{"id":27134,"date":"2019-06-11T16:00:45","date_gmt":"2019-06-11T16:00:45","guid":{"rendered":"https:\/\/www.microsoft.com\/security\/blog\/?p=89529"},"modified":"2019-06-11T16:00:45","modified_gmt":"2019-06-11T16:00:45","slug":"4-best-practices-to-help-you-integrate-security-into-devops","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/4-best-practices-to-help-you-integrate-security-into-devops\/","title":{"rendered":"4 best practices to help you integrate security into DevOps"},"content":{"rendered":"
<\/div>\n

Microsoft\u2019s transition of its corporate resources to the cloud required us to rethink how we integrate security into the agile development environment. In the old process, we often worked on 6- to 12-month development cycles for internal products. The security operations team was separate from the application development team and was responsible for ensuring that applications met security requirements. There was time to troubleshoot security between the two teams. Once we shifted to a shorter development cycle, we had to compress the new process to bake security into DevOps.<\/p>\n

Our experience has led us to adopt four best practices that guide our thinking about integrating security with DevOps:<\/p>\n

    \n
  1. Inventory your cloud resources.<\/li>\n
  2. Establish a governance structure for cloud services.<\/li>\n
  3. Give DevOps accountability for security.<\/li>\n
  4. Redefine centralized security.<\/li>\n<\/ol>\n

    This post walks you through these tenets with some advice we hope you can apply to your own organization.<\/p>\n

    Inventory your cloud resources<\/h3>\n

    Cloud subscriptions are so easy to spin up that many organizations don\u2019t have a comprehensive understanding of which teams are using which services. This makes it challenging to manage your costs and enforce security policies. If you are uncertain which services you are currently paying for, billing is good place to start.<\/p>\n

    Establish a governance structure for cloud services<\/h3>\n

    Once you understand your cloud inventory, you can begin the work of making sure your investments align with your business strategies. This may mean limiting which services your organization uses to maximize the ones that will help you meet your business goals. Then, align your organization to your cloud strategy by defining a governing structure:<\/p>\n