A Natural Progression from DevOps to DevSecOps
Security is integral to DevOps rather than becoming a part of the final phase in the SDLC. Today’s focus on cloud-native apps, containers, open-source software, and microservices necessitate a transition to DevSecOps. A “security-throughout” mindset is at the heart of integrating DevSecOps with CI/CD. It is key to maximizing modern, streamlined development approaches.
What is the Goal of DevSecOps in Continuous Integration and Continuous Delivery?
Ironically, DevSecOps and CI/CD are so symbiotic that it can be difficult to separate them. DevOps introduced CI/CD as a way to embed ongoing and iterative testing and verification through each stage. DevSecOps seeks to infuse the same philosophy but from a security perspective at the beginning of development, creating security gateways at each SDLC phase. And, when integrating DevSecOps with the CI/CD pipeline, software can be produced with speed and safety.
DevSecOps Offers Concrete Benefits to CI/CD
The optimal value of DevSecOps is when security checks are automated and integrated with the CI/CD pipeline. The primary role of integrating DevSecOps with CI/CD is to alert development and security teams to issues as soon as possible so that they can be remediated and the development cycle moves forward seamlessly. An integrated approach opposes the scenario when security reviews are left to the end of development, during testing, release, or as a last-minute add-on before deployment.
Today’s development teams can’t afford a stop-and-check security stance. When vulnerabilities are discovered at the end, they can derail go-live along with all the planned sales, marketing, and customer engagement activities.
Integrating DevSecOps with the CI/CD pipeline enables faster overall software development, fewer errors, more robust security, and less rework. Other benefits include improving time-to-resolution when issues arise, faster releases, grooming a smaller backlog, and more confidence in final deliverables that go into production.
Closing the CI/CD Loop with DevSecOps
Eliciting a continuous delivery, security-focused SDLC requires a thoughtful approach to security gateways during each phase – plan, code, build, test, release, and deploy. Each gateway, however, offers unique security assessment opportunities that help ensure that each CI/CD loop is closed out with a strong security result. This process and policy reinforces the cultural belief that you can’t have quality software without secure software.
CI/CD pipeline security best practices
According to Carnegie Mellon University’s (CMU) Software Engineering Institute (SEI), “DevSecOps helps clear up the bottleneck caused by older security models and tools on the modern CI/CD pipeline.” Their best practices to improve CI/CD pipeline security include:
- Maintaining strong physical access controls
- Having clear change management processes
- Attributing actions to individuals
- Tracking security controls for each delivery
- Reporting on compliance metrics
- Automated vulnerability fixes
- Adhering to clear incident response procedures
Other best practices to adopt include thinking of security issues as software issues. They are integral to the quality of the product. And inherent in the DevSecOps model is building security controls and vulnerability detection into your CI/CD pipeline. Lastly, ensure security is still a focus once hand-off occurs with production deployment. Proactive monitoring, automated patching, and configuration management are key to a smooth transition.
Application security testing
Several application security testing (AST) tools can be integrated into the various stages of the CI/CD pipeline. The most common include SAST, SCA, IAST, and DAST.
SAST: Static application security testing
SAST (aka white box testing or static analysis) analyzes source code to find security vulnerabilities, scanning an application before the code is composed. Typically, these tools are used during the code, build, and development phases.
SCA: Software composition analysis
SCA automates the identification of open-source software in a codebase, which is critical to assessing the full risk scope within an application. Early and continuous SCA testing throughout the SDLC supports a DevSecOps approach to CI/CD.
IAST: Interactive application security testing
IAST (aka runtime testing) identifies vulnerabilities in web applications found through runtime monitoring runtime. Agents and sensors continuously analyze application interactions, data flow, and behaviors to identify and manage real-time risks.
DAST: Dynamic application security testing
DAST (aka opaque or black box testing) is similar to IAST in that it tests software while running. However, testers don’t have visibility into the source code. It’s a way to assess the application from the outside, simulating attacks and noting the code’s response.
These tools are the backbone of Integrating DevSecOps with the CI/CD pipeline.
Modern DevSecOps Teams Rely on Panoptica
Cisco’s Emerging Technologies and Incubation (ET&I) team is paving the way with “DevSecOps-friendly” cloud-native security solutions that fundamentally simplify conventional offerings. Our Panoptica solution simplifies cloud-native application security, making it easy to embed into the software development lifecycle. Panoptica protects the full application stack from code to runtime by scanning for security vulnerabilities in the cloud infrastructure, microservices (Containers or Serverless), the software bill of materials, and the interconnecting APIs. And best of all, it integrates with the tools that your application development and SecOps teams are already using in your CI/CD pipeline. Try Panoptica for free!
