Embedded Advisor Weekly Brief
Be first to read the latest tech news, Industry Leader's Insights, and CIO interviews of medium and large enterprises exclusively from Embedded Advisor
Safety Should be Embedded in the Lifecycle of DevOps to be Secure
By Embedded Advisor | Thursday, May 30, 2019
DevOps has reached a tipping point in this modern age. As per Gartner Research, half of all surveyed organizations stated that they are actively using it as a model for releasing and retaining custom applications. However, many organizations expressed concerns that information security policies and teams are preventing them from achieving the agility level DevOps promises.
Digitizing and adopting Agile and DevOps practices have changed the way software is created. From the very beginning, software developed by waterfall methodology required extensive planning and was slow to deliver end products. With time, Agile overtook Waterfall, shifting the focus to shipping smaller software increments with requirements evolving through the collaborative effort of self-organizing teams and end-users.
The release cycle has shrunk to sprint boundaries of 2-3 weeks with the increased adoption of agile practices. Thus, after every few months, performing security checks increases the risk of attackers exploiting production weaknesses. If safety checks are not sufficiently automated, either the DevOps cycle will slow down, or the hygiene of safety will suffer. This phase lag can lead to insecure code that opens up vulnerabilities and weaknesses that can then be exploited by attackers.
Security teams and developers are trying to pursue conflicting goals. Developers want to steer software as quickly as possible out of the pipeline. On the other hand, security teams want developers to resolve all vulnerabilities of security before they push the software out. Both teams should function together to resolve conflicts and make sure that with a quick turnaround, well-tested software is made available.
A typical DevOps environment is based on cloud infrastructure and deployments, introducing numerous security considerations in the cloud. A simple misconfiguration error or security malpractice like credential sharing can generate unpleasant scenarios in the fast-paced DevOps pipeline. Containers come with risks of their own. Using container technologies such as Docker or Kubernetes provides the teams with exceptional productivity. Such utilities, however, can also create headaches of security. For example, containers can pose security risks without proper checks and balances, as they are not accurately scanned, for vulnerabilities.
While DevOps gains traction in the user market, security takes the frontline of customer concern. To establish secure DevOps practices, both the security implementations and operational processes should function hand in hand, balancing DevOps ROI and cyber safety needs.
