By Jeff Whalen January 07, 2022
D
evOps and Security. One encourages speed, agility, iterative learning, enabling technology to keep up with the pace of business. The other wants to keep you safe, slows things down, crosses all the T's and dots all the I's. They seem to be at odds with one another — but do they need to be? DevSecOps says no, that’s not the way it has to be. DevSecOps practices embrace both disciplines, offering speed and flexibility that meets the needs of the business, while doing it safely and reliably in order to provide a delightful and secure end user experience.
Transition from DevOps to DevSecOps
Most enterprises today have embraced DevOps principles and practices at the core of their software development processes. But are they prepared to adopt or implement DevSecOps? What do teams need to consider and plan for as they evolve to integrate security directly into their DevOps processes? What new challenges will they face that may render older application security models obsolete, both in development as well as in operations?
It’s Not Just Same Work, Different Day
It’s a common assumption that security processes can adapt and scale to the changingsoftware development and release cycles. However, security changes need to be more than just continuing the status quo at speed and at scale. Traditional security, with its reliance on experts and gateway checkpoints, is at odds with the iterative, automated approaches that dominate current DevOps architectures. Thus, in order to successfully evolve from DevOps to DecSecOps, all the teams involved in application development and delivery will need to work together to define their shared goals and outcomes and what changes to strategy, processes, tools and skills they’ll need to achieve success.
A Framework to Light the Way
Additionally, DevSecOps isn’t just about technology; it’s a shift in thinking about how to deliver positive experiences to end users through quality software, quickly and securely. In the eBook "6 Pillars of a Successful DevSecOps Practice,” Splunk lays out six fundamental principles organizations will need to address when building a DevSecOps program, outlining in detail how Splunk can help you to successfully implement and operate various elements of your practice. Each pillar addresses an important aspect of a comprehensive DevSecOps program, from how to organize teams around shared purpose and choose the right tools, to measuring the effectiveness of your DevSecOps practice and realigning teams on how to think about security threats. Transforming your DevOps practice to DevSecOps can be daunting, but with the right approach and the right partner, like Splunk, you can set your organization on the right path.