First, there was Dev, the development of platforms, solutions, and services that allowed organisations to refine their offerings and competitiveness, followed by DevOps, a shift in IT delivery and development that focused on speed, agility and lean methodologies to drive innovation and collaboration across teams. Now, according to Mandla Mbonambi, CEO of Africonology, DevSecOps has emerged, which is the integration of development and security operations that allows for the embedding of security protocols and considerations throughout the DevOps process.<\/p>\n
\u201cDevSecOps pulls a new team into the conversation – security,\u201d said Mbonambi.<\/p>\n
\u201cIt\u2019s an imperative driven by the need to ensure that security remains at the forefront of collaboration and development, not something that\u2019s brought in at the end when the loopholes are set, and the gaps widen. With this level of integration, it allows for the organisation to pivot and innovate at speed but within the highly relevant constraints of security.\u201d<\/p>\n
According to a Deloitte Insights paper \u2013 DevSecOps and the cyber imperative \u2013 DevSecOps allows for organisations to \u2018enhance their approaches to cyber and other risks\u2019. It ensures that security, privacy, policy and controls are embedded into the DevOps culture from the outset, allowing deeper integration of security throughout the lifecycle of innovation. In light of how vast the cybercrime landscape has become, and how sophisticated the threat vectors, it\u2019s almost a surprise that DevSecOps has taken so long.<\/p>\n
\u201cUltimately, organisations have to consider the governance, risk, and compliance (GRC) mandates that impact on their security stance across all areas of the business,\u201d added Mbonambi.<\/p>\n
\u201cThis is further complicated by the tenets of GDPR, that are far-reaching, the incoming Protection of Personal Information Act (POPIA), and the regulations around security that govern the US, Asia, and Australia. Ensuring that security is embedded within any solution has become mandatory to ensure global competitiveness and alignment.\u201d<\/p>\n
DevSecOps is neatly defined by Deloitte as being \u2018an evolution of DevOps culture and thinking\u2019 \u2013 it doesn\u2019t disrupt the cyber agenda, it enhances it, allowing for DevOps to innovate and iterate without worrying that they may compromise security.\u00a0 Unfortunately, in as much that DevSecOps feels like an intuitive step forward, it is one that few organisations understand or know how to implement.<\/p>\n
Logz.io\u2019s 2018 DevOps Pulse Report found that most DevOps professionals aren\u2019t prepared for security – 76% were either in the process of implementing DevSecOps or hadn\u2019t even begun to consider it. This is partly due to a lack of understanding, but also the limited skill pool. There just aren\u2019t enough skilled security professionals available to support DevSecOps development.<\/p>\n
\u201cIt\u2019s worth looking to partnering with an organisation that understands the tenets of DevSecOps and that can work with DevOps teams to provide relevant security insight and support,\u201d added Mbonambi.<\/p>\n
\u201cThis will not only allow for the organisation to embed security into the DevOps teams more efficiently, but it will ensure that they have access to the latest processes and tools from security specialists at the top of their game.\u201d<\/p>\n
In addition to putting tighter locks around DevOps innovations, DevSecOps offers a variety of benefits to the organisation. It isn\u2019t all box ticking and compliance, the business also gets to enjoy some significant cost savings thanks to the speed at which issues are identified and resolved. Vulnerabilities aren\u2019t found after release; they are uncovered in rigorous ongoing testing throughout the DevOps process. This, in turn, assures of faster recovery that will reduce downtime and the number of incidents, and improved threat hunting that catches flaws before they affect the company\u2019s reputation. The obvious benefit is improved overall security \u2013 DevSecOps can be used to test and assess legacy systems alongside the new \u2013 and the creation of a more transparent process that has all members of the DevSecOps team collaborating and sharing information openly.<\/p>\n
\u201cDevSecOps testing allows for constant improvement and iteration within tight security parameters but without slowing innovation to a crawl,\u201d explained Mbonambi.<\/p>\n
\u201cIt can allow for the team to build in robust systems that can be used to test across multiple projects and that can potentially improve software delivery and product differentiation. It may be a relatively new concept, but it is one that can be seamlessly integrated into the DevOps environment and that can add enormous value.\u201d<\/p>\n
DevSecOps can remove the need for expensive redevelopment and redesign, align the organisation more tightly with GRC, address risk at the outset, improve quality and minimise the need for patching down the line. With the right DevSecOps partner, the skills challenge can be deftly overcome while still retaining the competitive advantage.<\/p>\n","protected":false},"excerpt":{"rendered":"
First, there was Dev, the development of platforms, solutions, and services that allowed organisations to refine their offerings and competitiveness, followed by DevOps, a shift in IT delivery and development that focused on speed, agility and lean methodologies to drive innovation and collaboration across teams. Now, according to Mandla Mbonambi, CEO of Africonology, DevSecOps has […]<\/p>\n","protected":false},"author":25,"featured_media":27182,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[4950,5,6,13,262],"tags":[5099,492,10224,10223,291,1499,445,7484,10225,5098,6559,967],"class_list":["post-27180","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-analysis","category-enterprise-security","category-insights","category-top-stories","category-used","tag-africonology","tag-cybercrime","tag-deloitte-linsights","tag-dev","tag-devops","tag-devsecops","tag-gdpr","tag-grc","tag-logz-io","tag-mandla-mbonambi","tag-popia","tag-protection-of-personal-information-act"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/27180","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/comments?post=27180"}],"version-history":[{"count":3,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/27180\/revisions"}],"predecessor-version":[{"id":27185,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/27180\/revisions\/27185"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/media\/27182"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/media?parent=27180"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/categories?post=27180"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/tags?post=27180"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}