3 Tips for Integrating Security Into the DevOps Life Cycle

by Amiran Alavidze on July 29, 2019

DevOps has transformed how many organizations handle software development. At the same time, it is challenging organizations on how to best manage digital risk. It’s important to be strategic about approaching DevOps security.

Here are three key tips regarding what to do and what to avoid when implementing security in the DevOps life cycle.

Holistic approach. Consider the end-to-end value stream. Your product is not just the source code; it is the packages, images and configurations running in a production environment. Security needs to be addressed throughout that value stream, from the architecture and source code, to third-party components, build pipeline and operational environments.
Shift left. Security issues are a ticking time bomb. The cost of fixing them multiplies several times over at each step of the value stream. Implementing processes aimed at identifying potential security issues as early as possible improves the flow by addressing issues at the point of origin.
Optimize for speed. Security controls that significantly slow down value delivery will not survive for long. Automate whatever can be automated. As autonomy is being recognized as one of the cornerstones of efficient engineering, the role of security professionals becomes more of an enabler, with ultimate responsibility for product security residing with Engineering and Operations. As much speed is a challenge requiring us to rethink how we do security, it is also a blessing. When a newly discovered security issue can be addressed and the fix deployed within a day (or hours!), security exposure is reduced significantly.

For a security program to be effective, it has to be closely aligned with organizational goals. Companies are using DevOps to increase velocity and deliver value to customers more quickly. Therefore, it is essential that security processes support those goals to secure the software delivery value stream for safe digital innovation.

— Amiran Alavidze

July 29, 2019March 4, 2020 Amiran Alavidze DEVOPS, DevSecOps, security, tips

Amiran Alavidze

Amiran Alavidze is Tasktop’s Director of Security and Risk Management and has been practicing pragmatic, business-focused approach to Information Security for over 15 years. He specializes in information security risk management, IT controls assessment, security operations and incident response, cloud security and security architecture. Previously, Amiran served in various information security positions at Sierra Wireless, Nexen, Renaissance Capital, and TNK-BP. He has presented at conferences, such as BSides Vancouver, Cyber Security for ICS Canada and Cyber Security for Energy. Amiran has a master’s degree from Moscow Institute of Physics and Technology.

amiran-alavidze has 1 posts and counting.See all posts by amiran-alavidze