Following a wave of high-profile cyberattacks in the U.S., president Joe Biden invited top executives from the largest companies in tech, financial services, insurance, energy and education to discuss how to combat future cybersecurity threats. From SolarWinds to the Colonial Pipeline attacks, these events have accelerated cybersecurity initiatives across public and private sectors.
While there are a number of point solutions available to address cybersecurity, too many tools and too many people result in a DevSecOps “hairball” that leaves organizations inundated with data but little to no actionable information to inform their decisions. In recent years, many organizations have embraced the continuous integration/continuous delivery (CI/CD) approach as a philosophy to embrace digital transformation and ensure continuous integration, delivery and deployment of code while reducing errors and increasing project velocity. While it is a natural extension of the Agile and DevOps transformations, the adoption of CI/CD pipelines further siloed security as processes failed to keep pace.
The SecDevOps Evolution
CI/CD is a philosophy that leverages Agile methodologies and automated testing to enable testing at each stage of the software pipeline. By adopting CI/CD, organizations are able to account for a different number of permutations that change rapidly as a business changes. It helps organizations account for changes both internal (changing databases, different software versions, etc.) and external (compliance requirements, ransomware threats, etc.). This approach reduces the time required to integrate changes into a release and gets working software to users as quickly as possible. It also enables stakeholders and users to access new features and provide feedback immediately, creating an iterative cycle of information for future decision-making.
As organizations continue to evolve their continuous delivery processes, security must finally be included through SecDevOps orchestration to ensure a repeatable and reliable execution of security processes at every step of the software development life cycle (SDLC). By continually managing security practices, policies and technical debt in existing CI/CD pipelines, this approach ensures that everyone within an organization has the information they need at every step of the development process so they can share responsibility for delivering secure software.
Moving Beyond CI/CD
We need to take CI/CD one step further and include continuous security from the start. To effectively include security within an evolving CI/CD/CS approach, we need to focus on three key principles:
- Segregating stakeholder responsibility—Bring in the right people at the right time, whether they are developers and designers, quality engineers, business analysts and product owners or users.
- Isolating and securing environments—Reduce risk by identifying which stakeholder is responsible for each aspect of the pipeline.
- Decreasing feedback loop; speeding up pipelines—Leverage technology to automate the pipeline and reduce time for development, feedback and iteration.
Continuous security is like CI/CD in that questions are raised and feedback is addressed by technologies and processes throughout the pipeline, rather than in response to a release. By extension, CI/CD/CS is the philosophy of continuously shipping software that meets the most current security standards for the business, accounting for internal and external change throughout the SDLC.
Different organizations have different risks to be accounted for, which means security must be aligned to business strategies and priorities so that it can dynamically respond. With end-to-end integration into the SDLC, continuous security supports CI/CD to improve productivity and speed time-to-market, while reducing the risks that might impact a particular business. Software is inherently impermanent and organizations need to be able to continuously balance security, technical and business priorities to ensure they are maintaining their focus on what matters most: Delivering value to customers and shareholders.
