The DevSecOps Approach to Achieve Faster Delivery & Enhanced Security

The DevSecOps Approach to Achieve Faster Delivery & Enhanced Security 1
©RapidValue Solutions
A Whitepaper by RapidValue Solutions
The DevSecOps Approach to Achieve
Faster Delivery & Enhanced Security

Index
2
DevSecOps and the Four Pillars of DevSecOps Transformation
4
5
7
The DevSecOps Manifesto
Why do we need DevSecOps?
Integrating Security into DevOps
1
Introduction
10
12
DevSecOps Best Practices
Future of DevSecOps

1. Introduction
Unless one has been living under the rock, it is not possible to not have come across the term ‘digital
transformation.’ Industries are on the move to transform their businesses and services leveraging
technology. The global pandemic has further accelerated the need to transform legacy systems and replace
them with newer digital technologies. With the need to accelerate development and time to market
increasing more than ever, businesses have to embrace security to be successful in the longer run.
Data security breaches are an important cause of concern in the IT industry, and almost 61% of organizations
have experienced an IoT security breach. Cyber-attacks have adverse effects on businesses and result in
reputational damage, operational disruptions, and financial losses. While these breaches affect all types
of organizations, often, it is the SMEs that are on its receiving end. However, this does not mean that large
organizations are safe, and some of the big players like Facebook, LinkedIn and Uber have also fallen victim
to data breaches. The recent Whatsapp vs Signal vs Telegram debate points towards the users’ growing
concern over security breaches and data exploitation.
Recent studies suggest that 40% of breach victims are SMEs, and around 60%
of small companies go out of business within six months of a cyber attack.
With a prediction suggesting that almost 33 billion records are to be stolen in 2023, preventing these
breaches and enhancing security has become more relevant than ever. This brings us to our topic of
discussion, DevSecOps. DevSecOps is an extension of the concept of DevOps that ensures code quality
and reliability assurance. This whitepaper attempts to answer the questions surrounding DevSecOps while
consequently providing a clear idea about the concept.

DevSecOps is a transformational shift that incorporates secure culture, practices, and tools to drive
visibility, collaboration, and agility of security into each phase of the DevOps pipeline. The previous
approach of assigning security to a specific team and reserving it for the final stage of development is an
outdated concept, especially during the present time when DevOps ensures continuous and frequent
development cycles. DevSecOps enables us to strive for “Security by default” by integrating security using
tools, creating security as Code Culture, and promoting Cross Skilling. This is illustrated in the diagram
below.
2. DevSecOps and the Four Pillars of DevSecOps
Transformation
Skill
Tools
Culture
Development
Operations Security
Software releases
and updates
Reliablity
Performance
Scaling
Confidentiality
Integrity
Availablity
DevSecOps
The next topic for discussion is the ‘Four Pillars of DevSecOps Transformation.’ These are the four key areas
that we deem to be important for effective DevSecOps transformation.

1. Governance: It is extremely important to establish security guidelines and monitor results. A consistent
governance model can be established by enabling security services that are business-aligned, agile, and
risk-based. This can be done by defining DevSecOps roles and responsibilities, defining best practices and
processes, automated security tests and audits, and metrics to evaluate the progress/continuous feedback.
2. People: The next most important pillar of DevSecOps transformation is the people involved in it. Ensure
to build teams based on business priorities and offer them training on the security know-how. It is also
important to focus on solutions while working together to ensure effective collaboration.
3. Technology: Leverage technology to strengthen your security and incorporate security into DevOps. Also,
ensure to automate the recurring security tasks and harden the development pipeline.
4. Process: During the process, it is important to involve security from the initial stage with automated
security controls wherever possible. Fix issues based on priority and also smoothen the DevSecOps feedback
process.
They are as follows:

The DevSecOps Manifesto lists down a set of values/ideas by which security practitioners intend to
implement DevSecOps and contribute value with as little friction as possible. Compiled by DevSecOps.org,
the manifesto aims at faster innovation and ensures that data security is not compromised. As stated on
their website, instead of waiting for a data breach to occur, the security teams look for anomalies that are
yet to be detected.
The manifesto comprises nine statements, and they are as follows:
While the above-given manifesto provides a basic framework, businesses can modify it to suit their
security needs.
3. The DevSecOps Manifesto
Consumable Security Services with APIs
over Mandated Security Controls & Paperwork
Business Driven Security Scores
over Rubber Stamp Security
Red & Blue Team Exploit Testing over
Relying on Scans & Theoretical Vulnerabilities
24x7 Proactive Security Monitoring over
Reacting after being Informed of an Incident
Shared Threat Intelligence over Keeping
Info to Ourselves
Compliance Operations
over Clipboards & Checklists
Leaning in over Always Saying “No”
Data & Security Science over Fear,
Uncertainty and Doubt
Open Contribution & Collaboration
over Security-Only Requirements
1.
2.
3.
4.
5.
6.
7.
8.
9.

As mentioned earlier, DevSecOps aids in enhancing security and minimizing risks during the DevOps
process. Let us move on to discuss further the reasons why we need to incorporate DevSecOps.
- Continuous Security: DevSecOps ensures continuous and enhanced security by implementing the ‘secure
by design’ principle using automated security review of code and automated application security testing.
- Accelerated Delivery and Recovery: By embedding security into the early stages of DevOps workflow, we
can increase the speed, quality, and efficiency of the secure code delivery. As security testing is part of the
release pipeline, when there is a security incident, it allows faster detection and remediation.
- Reduced Costs: By introducing secure coding best practices and security testing at the early stages of
SDLC, we can reduce the complexities and the cost. By failing fast with security testing, we can reduce the
risk of security issues and thus reduce the cost of recovery and rework.
- Increased Efficiency and Product Quality: As a continuation of the first point, by ensuring continuous
security, security issues are detected and remediated during development phases. This, in turn, results in
increased speed of delivery and enhanced quality.
4. Why do we need DevSecOps?

- Enhanced Compliance: In DevSecOps, security auditing, monitoring, and notification systems are
automated and continuously monitored, and this ensures enhanced compliance.
- Effective Collaboration: By integrating development, security, and operations, DevSecOps fosters a
culture of openness and transparency from the earliest stages of development. This improves collaboration
between the people involved and yields better results.
- Improved Business Value: The above-mentioned benefits of DevSecOps ultimately culminate in this point.
DevSecOps, with its improved security, ensures that a better product reaches the market at an accelerated
speed. A better product thus equates to happier customers, improved user experience, and strengthens
one’s ability to compete in the market. This improves business performance and value considerably.
68% of business leaders feel that their cybersecurity risks are increasing.

Now that we have discussed why we need DevSecOps let us shed some light on integrating security into
DevOps. Let us begin by answering the question as to 'Why it is important to integrate security into
DevOps?'
While the ability to deploy applications has improved in both scale and speed in favor of meeting
business demands quickly, security considerations are often being overlooked. However, this is a matter
of serious concern because, given the reliance on applications to keep operations running, security in the
development process cannot be considered as an afterthought. Application security must speed up in
accordance with the pace of operations. Also, it has to be kept in mind that feedback in the early stages of
the cycle reduces considerable cost and time.
Having discussed the need to integrate security into DevOps, let us discuss how to bring security into
DevOps. We have simplified the process into four key points for you.
• Tightly integrating security tools and processes throughout the DevOps pipeline.
• Automating core security tasks by embedding security controls early in the software
development lifecycle.
• Enabling continuous monitoring and remediation of security defects across the
application lifecycle, including development and maintenance.
• Ensuring better collaboration between Agile Development and Security Teams.
5. Integrating Security into DevOps

Here is an image that depicts the different phases in the DevOps pipeline.
Let us elaborate on how to integrate security into the existing DevOps pipeline in order of the
phases.

• Plan: Security begins from this phase. In this phase, it is important not to just stick to feature
descriptions, and one must go into the depth of the requirements - both functional and
non-functional. The focus should also be on security, performance, acceptance test criteria,
application interface, and threat-defense models.

• Code: In this phase, one must adopt the “How to do it” approach rather than a “what to do”
approach. It is important to follow the coding standards and practices to ensure security. Also,
perform code reviews and static code analysis during this phase.

• Build: Ensure that you use automated build tools and incorporate static application security
testing (SAST) tools. Perform test-driven development during this phase. In addition to it,
enforce quality standards and ensure that the best security practices are implemented
through static code analysis.

• Test: During this phase, leverage dynamic application security testing (DAST) tools to test
your application while in runtime and also automate the tests.
CODE
TEST
R
ELEA
SE
PLAN
B
U
I
L
D
DEPLOY
O
P
E
R
A
T
E
MONITOR
Dev Ops

• Release: Run automated scans to verify the compliance with the requirements of various
industry standards. Additionally, use detailed compliance information to guide your product
security action plans and prioritization.
• Deploy: Before the deployment process, ensure that the configurations are secure across
the IT infrastructure. Moreover, automate the deployment process and also ensure that it is
consistent.
• Operate: It is probable to witness the occurrence of human errors in this phase. Hence, to
prevent that, perform routine maintenance and upgrades.
• Monitor: To integrate security in this phase, implement a continuous monitoring program in
real-time to keep track of system performance and identify any exploits.
Post the integration of security into the DevOps cycle, a DevSecOps pipeline design will look
something like the image given below.
GitLab’s Mapping the DevSecOps Landscape survey suggests that 78% of the
respondents think the demand for technical security skills is increasing.
Continuous Integration, Continuous Security
Collaboration Deploy
Planning
/ Backlog
Architecture
Threat
Modelling
Deploy to
Production
Deploy to
Production
Security as
Code
Production
Test
Monitor
ChatOps
Development Version
Control
Orchestration
Static
Security
Test
Deploy to
Test
Dynamic
Security
Test
Ready to
Deploy
Source: DXC Technology

For every process that exists, there are specific best practices that enable its smooth functioning.
Likewise, from our experience of implementing DevSecOps, we have compiled a list of seven key
best practices to be kept in mind to ensure proper and effective implementation of DevSecOps.

• Provide Proper Training: It is important to train the developers on secure coding to
integrate security from the initial stages. Usually, the organizations pay little attention to
the developers’ training and skill enhancement when it comes to delivering the secure
code. Training them in the best practices of secure coding will help us to improve the
code quality and thus to reduce the security vulnerabilities.

• Shifting Left: Shift left testing is a method that helps detect and prevent defects early in
the software development cycle. This method ensures better quality by moving tasks to
the left as early in the SDLC as possible. Find out more information about implementing
shift left testing in QA here.

• Identifying and Implementing the Right Tools: Security tools will be integrated into the
development pipeline to ensure the secure delivery of the code. The speed and accuracy
of the tools are very important. Any tools that you choose should protect you not just
against known vulnerabilities but also unknown threats and key Open Web Application
Security Project (OWASP) top 10 risks. The tools should be able to help you to identify and
address risks in the open-source software components that you use.

• Automating Processes: Security tests and controls should be integrated early in the
development cycle, and it should happen in an automated fashion. This will shorten the
feedback loops and decrease the friction. As a result, the engineers can detect and fix the
security and compliance issues more faster and efficiently in the development lifecycle.

• Threat Modelling: A threat modeling exercise will help your organization to get an
idea of the possible threats and vulnerabilities, the existing controls for protecting the
applications and assets, and any gaps in your controls that need to be addressed. This
will help us to protect our systems and applications. Also, threat modeling helps teams to
gain a better understanding of everyone's roles, objectives, and pain points. It will help to
create a more collaborative work environment.
6. DevSecOps Best Practices

1
• Uniform Security Management Process: A uniform security management system should
be required in DevSecOps. The advantage of this is that all the team members would
be immediately notified in case of any changes/updates. Also, it will help the team to
prioritize and manage the tasks from a bunch of allocated work.
• Monitor and Scale: It is very important to monitor the code that’s already running, as
well as code that’s actively being developed. Monitoring can track the malicious login
attempts, unauthorized access, errors coming from your application, etc. We should
employ efficient and powerful continuous monitoring tools for this purpose. In the event
of any threats or attacks, we should be able to scale the infrastructure to handle the
situation.
Gartner projects that DevSecOps will reach mainstream adoption within
5 years and has predicted a 20-50% market penetration.

7. Future of DevSecOps
There are several common misconceptions surrounding DevSecOps, such as it requires a
specific dedicated team for its implementation, it slows down developers and the like. However,
these are nothing more than myths, and DevSecOps plays a major role in helping organizations
that are looking forward to uniting IT operations, application developers, and security teams by
integrating security into their DevOps pipeline. As mentioned in our previous blog on
DevOps trends, with developers leaning towards the compliance-as-code service and security
becoming the major focus, the future of DevSecOps sure seems bright.
The Analytical Research Cognizance suggests that the DevSecOps market is expected to grow
at a CAGR of 33.7% during the forecast period 2017-2023. This further reiterates the fact that
businesses are placing a huge amount of importance on security concerns and are taking
possible measures to prevent them. At this point, it is safe to say that DevSecOps would become
the norm in a few years down the road and that it would be impossible to imagine a DevOps
cycle without it.
Authors
Vivek CB
Practice Manager - Testing
RapidValue
Amritha Nampalat
Marketing Executive
RapidValue
If you’d like to know more about our DevSecOps approach and solutions, please reach out to us at
contactus@rapidvaluesolutions.com

Disclaimer:
This document contains information that is confidential and proprietary to RapidValue Solutions Inc. No part of it may be used,
circulated, quoted, or reproduced for distribution outside RapidValue. If you are not the intended recipient of this report, you are
hereby notified that the use, circulation, quoting, or reproducing of this report is strictly prohibited and may be unlawful.
RapidValue is a global leader in digital product engineering, including mobility,
omni-channel,IoT,AI,RPAandcloudservicestoenterprisesworldwide.RapidValue
offers its digital services to the world’s top brands, Fortune 1000 companies and
innovative emerging start-ups. With offices in the United States, the United
Kingdom, Germany and India and operations spread across the Middle-East,
Europe and Canada, RapidValue delivers enterprise services and solutions across
various industry verticals.
www.rapidvaluesolutions.com
+1 877.643.1850
www.rapidvaluesolutions.com/blog
contactus@rapidvaluesolutions.com
February, 2021

The DevSecOps Approach to Achieve Faster Delivery & Enhanced Security

Recommended

Recommended

More Related Content

More from RapidValue

More from RapidValue (20)

Recently uploaded

Recently uploaded (20)

The DevSecOps Approach to Achieve Faster Delivery & Enhanced Security