Skip to main content

Rugged DevOps

Image
By
Rugged DevOps is a method that includes security practices as early in the continuous delivery pipeline as possible to increase cybersecurity, speed and quality of releases beyond what current DevOps practices can yield alone. (1) “Rugged “describes software development organizations which have a culture of rapidly evolving their ability to create available, survivable, defensible, secure and resilient software. (2)
As business increasingly relies on agile software development, the absence of matching fast-moving security methodologies in the delivery pipeline will essentially increase the risk of a security breach or a cyberattack. Security staff must be imbedded into cross functional teams to ensure a more sustainable and less risky continuous deployment value chain (continuous integration, continuous delivery and continuous testing). The bad guys have already acquired these skills and the use of automation to engage in a continuous attack on our defenses.

Security was named as the number one DevOps obstacle by 28 percent of enterprises. (3)  Security needs to be engaged early and often.  If the Dev organization is at a maturity level where daily builds and releases are common, come up with a suite of models that allow you to do some level of testing and can conform to the condensed cycle times. By moving away from a waterfall set of security methodologies and adopting and adapting scrum practices, security can engage earlier and more often in the development lifecycle.  If you are not part of the solution people will go over or around you.  

DevOps is a cultural movement.  Changing the way we think and do things takes time. Culture doesn’t change until the way think changes.  Think about the things that you may have in common with development and operational teams and try to build on those commonalities.  We are more alike than we are different.

As with any DevOps initiative automation is key.  Reliance on manual testing just doesn’t enable the kinds of delivery speeds businesses are looking for today.  It doesn’t mean that some of that manual testing methodology goes away, but it may be used as a back up to the automated testing when necessary.  Security teams should be thinking about ways to automatically integrate manual testing results back into the pipeline. (4)

Security must be engaged at the strategy and design stages of the lifecycle.  Security concerns and perspectives have to be incorporated into requirements before any code or design work is done.  This way we can ensure that available, survivable, defensible, secure, resilient software and architecture get created.

DevOps is all about security “shifting left” to find security issues as early in the development life cycle as possible. By integrating security tools into your continuous integration process, security teams can engage their highly effective skills to uncover and eliminate vulnerabilities early in the development cycle. The earlier you find an issue the cheaper and easier it is to fix, creating big wins for both the provider and the business.

For more information: WhatIs? DevOps research paper 

(1) Forrester Research
(2) Rugged Software.com
(3, 4) Ericka Chickowski

Labels:

Popular posts from this blog

Four Service Characteristics

By
Recently I came across several articles by researchers and experts that laid out definitions and characteristics of services. ITIL provides us with a definition that can help drive the creation of value-laden services: A means of delivering value to customers by facilitating outcomes customers want to achieve without the ownership of specific costs and risks. An area that ITIL is not so clear is in terms of service characteristics. Several researchers and experts put forth that services have four basic characteristics (IHIP): Intangibility—Services are the results of actions not things. They have no physical presence and represent a logical set of elements. One way to think of service is “work done for others.”  Heterogeneity—Also known as “variability”; services are unique items because of the mechanisms used to deliver services, which is people. Because the people element adds variability, the service is variable. This holds true, especially for the value proposition—not eve...
Post a Comment
Read more

What Is A Service Offering?

By
The ITIL 4 Best Practice Guidance defines a “Service Offering” as a description of one or more services designed to address the needs of a target customer or group.   As a service provider, we can’t stop there!   We must know what the contracts of our service offering are and be able to put them into context as required by the customer.     Let’s explore the three elements that comprise a Service Offering. A “Service Offering” may include:     Goods, Access to Resources, and Service Actions 1. Goods – When we think of “Goods” within a service offering these are the items where ownership is transferred to the consumer and the consumer takes responsibility for the future use of these goods.   Example of goods that are being provided in the offering – If this is a hotel service then toiletries or chocolates are yours to take with you.   You the consumer own these and they are yours to take with you.      ...
Post a Comment
Read more

What is the difference between Process Owner, Process Manager and Process Practitioner?

By
This article was originally published in 2015. With the Introduction of ITIL 4, some of this best practice has changed. See  ITIL 4 and the Evolving Role of Roles . Updated Definitions in ITIL 4: Process Owner: In ITIL 4, the concept of 'processes' has expanded into broader 'practices.' Consequently, the Process Owner is now often referred to as the 'Practice Owner.' This individual is accountable for the overall design, performance, integration, and improvement of a specific practice within the organization. They ensure that the practice achieves its intended outcomes and aligns with the organization's objectives. Process Manager: Now commonly known as the 'Practice Manager' in ITIL 4, this role is responsible for the day-to-day management of the practice. The Practice Manager ensures that activities are carried out as intended, manages resources assigned to the practice, and oversees the practitioners performing the work. Process Practit...
Post a Comment
Read more