{"id":29325,"date":"2019-09-26T15:57:00","date_gmt":"2019-09-26T15:57:00","guid":{"rendered":"http:\/\/49c09cc2-d8c2-419f-a8dc-303bfde1fbc4"},"modified":"2019-09-26T15:57:00","modified_gmt":"2019-09-26T15:57:00","slug":"devsecops-is-the-new-devops","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/devsecops-is-the-new-devops\/","title":{"rendered":"DevSecOps is the new DevOps"},"content":{"rendered":"

“Shifting left,” the latest buzzphrase for pushing responsibility and functionality to the beginning of the software development lifecycle, is a good idea, but more is needed — especially in DevOps situations, in which software moves through fast, and in an automated fashion. Organizations with highly integrated security practices are well ahead with DevOps as well. <\/p>\n

Hence, the increasing emphasis on expanding the DevOps term to DevSecOps — as explained in this Red Hat overview,<\/a> DevSecOps means “thinking about application and infrastructure security from the start. It also means automating some security gates to keep the DevOps workflow from slowing down.”.<\/p>\n

\"building-6th-ave-nyc-photo-by-joe-mckendrick.jpg\"<\/span> Photo: Joe McKendrick<\/span><\/p>\n

DevSecOps may seem like a dry, highly technical and siloed pursuit, but in practice, it is shaped by an open culture that seeks to deliver innovation at the rapid pace customers increasingly require. “Firms that are undergoing DevOps transformations want and need guidance on how to integrate security,” state the authors of a recent survey<\/a> released by Puppet, CircleCI and Splunk Inc.<\/p>\n

The Puppet\/CircleCI\/Splunk survey, which involved 3,000 developers and managers, validates how DevSecOps enhances the entire DevOps practice. The survey finds that teams at higher levels of DevOps practices have automated their security policies, and they involve security teams very early in the software development lifecycle — including the planning and design phases. <\/p>\n

Twenty-two percent of the firms at the highest level of security integration have reached an advanced stage of DevOps evolution, compared to only six percent of the firms with no security integration. <\/p>\n

Firms at the highest level of security integration, the survey shows, are able to deploy to production on demand at a significantly higher rate than firms at all other levels of integration – 61 percent are able to do so. Only 49 percent of organizations without integrated security can deploy on demand.  <\/p>\n

A strong DevOps culture also supports stronger security, the survey finds. This is defined as “a culture of sharing, where teams collaborate using common tools and work towards common goals; where delivery teams have strong autonomy, yet it’s relatively easy to cross organizational boundaries to get work done.” <\/p>\n

What’s the best path to DevSecOps? Cisco, a sprawling tech organization with a huge business stake in secure software delivery, has been employing DevSecOps methodologies to assess and improve the security posture across its many cloud-based outlets. In a recent post,<\/a> Steve Martino, senior vice president and chief information security officer for Cisco, shared details of his company’s journey:  <\/p>\n