Learn How You Can Get a Running Start with DevSecOps

by Matthew Rose on February 18, 2019

DevOps is an evolving philosophy, and now is the time–just as you start embracing DevOps in your organization–to start building security into both your DevOps philosophy and processes. DevOps philosophy started with the core principles of W. Edwards Deming’s points on Quality Management, binding the development of services and their delivery to IT Operations. As we apply Deming’s principles to software development and IT organizations, we’re working to improve the overall quality of software systems. Read on to learn how to get a running start with DevSecOps.

Automation is Essential for DevSecOps

We think that automating the process, particularly using Continuous Integration (CI) and Continuous Delivery (CD) tools, is essential for successful adoption of DevSecOps.

Continuous integration. Allows a developer to integrate changes into the source code mainline as they finish writing a piece of code.
Continuous delivery. Allows system components to be updated as needed, rather than waiting to deliver component updates in the next full release.
Continuous deployment (also known as CD). Allows applications to be continuously deployed, often to just part of the user base at first, then later to the entire user base if the deployment is successful.

“While enabling organizations to develop software with more efficiency and speed, the DevOps process also dramatically expands risk through software exposure,” said Emmanuel Benzaquen, CEO, Checkmarx.

Beyond the Acronyms Lies a Secure SDLC

For many organizations, DevOps, CI, CD (and CD again) just amount to a lot of acronyms and words that are difficult to turn into their ultimate goal—a secure software development lifecycle (aka an SSDLC). As is so often the case, the Open Web Application Security Project (OWASP) provides a model for integrating security into any existing SDLC, which they call the Software Assurance Maturity Model. Applying this model in an organization is comprised of six basic steps, as follows:

Assess: Ensure a proper start of the project by defining scope, identifying stakeholders, and spreading the word so people understand what you’re doing and why.
Assess: Identify and understand the maturity of your scope in each of the 12 software security practices.
Set the target: Develop a target score to use to measure against, to guide you to act on the most important activities for your situation.
Define the plan: Determine a change schedule and develop or update your roadmap plan. It’s important to have a realistic change strategy in terms of number and duration of phases. Identify quick wins you can make early on.
Implement: Work the plan by implementing all activities in this period, considering their impact on processes, people, knowledge, and tools.
Roll out: Make sure that improvements are available and visible for everyone involved. Organize training and communicate the improvements to the team, then measure the adoption and effectiveness of the improvements implemented.

Successful Implementation of an SSDLC

It’s easy to say you’re going to implement a secure SDLC, using automation and integration. However, each of those six steps above takes time, energy, evangelizing, training, and much more. CIOs and CISOs seek ways to accelerate the maturity of their DevOps programs, but need help to get started. One way to accelerate that process is with expert services for software security deployment and automation.

Implementing automation into DevSecOps processes is a critical challenge for most organizations. An outside expert can work closely with organizations help advance the automation capabilities in their organizations and throughout their SDLC. Successful automation is just one part of implementing a secure SDLC. As outlined by OWASP in the steps above, it’s an ongoing process. Checkmarx provides customers with professional services, who share the essential guidance to develop and deploy software security programs with automation. Let’s get your organization off to a running start with DevSecOps.

Sponsorships Available

Matthew Rose

Matt has over 18 years of software development, sales engineering management and consulting experience. During this time, Matt has helped some of the largest organizations in the world in a variety of industries, regions, and technical environments implement secure software development life cycles utilizing static analysis.Matt’s extensive background in application security, object-oriented programming, multi-tier architecture design/implementation, and internet/intranet development has been key to many speaking engagements for organizations like OWASP, ISSA, and ISACA.