How To Implement DevSecOps

Security, previously an afterthought in the product development lifecycle, is now becoming an integral part of the process. New methodologies, like DevSecOps and shift left, offer clear advantages to companies seeking to protect valuable data while still moving quickly.

In a separate article, we covered the meaning of DevSecOps, the benefits of this practice, and some trends that show how this methodology will mature in the next few years. This guide will share some insight into implementing DevSecOps: best practices, tools, and the DevSecOps pipeline to guide your software developers.

Background: the DevSecOps model

DevSecOps stands for development, security, and operations. The goal of this approach is to integrate security at every phase of the software development lifecycle using automation.

DevSecOps aims to fully integrate security testing into the continuous integration (CI) and continuous delivery (CD) pipelines. In addition, DevSecOps breaks down productivity barriers and knowledge gaps within the development team, enabling testing and fixing to be done alongside coding and development.

In brief, the DevSecOps model is characterized by three key things:

1. Security testing is carried out by the development team.
2. Any issues found during testing are also managed by the development team
3. Remediation and fixes for those issues are carried out by the development team.

This means that all stakeholders who participate in the software development lifecycle are responsible for the security of the final product. The goal is to reduce security weaknesses in a functional, streamlined way.

The DevSecOps pipeline

What does DevSecOps look like in practice? DevSecOps can be integrated at every stage of the software development lifecycle.

1. Planning: Start with an initial security analysis and create a plan for where, when, and how testing will occur throughout the development process.
2. Coding: Deploy Git controls and other security protocols to secure passwords and API keys.
3. Building: Add static application security testing (SAST) tools to find any flaws in your code before deploying.
4. Testing: Use dynamic application security testing (DAST) tools to test your application while in runtime. DAST tools find errors related to user authentication, authorization, SQL injection, and API-related endpoints.
5. Releasing: Before releasing the product, run complete penetration testing and vulnerability scans.
6. Deploying: Send a secure build to production for final deployment after all testing is completed.

Security is integrated throughout the process. And while it may seem like this adds extra steps to the software development lifecycle, this method saves time in the long run.

DevSecOps best practices

For DevSecOps to be truly impactful, it requires thoughtful integration — starting with an understanding of the shift left approach.

Shift-left testing

Shift-left security is a key best practice for DevSecOps. Shift left security requires testing an application’s security iteratively and regularly  — rather than waiting to test at the end of the software development process.

A shift left strategy does not mean simply shifting testing to an earlier stage — in that sense, the term is something of a misnomer. In reality, a shift left strategy involves an iterative approach in which testing occurs at every stage of the development process.

Train developers on security practices

One of the difficulties of implementing DevSecOps is that it requires some degree of security education on your software development team, in addition to implementing the shift left methodology. Developers must be able fix security-related bugs without outside guidance for the process to be truly streamlined and productive.

Some teams start by embedding a “security champion” within their development teams. This person has expertise in security with advanced experience in this field.  They can oversee the security portion of DevSecOps while the rest of the team gets up to speed. However, it’s worth noting that this is not a replacement for providing your development engineers, operations teams, and compliance teams with training in security best practices and testing procedures.

Try a Red Team/Blue Team approach

One way to enable the quick discovery of a security weakness during the software development lifecycle is to use the red team/blue team approach. The red team is an external group of “ethical hackers” that aims to try to penetrate an IT environment. The red team steps in at different stages of the DevSecOps pipeline to see if there are any vulnerabilities in the code. Their effort helps the blue team — your software developers— proactively mitigate issues.

Automate responsibly as much as possible

Speed is a core benefit of DevOps, and since DevSecOps is the next iteration of this approach, it follows that speed is still of the essence. For security to be part of DevOps, it must be automated to prevent the development process from slowing or breaking down.

There are a range of different tools that can test security during the software development process. These tools can automate everything from source-code analysis through integration to post-deployment monitoring. Involve the InfoSec experts at your organization to pre-approve tools that will ensure your code and environments don’t put your organization at risk.

It’s worthwhile noting that not everything can or should be automated. Ideally, automation should keep the pipeline fast and productive. Look for instances where automated tools can reduce fatigue-inducing manual activities that are repetitive and low-value.

Choosing the right DevSecOps tools

Generally, DevSecOps tools integrate into the process to offer key functions: alerting, software development, visibility, threat modeling, testing, or all of the above. Companies can work with different vendors to test for vulnerabilities along the way, or find a full-lifecycle tool that helps with the entire process.

Ultimately, DevSecOps aims to eliminate data loss. A data loss prevention tool like Nightfall can layer with your DevSecOps tools to help software developers work in a secure environment — as well as to monitor cloud programs after a piece of software is launched.

Nightfall provides a native GitHub integration that scans push events for API keys, credentials, and PII in order to remove them from your GitHub Organization.  Using machine learning, Nightfall discovers, classifies, and protects data in popular SaaS applications like Slack, Google Drive, GitHub, Confluence, Jira, and many more via our Developer Platform. Nightfall also provides other tools, like a GitHub Action, a CircleCI Orb, and integrations with Cribl and Snyk that can be used at different parts of the software development lifecycle to prevent the issue of secrets proliferation within your code.
Schedule a meeting below to get a demo and learn more about Nightfall.