{"id":8066,"date":"2020-08-28T09:00:00","date_gmt":"2020-08-28T07:00:00","guid":{"rendered":"https:\/\/www.codemotion.com\/magazine\/?p=8066"},"modified":"2021-12-23T11:22:42","modified_gmt":"2021-12-23T10:22:42","slug":"devops-mindset","status":"publish","type":"post","link":"https:\/\/www.codemotion.com\/magazine\/devops\/devops-mindset\/","title":{"rendered":"A DevOps Mindset Benefits Many Professions"},"content":{"rendered":"\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\tTable Of Contents\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t
  1. Continous Security and DevSecOps<\/a>
  2. Best practices for Continuous Security inspired by DevOps<\/a>
  3. Is it time for DesignOps?<\/a>
  4. MLOps: What data scientists can learn from DevOps\u00a0<\/a>
  5. Want to launch a developer event despite the challenges of COVID-19?<\/a><\/ol>\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\n\n\n

    Many workplaces<\/span> have begun to view their work through a DevOps<\/span> framework, looking at the benefits of small, incremental steps, fast delivery, and a mindset that embraces microservices<\/span> and serverless architecture<\/span>. While <\/p>\n\n\n\n

    Continous Security and DevSecOps<\/h2>\n\n\n\n

    Kim van Wilgen, Customer Director at Schuberg Philis, spoke at last year’s Codemotion<\/span> Amsterdam about how delivering small and fast means we are more frequently introducing new vulnerabilities<\/span>. Traditional cycles of pen tests and code reviews<\/a> are not keeping up. <\/p>\n\n\n\n

    The move to the cloud<\/span> further accelerates security<\/span> challenges. She gave the example of a security<\/span> software vendor that previously had on-premise applications<\/span>.<\/p>\n\n\n\n

    “Every one of the thousand customers had 1000 of Holland’s whole customer<\/span> base in their databases<\/span>. And then we said, we’re going to collect them all and put them at single spots on AWS<\/span>. <\/p>\n\n\n\n

    That meant that almost every person in Holland was in the databases<\/span> on one spot. That’s far more attractive for them for a hacker to actually proceed on an attack<\/span> because it’s just more to gain.”<\/p>\n\n\n\n

    Enter DevSecOps, which focuses on integrating Continuous Security<\/span> in dev processes<\/span> and teams. Kim defines Continous Security<\/span> as: “A set of practices and principles in software engineering<\/span> aimed at designing, developing, testing, and running software<\/span> more surely. They help reduce the cost, time, and risk of delivering integrity. availability and confidentiality to applications<\/span> in production.” She asserts, “Continous Security<\/span> is essential for delivering Continous Delivery.”<\/p>\n\n\n\n

    You’ll want to watch the whole video below to see how DevOps<\/span> can benefit security<\/span>:<\/p>\n\n\n\n

    [jwp-video n=”1″]<\/p>\n\n\n\n

    Best practices for Continuous Security inspired by DevOps<\/h2>\n\n\n\n

    Have security champions<\/strong><\/h3>\n\n\n\n

    Shared responsibility is no responsibility. “You need a person who sees what’s developing out outside, what is happening. Are we at risk? Do we advance on the right topics? Do we make the right improvements? Are we at the step where we need to be?”<\/p>\n\n\n\n

    Kim’s workplace<\/span> has a person in every team<\/span> in the role of lead security<\/span>: SecLeads or SecBuddies. “They connect with the security<\/span> managers to rubber duck or to ask for expertise because these folks really know their thing. But the important thing that the importance of security<\/span> is shared within individual teams<\/span> instead of in a silo.” <\/p>\n\n\n\n

    Don’t try to eliminate all risk<\/strong><\/h3>\n\n\n\n

    “If you eliminate all the risk, you’re not pushing anything out to production anymore.”<\/p><\/blockquote>\n\n\n\n

    Alignment of security and business value is integral to DevOps<\/h3>\n\n\n\n

    “Our main focus is delivering functionality<\/span>. Security<\/span> should support delivering value and should not compromise delivering failure. don’t eliminate all the risk.”<\/p><\/blockquote>\n\n\n\n

    Be DevOps driven<\/strong><\/h3>\n\n\n\n

    DevOps<\/span> is a mindset<\/a>. It’s about making sure we’re delivering value with all the competencies<\/span> in one team to do that. And security<\/span> is definitely a part of this.<\/p>\n\n\n\n

    “It’s vital to consider what things we can do early in our pipeline to make sure that we reduce the cost of adding security<\/span> because if we fixed all the things at the latest stages will be very expensive. So and instead of throwing it over the fence and hoping that it will be right, just talk to each other and pair with the security<\/span> expert early in the process<\/span> to see what do we really need to address what has to be in there? What’s the MVP on security<\/span>?”<\/p>\n\n\n\n

    Integrate into the pipelines <\/h3>\n\n\n\n

    If you automate security<\/span>, you will learn a range of concepts including:<\/p>\n\n\n\n

    SAST<\/strong>: a Static Analysis Security Testing<\/span> tool<\/span> which means you’re checking your source code<\/span> against vulnerabilities<\/span>. Kim recommends many tools<\/span> including Checkmarx, Veracode<\/span>, Appscan, fortify, PR application<\/span> inspector, and covarity. <\/p>\n\n\n\n

    “These tools<\/span> are very good at checking your source code<\/span> and seeing if it has vulnerabilities<\/span> for SQL<\/span> injections or stuff like that.”<\/p>\n\n\n\n

    DAST: Dynamic application security<\/span> testing. This testing simulates attacks<\/span> against an application or state. (These are typically web-enabled applications and services). It then analyzes results and determines whether it is vulnerable. Helpful tools<\/span> include Fortify<\/span>, AppScan, ZAP, Qualys, and Rapid7A. <\/p>\n\n\n\n

     Identify and remove: start small.<\/strong><\/h3>\n\n\n\n

    Kim recommends that you start by doing, detailing when her company introduced SonarQube<\/span>: “I’ve added over a 100 security rules in SonarQube and sent the top X screwups to the team<\/span>. They are more aware and will solve their own issues.” <\/p>\n\n\n\n

    They also set up an internal learning platform to practice attacks<\/span> and grow awareness and knowledge of security<\/span>.<\/p>\n\n\n\n

    Learn and adapt first before you break the build.<\/h3>\n\n\n\n

    While Kim suggests people jump into security practices with enthusiasm, she stresses, “If you start by breaking the build, nobody gets any value to production. Nobody can comply with customer<\/span> agreements because you decided it was a good plan to improve security<\/span> policy<\/span>. That’s not a good thing to do. You won’t be the most likable person from that moment on.”<\/p>\n\n\n\n

    Fix your vulnerabilities<\/h3>\n\n\n\n

    Kim stresses that while you make a lot of effort finding all the vulnerabilities<\/span> in your software<\/span>, don’t forget that somebody has actually to take time to fix them.” If you skip this, you achieve nothing.”<\/p>\n\n\n\n

    Immutable infrastructure<\/h3>\n\n\n\n

    Immutability is difficult in legacy<\/span> environments. However, one of the benefits of using containers (especially in microservices-based applications<\/span>) is that they make it easier to secure<\/span> applications<\/span>. Kim also stresses an immutable infrastructure<\/span> mindset where:<\/p>\n\n\n\n