What is DevSecOps?

In the area of agile software development, product security is taking on an ever-expanding role. In this time of continuous delivery and continuous integration, however, the development process is being subjected to a challenge that should not be underestimated. As such, ever more companies are making use of the DevOps approach, in which development and subsequent operations are both closely intertwined with a security component from the very start: hence, the abbreviation DevSecOps. DevSecOps presents a ready-made solution for problems that many software companies face on a daily basis. The solution equally takes into account the demands of speedy development and security.

DevSecOps optimises the use of agility and allows for swift reaction, much like the DevOps approach, because the security aspect is already taken into account during the actual development phase. This clearly distinguishes the system from conventional approaches, where a security team usually needs to intervene once a product has been finalised.

The DevSecOps method guarantees high-security standards for quick and agile development methods including continuous delivery and continuous integration. The often very high-security requirements must already be included in the programming for ongoing operations. This makes good communication between the security, development, and IT operations teams fundamentally important. In this context, an interdisciplinary approach is decisive for the success of the entire development process.

For the past few years, the security aspect of software development has been ascribed growing significance. Because of the fast pace of development, accompanied by increasingly shorter time intervals between different versions, adhering to security standards is becoming an increasingly greater challenge. For many companies, the challenge becomes insurmountable if the security aspect is only considered after the actual development stage has been completed. Companies often have to decide between enhancing security and the greater expenditure of time alongside it, or lower security standards at the advantage of shorter release cycles. Many providers often go for the latter option. However, DevSecOps offers an outstanding solution for bringing together high security and short release cycles.

Earlier solutions for the implementation of security features and security protocols cannot be compared to the new and faster variants of agile software development. Only by integrating security standards into the development stage of the software and its inclusion in the development process can the desired level of security be guaranteed, even during short development and production cycles. However, very few companies actually take this approach. This is evident in the fact that some products lack security due to shorter version cycles, and that those security holes can often only be closed by makeshift ‘day-one patches’ .

When aiming for a high degree of security, it must be accepted that development will take longer or alternatively users can turn to DevSecOps in order to achieve the desired result.

Let’s use a practical example from a private user to illustrate the above. The app in our example is a household budgeting tool that can be used on a smartphone. The app allows a user to record, categorise, colour-code, and prioritise various incomes and expenditures. In this case, very little sensitive data comes into play, so there is not much to take into account in terms of security.

However, let’s say that a new function is added to the app, in which receipts can be scanned and automatically recorded. In this case, since there is a lot of data to process and to be evaluated on servers, secure communication and processing take on a much more important role. If this security aspect is only taken into account in retrospect, then it can take half a year for the new function to be deployed.

Let’s say that another function is to be added to the app. In this case, expenditures are to be integrated into the app directly from the user’s online banking account. This implies the processing of extremely sensitive data, and the integration of such a solution while also adhering to high security standards could eventually take over a year. By that time, the competition will already have gained a lot of ground, and your own product may no longer be interesting to the market.

However, if the security aspect is directly taken into account during programming and development through DevSecOps, then the time needed to release the new function, without compromising the security of the product, can be shortened significantly. Often, security is improved in the process, since it can be integrated directly into the programming, and does not take the form of a security patch to be slapped on to an already-existing product. As such, the company benefits from shorter version cycles and the user benefits from consistent software updates.

The benefits of DevSecOps are obvious. If a company decides to conduct the development of their own products with the modern DevOps system due to increasing demand and the greater challenges they are facing, they will often see an unexpectedly high increase in production and deployment speed for different software versions. However, security is often left too late during the process. If it is only integrated into a product once completed, as is often the case, this can not only lead to problems related to the functionality of the software, but its deployment will be noticeably delayed.

However, should the security aspect be taken into account while the development process is ongoing, then the situation changes completely. In that case, the process is barely slowed down at all, since the security team will also benefit from the different monitoring solutions and automation. In addition, the development and operations teams are able to take into account all security-related factors during development, leading to a very clear reduction in the number of security issues. As such, secure and stable software variants can still be produced in a short amount of time and directly released to the end clients. Both clients and companies benefit from this new approach.

Just like with DevOps, the success of the DevSecOps system and its efficiency are dependent on how well individual employees and teams are able to handle the transition. Without an open company culture and open exchange between teams and different departments, the DevSecOps concept will not function properly. As a result, it is important not only for the benefits of the new system to be openly communicated, but also to ensure that the changes are well-coordinated across teams and employees.

If employees continue to resist aspects of the system, such as the integration of security experts into the actual development process, this could lead to considerable difficulties.

The integration of important security features is vital in the software development and IT operations sectors. If the necessary security measures are only taken into account after the actual development has been completed, this will not only lead to very lengthy delays, but will also allow errors to creep up that will not be subjected to a comprehensive review process. However, should the security aspect be integrated directly into the development of software, software updates, and software versions through DevSecOps, the time spent implementing security measures will be markedly reduced and quality will also be noticeably improved through automated checks. As such, companies will benefit by not only using DevOps in their operations, but also employing DevSecOps to integrate data and software security directly into the development process.