It is time to adopt a security-focused approach to DevOps, one that integrates the security alarm bells and whistles into the flair and speed of development without the traditional frictions and complexities.
A survey undertaken by ESG found that 68% of respondents were considering adopting developer-focused security solutions and shifting security to developers.
This is a good thing. As good a thing as DevOps itself – an approach that Forrester describes as one that ‘consistently reduces time to market, increases enterprise agility, and makes businesses more resilient.’
It’s also why the research firm believes that one of the key areas in which DevOps will evolve is in the evolution of practices. Replacing processes will see security and risk personnel shifting to the left and joining projects at the start, rather than wedged into the middle or the end.
It’s a view shared by Mandla Mbonambi, CEO of Africonology, who believes that the shift to the left has become as important and essential to the success of a DevOps project as the expertise and capabilities of the teams themselves.
“Security threats are evolving at such a rapid pace that organisations have to embed intense agility into their operations and development processes to keep up and stay secure,” he says.
“Developers need to do more than just include security into their systems, they have to embrace security within their own best practices and processes. This moves the DevOps approach to security, away from a ‘fill the gaps at the end’ mentality and towards a more robust and resilient one.”
Forrester believes that this transformation of mindset and strategy can fundamentally determine the success of an organisation in the future. The firm says that high-performing companies will be those which implement code-based change management empowered by technology and security and that put security and development on the same tier.
It’s not an unrealistic ideal, either. The ESG survey found that most security teams are comfortable with developers taking on security testing with the biggest concern being that this could put undue pressure on development teams.
“There is a risk that by putting security into the development space, companies feel that they are saving money by incorporating the two without giving the development teams the time or resources they need to do both roles effectively,” says Mbonambi. “This could then potentially open up solutions and the business to even greater risk as neither the development nor the security is given the attention to detail they need. Speed to market is a very real pressure and teams can end up compromising when there shouldn’t be any compromise at all.”
It’s not worth the compromise either. The European Cybersecurity Agency (ENISA) annual report of the threat landscape in 2022 reinforced the concerns that organisations and DevOps teams share when it comes to security risks.
The report identified eight primary threat categories across ransomware, malware, social engineering, threats against data, denial of service (DDoS), internet threats, disinformation-misinformation, and supply chain attacks and emphasised how denial of service, zero-day exploits, and phishing have grown in both sophistication and use case. The latter has evolved into spear-phishing, whaling, smishing and vishing, while DDoS attacks have become more complex at a greater scale.
The ESG survey found that 38% of organisations had lost data due to the insecure use of APIs, and 37% had suffered an exploit as a result of vulnerabilities in internal code. This adds to 35% with services compromised due to account credentials, and 34% who had their systems exploited due to vulnerabilities in open-source software. The list does go on – the reality is that security remains a consistent and persistent priority.
“Ultimately, there shouldn’t be a trade-off when it comes to security in DevOps or development in security,” concludes Mbonambi. “Give your teams the best possible support at every point, be it security, operations or development, and ensure that they have the resources and time they need to architect solutions that are resilient and secure. This will not only embed a level of robustness into your business and your services, but it will save you money and time in the long term. Consider using an outsourced, third-party service provider to bolster your teams and to ensure that deadlines are met without compromise.”