It isn’t news that DevOps and IT security teams often struggle to align their departments and maintain a coherent balance between keeping a business secure and developing new applications to maintain customer interest. While security processes are a necessity, they can be deemed by DevOps teams to be manual and cumbersome, blocking the agility that makes them so effective in bringing their solutions to market. IT teams conversely feel their counterparts are prepared to sacrifice security in the name of innovation and revenue.
Even if both teams do respect the other’s intentions, any conflict could lead to delays in both of their processes. For example, an IT team may need to make crucial updates to the network security and warn different teams they may experience some downtime during this crucial implementation. However, DevOps have typically been given more leeway in how they operate as they are so important in today’s software-driven world, and may ask for the update to be delayed so they can complete tasks or meet deadlines, leaving the IT team waiting and losing time rescheduling their own work.
This has unfortunately led to a myth that DevOps teams choose to ignore security. In reality, developers are keen to know that their apps and the environment they work in are secure – but at the same time, they don’t want security to get in the way of them quickly delivering valuable new products and software features.
So, is there a way for DevOps teams – one of the most important resources in many modern businesses – to embrace security without impacting agility? Can the integration of DevOps and security be done in a way that alleviates tensions and promotes collaboration – while actually improving both security and agility in the process?
Yes. The secret is automation.
Reconciliation through automation
As C-suite executives are now more likely to focus on security, due to the obvious financial and reputational consequences of a breach, DevOps teams should define how they protect and secure their multiple projects and production environments. Automating security as part of the CI/CD process allows DevOps teams to easily follow company security policies because they will be embedded into the automation pipeline.
This process can remain running with little concern, effectively minimising stress about security. This still automates policy changes and activities so that there is a significantly reduced chance of error. Although the automation solution remains hidden, it can still be utilised at any point to view data on the vulnerabilities, compliance requirements, security policies and network connectivity, via its continuous scanning abilities.
Additionally, DevOps teams are already familiar with automated tools in their daily operations and communications – and they are likely to be accepting of switching to a security solution that integrates with their existing processes.
Automation is the key to creating reliable, effective and connected “DevSecOps” teams, as it makes the secure option the easy option. It combines DevOps’ existing use of automated tools to achieve their ultimate goal of continuous, on-time and on-budget deployments with security’s focus of reducing human error and maintaining continuous visibility into potential vulnerabilities.
Encouraging adoption
A guiding principle of DevOps is collaboration, which is often equated with the idea of shared responsibility. To successfully embed security into the DevOps process, security teams and developers must work together and establish shared responsibility. But how?
Some organisations may assign a security representative in each development team. This person acts as a pivotal link between the two teams – improving communication and building a balanced process that considers everyone’s mutual interests. A continuous flow of knowledge sharing among both teams ensures a level of maturity that allows a business to secure applications and services with an automated solution.
Security teams can begin to define “guardrail policies” that allow development teams to deploy continuously, with the caveat of having to obey security and compliance policies. This is critical for both teams. This new way of working means developers will be able to test their security posture at every step in the CI/CD pipeline and correct things when necessary, and security teams can comprehensively ensure security and compliance throughout the development process.
Embracing collaboration
Any belief that there is common discord between DevOps and IT security teams is unfounded. While it cannot be denied that both teams affect each other, this is not due to conflict – it’s due to business needs. If the two teams work together, they can both achieve their goals and be part of a secure, innovative and profitable organisation. The first step is to accept collaboration is a necessity and by embracing security instead of being concerned by it, DevOps teams can stay in control of how their needs work around IT teams’ processes. Then, an automated security solution can be deployed to improve the efficiency and outcomes of both departments – and, in turn, the entire organisation. It’s time for DevOps to embrace DevSecOps.
Reuven Harrison, CTO at Tufin
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.