Making the Shift for a Complete Security Approach
November 18, 2019

Dan Hubbard
Lacework

In today's development lifecycle, fast, reliable and efficient define the model. DevOps is the driving force behind efficient software development as DevOps teams are now both reflecting and defining business models as they operate in a continuous cycle of development, integration, deployment and innovation. This coordination allows not only for organizations to be far more responsive, but also for speed to define the operations and data that function in runtime.

Microservices, container orchestration, virtualized machines; these and other tools have created an entire industry to support the fast, continuous development approach. But while efficiency and speed bring competitive advantages, something is still missing: security. With the luxury of speeds comes the by-product of overly pushed data during the development phase. This opens the question of which is more important — speed or security?

The reality is that while we all strive for fast and efficient solutions; the integrity and security of the work are compromised. The lack of coordination witnessed in recent cyber-attacks calls attention to the differing ideals of SecOps and DevOps teams.

In an attempt to merge these seemingly conflicting efforts, let's look at just a few of the latest security approaches and how to encompass the process of shifting left in order to apply concepts of security during the development and delivery stage.

Track Vulnerabilities vs. Being Vulnerable

Tracking vulnerabilities is a no-brainer but what you really want to know is how you have become vulnerable in the first place. This means you need to combine the latest vulnerabilities with your risk and exposures in your infrastructure. If you have a vulnerability that is open to the world that is a lot different than one that is sitting pre-deploy in your image repository.

As the lines between development and runtime overlap more and more, and because there is such a heavy reliance on the speed and output coming from DevOps, security has to operate at every point where data is created, transacted, integrated, and applied. Anything pushed into production that has a vulnerability creates the potential for a security issue later. Catching it while it's being created delivers demonstrable value because it reduces the burden on security operations teams and increases the availability of services.

What's needed is a complete approach not just a "unified" approach. Instead of pulling together functionality from various sources of IP, you can instead apply already underlying technologies to extend the security visibility and detection capabilities across everything an organization's infrastructure and data touch.

A Complete Security Approach

By extending security to the left side of the application continuum, developers participate in their organization's security approach; automation gives them the ability to actively contribute to effective security without placing constraints on speed or agility. The result is an organization-wide approach to the security and compliance of data and operations. This means:

Development teams can deploy services that have been developed with the discipline of security automatically embedded in their innate processes. Using the visibility and threat detection of a security platform, they can identify unexpected risks and threats much earlier in the development cycle. This also provides them with a greater understanding of where issues happen so they can create processes that eliminate them in the future. DevOps teams can rely on built-in security protections that are already blessed by the organization, which accelerates their development cycles.

Security teams will learn more from the results of anomaly detection and will benefit from continuous security and compliance in a way that gets them out of reactive mode and takes more control over DevOps and other IT operations. With some organizations pushing increasingly massive numbers of fixes and changes into production every day, security has to provide a way to monitor, detect, and alert. Complete, continuous security and compliance delivered with automation is the most effective way to do this.

Business teams are ultimately the biggest beneficiary of this modern approach. The dev process is accelerated, quality is improved, and compliance is monitored and addressed before it becomes a problem. Rather than accepting the inherent tension between DevOps and security teams, the business benefits from faster delivery, more security production, and an established place in their respective market.

By using a security approach that is complete and has been designed specifically to meet the challenges of public cloud environments in both build-time and run-time operations, organizations can take advantage of a security-first model that enables continuous visibility, automation, and the ability to move fast. This will not only strengthen security, but it will also provide compliance and DevOps teams with the tools and processes they need to successfully meet the requirements of the cloud era.

Dan Hubbard is CEO of Lacework
Share this

Industry News

May 19, 2022

Jellyfish announced the launch of Jellyfish Benchmarks, a way to add context around engineering metrics and performance by introducing a method for comparison.

May 19, 2022

Solo.io announced the addition and integration of Cilium networking into its Gloo Mesh platform, providing a complete application-networking solution for companies’ cloud-native digital transformation efforts.

May 19, 2022

Aqua Security announced multiple updates to Aqua Trivy, making it a unified scanner for cloud native security.

May 18, 2022

Red Hat unveiled updates across its portfolio of developer tools designed to help organizations build and deliver applications faster and more consistently across Kubernetes-based hybrid and multicloud environments.

May 18, 2022

Armory announced public early access to their new Continuous Deployment-as-a-Service product.

May 18, 2022

DataCore Software announced DataCore Bolt, enterprise-grade container-native storage software for DevOps.

May 17, 2022

DevOps Institute, a global professional association for advancing the human elements of DevOps, announced the release of the Upskilling IT 2022 report.

May 17, 2022

Replicated announced a host of new platform features and capabilities that enable their customers to accelerate enterprise adoption of their Kubernetes applications.

May 17, 2022

Codefresh announced that its flagship continuous delivery (CD) platform will be made accessible as a fully-hosted solution for DevOps teams seeking to quickly and easily achieve frictionless, GitOps-based continuous software delivery in the cloud.

May 16, 2022

Red Hat announced new capabilities and enhancements across its portfolio of open hybrid cloud solutions aimed at accelerating enterprise adoption of edge compute architectures through the Red Hat Edge initiative.

May 16, 2022

D2iQ announced a partnership with GitLab.

May 16, 2022

Kasten by Veeam announced the new Kasten by Veeam K10 V5.0 Kubernetes data management platform.

May 12, 2022

Red Hat introduced Red Hat Enterprise Linux 9, the Linux operating system designed to drive more consistent innovation across the open hybrid cloud, from bare metal servers to cloud providers and the farthest edge of enterprise networks.

May 12, 2022

Couchbase announced version 7.1 of Couchbase Server.

May 12, 2022

Copado added Copado Robotic Testing to Copado Essentials.