed before it becomes a problem. Rather than accepting the inherent tension between DevOps and security teams, the business benefits from faster delivery, more security production, and an established place in their respective market.

By using a security approach that is complete and has been designed specifically to meet the challenges of public cloud environments in both build-time and run-time operations, organizations can take advantage of a security-first model that enables continuous visibility, automation, and the ability to move fast. This will not only strengthen security, but it will also provide compliance and DevOps teams with the tools and processes they need to successfully meet the requirements of the cloud era.

Dan Hubbard is CEO of Lacework
Share this

Industry News

June 22, 2021

Red Hat announced new end-to-end Kubernetes-native decision management capabilities as part of the latest release of Red Hat Process Automation.

June 22, 2021

GitLab announces the next iteration of its single application with its 14 release.

June 22, 2021

Transposit introduced new platform capabilities which are developer-friendly, but built for all.

June 22, 2021

Plutora transitioned to an expanded data-centric platform, added additional metrics to monitor and manage value stream flow, and deepened its integrations with Agile planning tools.

June 22, 2021

Opsera announces its native Salesforce CI/CD release automation functionality.

June 21, 2021

Render announced the general availability of autoscaling.

June 21, 2021

Grafana Labs acquired k6, the Stockholm-based startup behind the open source load testing tool for engineering teams.

June 17, 2021

Bitrise announced the release of its new enterprise-grade Mobile DevOps platform.

June 17, 2021

Perforce Software announces a partnership with Microsoft to deliver the free Enhanced Studio Pack, providing development tools in a click-to-start model on the Azure cloud.

June 17, 2021

Tigera announced the availability of Calico Cloud in the Microsoft Azure Marketplace.

June 16, 2021

Red Hat announced the general availability of Red Hat’s migration toolkit for virtualization to help organizations accelerate open hybrid cloud strategies by making it easier to migrate existing workloads to modern infrastructure in a streamlined, wholesale manner.

June 16, 2021

BrowserStack announced it has secured $200 million in Series B funding at a $4 billion valuation.

June 16, 2021

Harness announced significant platform updates that address gaps in today's developer and DevOps market.

June 15, 2021

Broadcom announced new capabilities for Value Stream Management (VSM) in its ValueOps software portfolio, seamlessly combining the proven investment planning features of Clarity™ with the advanced Agile management capabilities of Rally® software.

June 15, 2021

Copado announced its Summer 21 Release, opening up its platform for true multi-cloud DevOps for enterprise SaaS and low-code development.