Why Speed of Deployment is Key for DevOps
October 28, 2019

Ran Ilany
Portshift

The world of tech is changing at an eye-watering rate. Whether you're in finance, marketing, manufacturing, or any other industry, your app functionality needs not only to keep up with the Joneses, but to keep ahead of them.

When you have a customer-facing app, you need to ensure that it's always updated with the newest tools and trends, offers cutting-edge features, and is perpetually responsive. If it lags behind in terms of features and functionality, that will impact on your user loyalty. Your app is used every day — you can't afford for it to go down for a few hours while you update capabilities.

Finally, your competition is always out there pushing to take advantage of any misstep you make. Speed of deployment affects your bottom line, making it one of the core DevOps metrics. Continuous integration (CI) and continuous delivery (CD) are now established principles that are standard in almost every business. The huge advantages that come with incremental, ongoing changes and deployment via Kubernetes, microservices, and containers have been proven and embedded into every business practice. While DevOps tools and practices are standard almost everywhere, there's still one DevOps tool left to go.

Security is the Speedbump in the Track of Continuous Delivery

There's just one flaw in the rapid delivery and innovation that's been enabled by DevOps, and that's security and compliance. No business can risk leaving a pathway open to hackers or missing a step in compliance, causing the app to be offline for hours or potentially days. It's a given that the faster you innovate, the greater the chances that you'll leave a vulnerability in the infrastructure, but traditional security testing processes are wholly incompatible with agile DevOps tools.

Traditional application security testing requires cumbersome, slow, and thorough one-time gating inspections. These processes take days or even weeks to complete and involve a significant number of security professionals — the antithesis to the agility, automation, and transparency that are the hallmarks of DevOps mindset. Compliance throws another monkey wrench into the fast-moving works of DevOps metrics. Some apps in specific industries need to be government-recertified after every update, seriously hampering the speed of deployment.

It's simply not practical to pause the entire CI/CD system for days at a time for an external security or compliance examination, nor can the entire process be repeated every few days, or possibly every few hours, each time the app is updated. These security testing strategies can't scale with DevOps tools, and the majority of DevOps employees lack the necessary knowledge and understanding of security to be able to carry them out.

DevSecOps is the Final Step

Not only is app security compromised when security measures are applied as a final stage at the end of development, but the core KPI of speed of deployment is undermined. The only option is to evolve business processes one step further, from DevOps to DevSecOps. Together, IT, security, and risk management professionals can adopt and support a DevOps mindset that bakes security into the very beginning of the DevOps process.

DevSecOps adapts security tools, processes, and policies into the DevOps toolchain without slowing down deployment. An integrated DevSecOps team can loop security best practices in from the very beginning of the service creation, automate them, and ensure that they progress continuously to improve through every iteration, keeping pace with the DevOps process.

Tactics like active security audits, pen testing, security unit tests, and static code analysis can and should be automated. By emulating the principles of CI/CD, we arrive at continuous security, which endlessly scans source code and imported open-source libraries to identify vulnerabilities in the smallest components of your app's development layer. DevSecOps brings security under the agile umbrella of continuous delivery, removing an obstacle to app security and a serious speedbump in the accelerating pace of deployment.

When seeking a resolution, prioritize your search on solutions that help security, development, and operational teams to overcome their silos and work together as a unified DevSecOps team in a single platform. Then, DevSecOps teams can continuously secure and protect their growing multi-cluster Kubernetes deployments without slowing it down. Also consider application security capable of replacing multiple fragmented firewalls, security groups, and ACLs with workload security that is as automated as possible and decoupled from the network infrastructure. This will enable DevSecOps teams to implement a digital identity for every workload at the CI/CD level, making it more intuitive to create security policies with fewer hassles and interruptions.

DevSecOps Brings in Security Without Slowing Down DevOps

Security is vital for all business applications, but DevOps cannot afford to slow down from its agile, continuous delivery position. DevSecOps allows and organization to unite IT, security, R&D, and operations teams for a single unified response that secures and protects continuous deployment without slowing it down. By automating workload security, the operation brings continuous security up to speed with CI and CD best practices to deliver the best of all possible worlds; speed and security in a single platform.

Ran Ilany is CEO of Portshift
Share this

Industry News

November 14, 2019

Raytheon Company is collaborating with Red Hat to develop a new, security-focused software development solution, known as DevSecOps, for enterprise environments.

November 14, 2019

Fugue has open sourced the Fugue Rego Toolkit (Fregot) to enhance the experience working with the Rego policy language.

November 14, 2019

Sysdig announced Sysdig Secure 3.0 to provide enterprises with threat prevention at runtime using Kubernetes-native Pod Security Policies (PSP).

November 13, 2019

Testim introduced the Testim Development Kit, a new way for developers to quickly create resilient tests directly in code.

November 13, 2019

Rollbar announced an error monitoring solution for Salesforce’s Apex platform.

November 13, 2019

StackRox announced version 3.0 of the StackRox Kubernetes Security Platform.

November 12, 2019

VMware announced rapid advancement of VMware Tanzu, a new portfolio of products and services designed to transform the way enterprises build, run and manage software on Kubernetes.

November 12, 2019

SmartBear released ReadyAPI 3.0. This latest release addresses the increasing requirement for organizations to consistently deliver high-quality APIs in order to meet accelerated business demands within compressed release cycles.

November 12, 2019

Aqua Security announced its expansion into cloud security posture management (CSPM) with its acquisition of CloudSploit.

November 07, 2019

To help developers increase the speed and quality of their SQL coding, enhance efficiency, and take advantage of the latest improvements in SQL Server, Redgate has released a major upgrade for its most popular tool, SQL Prompt.

November 07, 2019

CloudBees announced a partnership with Atos and VMware surrounding a solution to help customers adopt DevOps best practices at scale on Atos’ recently announced Atos Digital Hybrid Cloud (DHC) powered by VMware Tanzu and CloudBees cloud native continuous integration/continuous delivery (CI/CD) enterprise solution.

November 07, 2019

Fugue announced the release of the Fugue Best Practices Framework to help cloud engineering and security teams identify and remediate dangerous cloud resource misconfigurations that aren’t addressed by common compliance frameworks.

November 06, 2019

Red Hat and the Quarkus community announced Quarkus 1.0.

November 06, 2019

Copado announced its Winter 20 release to provide Salesforce customers the fastest path to continuous innovation.

November 06, 2019

Applause announced its new solution for AI training and testing.