DevSecOps: Embracing Automation While Letting Go of Tradition

while i am all for traditions like thanksgiving turkey and sunday afternoon football, holding onto traditions in your professional life can be career-limiting. the awesome thing about careers in technology is that you constantly have to be on your front foot — because when you’re not, someone, somewhere, will be. and when you meet them, they’ll win.

one tradition that has a limited lifespan at this moment is waterfall-native development and the security practices that go along with them. while the beginning of the end might have first been witnessed when gene kim and josh corman presented security is dead at rsa in 2012, we have more quantifiable evidence from the 2017 devsecops community survey. when asked about the maturity of devops practices in their organizations, 40% stated that maturity was improving, while 25% said that it was very mature across the organization or in specific pockets.

in a waterfall-native world, traditional application security approaches are bolted-on late in the lifecycle, performed manually, and can take hours to days to receive feedback. in devops-native worlds where sdlc stages shrink to absurdly short windows, old world technologies won’t be able to cross the chasm into this high-velocity realm.

for those of us in the security profession, there is an awesome opportunity in front of us. our brothers and sisters in the dev and ops realms are calling on us to innovate.

when faced with the chance to build security into a new and exciting development model, security practitioners must not miss the opportunity to make positive change. interestingly, 65% of security respondents are in agreement that security is seen as an inhibitor to devops agility (q31). it feels as if we may be letting the opportunity to drastically fix our application security woes pass us by.

moving from an inhibitor to an enabler of best practices requires a mind shift. the solution to these difficulties is security automation at the speed of devops. successful application security has been defined as increased automation that doesn’t slow down the development and operations process. imagine a scenario where developers embrace security rather than find ways to work around it.

when the cycle times shrink, it’s time to rethink how we continue to refine and improve application security. as enterprises adopt and enhance devops, application security teams should focus on decreasing the amount of time it takes to detect an attack in progress and respond to an identified issue. in a devops-native world, automation of attack, anomaly, and application security protection at runtime is paramount. hanging on to traditions is non-essential.

one example of where devops and security are sprinting at the same pace is with runtime application self-protection (rasp) and next-generation web application firewall (ngwaf) technologies. rasp and ngwaf technologies allow enterprises visibility into application security attacks and data at runtime giving security, operations, and development teams a chance to improve application security results beyond just an increased speed of assessment. by taking the results of runtime security visibility and protection and feeding that information back into all stages of the development cycle we are able to increase velocity while simultaneously increasing the security of our entire development effort.

devops practitioners will lead the charge to implement new application security technologies that meet these requirements, moving beyond traditional waf deployments to modern application security technologies that embed into the heart of the application itself. the closer the protection gets to the core of the application, the stronger and more accurate the results. automation is one of the fundamental keys to devops success and security can’t be overlooked. automation of application security will democratize security data breaking down silos between groups helping the entire organization operate more efficiently.

we can always just stick to tradition, stick to what we have held to be absolute truths in application security for the last decade. or, we can choose to innovate our application security practices to incorporate learnings from the changes that are occurring around us. i think it’s pretty clear that innovation is required if we are to properly secure the modern application environment — and that innovation will come in the form of application security automation.

this blog is one of seven in a series providing expert commentary and analysis on the results from sonatype’s 2017 devsecops community survey. for access to all of the blogs in this series and the survey report, see here . tyler shields ( @txs ), vice president at signal sciences, is a guest blogger for sonatype's 2017 devsecops community survey.