Question

SecDevOps - Over the past 5–10 years there has been a shift in product and service development to use more agile methodologies to provide more continuous delivery.

QUESTION 1:

Considering the article below: Comment on at least two (2) security concerns with a DevOps model and how these concerns can be alleviated with a strong implementation of SecDevOps considerations.

-----------------------------------------------

Agility has become an unavoidable necessity in a fast-moving technology environment, but achieving it can be a challenge for organizations and their development teams. The DevOps philosophy provides a road map; following it is not always as easy.

Even more crucial than the need to transform the development process is the need to protect against ever more sophisticated threats and attacks. But some organizations are finding that agility and security can go hand in hand. SecDevOps is an approach to development that puts security right at the heart of DevOps by making it integral to the development cycle.

SecDevOps: Bridging the Gap Between Security and Agility

According to CIO Insight, organizations such as the endowment-based Dana Foundation have found the SecDevOps approach to be an effective way to bring security into DevOps. The result is faster development cycles and more robust security.

The Dana Foundation is primarily engaged in two fields: web activities related to grant management and publishing and outreach operations, including an annual brain awareness week. James Rutt, the company’s chief information officer (CIO), told CIO Insight that the organization was primarily concerned with “code quality and code security,” with a particular focus on protecting against known code vulnerabilities listed in the Open Web Application Security Project (OWASP) Top 10, such as cross-site scripting and forgery.

The SecDevOps approach helped the company speed up its development process while reducing code vulnerabilities by 40 to 50 percent. This impressive performance shows why and how security and agility can form a perfect partnership.

Building Security Into the DevOps Cycle

Experts have been preaching for years that security needs to be built in, not bolted on after the fact. But the combination of conventional, prolonged development cycles with a fluid security environment has made built-in security almost impossible to achieve. After all, if new versions of a software package were only released every couple of years, the security environment would be radically transformed between two successive versions. Developers had no choice but to bolt on new security features.

In the world of DevOps, the software development cycle has become dramatically faster — so much faster, in fact, that code development can now match the pace of new security challenges. Developers are no longer focused on fixing existing code to handle new security threats. Instead, they are constantly building new code as part of the DevOps cycle, which means that new security features can be built in as part of the overall development process. This is exactly what the security community has been preaching all along.

SecDevOps is not a magic trick, but a natural, organic way to approach new security needs in the context of ongoing code development. This is very good news for organizations that are shifting into the DevOps era.

Answer 1

DevOps ,as the name suggests,is the collaboration of development and operations team for faster implementation of software development.Although the DevOPS methodology is increasingly used in day to day businesses,there remains few security challenges to be addressed:

1) Neglecting Security challenges:Development team often neglects the security challenges as their main focus is on speedy delivery.They find the security challenges as blockers in their pathway which may slow down their delivery.As a result of which,it always leave behind unresolved vulnerabilites which exposes the code to malfunctions in future.

2) Risk associated with the tools being used in DevOps: DevOps usually relies on some open source tools which carries associated risk with them ,for example,container is a packaging platform for applications which can run on any platform and carry forward vulnerabilties which are difficult to be scanned.

Adopting Secured DevOps can eliminate the threats posed by the above mentioned two challenges.DevSecOps is a methodology where everyone involved in sofware development lifecycle takes responsibilty of security issues in their code.Security and other teams can be trained in new skills to be applied in DevSecOps.Security policies can be introduced like configuration management,code reviews for vulnerabilties,firewalls etc.Also,automating tools and security processes can help security operations to keep up the pace with development operations which will overcome the negligence induced due to the pressure of keeping up the speed.