How Does DevOps Demand a Shift from the Traditional Cybersecurity Approach?

Terms of use

Terms of Use

The use of this site and the content contained therein is governed by the Terms of Use. When you use this site you acknowledge that you have read the Terms of Use and that you accept and will be bound by the terms hereof and such terms as may be modified from time to time.

All text, graphics, audio, design and other works on the site are the copyrighted works of nasscom unless otherwise indicated. All rights reserved.
Content on the site is for personal use only and may be downloaded provided the material is kept intact and there is no violation of the copyrights, trademarks, and other proprietary rights. Any alteration of the material or use of the material contained in the site for any other purpose is a violation of the copyright of nasscom and / or its affiliates or associates or of its third-party information providers. This material cannot be copied, reproduced, republished, uploaded, posted, transmitted or distributed in any way for non-personal use without obtaining the prior permission from nasscom.
The nasscom Members login is for the reference of only registered nasscom Member Companies.
nasscom reserves the right to modify the terms of use of any service without any liability. nasscom reserves the right to take all measures necessary to prevent access to any service or termination of service if the terms of use are not complied with or are contravened or there is any violation of copyright, trademark or other proprietary right.
From time to time nasscom may supplement these terms of use with additional terms pertaining to specific content (additional terms). Such additional terms are hereby incorporated by reference into these Terms of Use.

Disclaimer

The Company information provided on the nasscom web site is as per data collected by companies. nasscom is not liable on the authenticity of such data.
nasscom has exercised due diligence in checking the correctness and authenticity of the information contained in the site, but nasscom or any of its affiliates or associates or employees shall not be in any way responsible for any loss or damage that may arise to any person from any inadvertent error in the information contained in this site. The information from or through this site is provided "as is" and all warranties express or implied of any kind, regarding any matter pertaining to any service or channel, including without limitation the implied warranties of merchantability, fitness for a particular purpose, and non-infringement are disclaimed. nasscom and its affiliates and associates shall not be liable, at any time, for any failure of performance, error, omission, interruption, deletion, defect, delay in operation or transmission, computer virus, communications line failure, theft or destruction or unauthorised access to, alteration of, or use of information contained on the site. No representations, warranties or guarantees whatsoever are made as to the accuracy, adequacy, reliability, completeness, suitability or applicability of the information to a particular situation.
nasscom or its affiliates or associates or its employees do not provide any judgments or warranty in respect of the authenticity or correctness of the content of other services or sites to which links are provided. A link to another service or site is not an endorsement of any products or services on such site or the site.
The content provided is for information purposes alone and does not substitute for specific advice whether investment, legal, taxation or otherwise. nasscom disclaims all liability for damages caused by use of content on the site.
All responsibility and liability for any damages caused by downloading of any data is disclaimed.
nasscom reserves the right to modify, suspend / cancel, or discontinue any or all sections, or service at any time without notice.

For any grievances under the Information Technology Act 2000, please get in touch with Grievance Officer, Mr. Anirban Mandal at data-query@nasscom.in.

New

See all

No notification found.

How Does DevOps Demand a Shift from the Traditional Cybersecurity Approach?

Kovair Software

@kovairsoftware

September 2, 2021

IT Services DevOps

“Robust security is the shared responsibility of the entire IT industry.“

Forward-thinking firms understand the demands of DevOps and are working towards evolving their culture and development processes to address the need for security at each level by following updated privacy policy, and access controls. This trend is worth following. More and more enterprises are likely to make a risk assessment, threat modeling, and security-task automation inherent elements of their product development journey.

What is Driving the Change?

Today’s environment is becoming increasingly cloud-based. Conventional security parameters (like a local firewall) that define a perimeter/ a boundary wall are turning obsolete because cloud-native apps are designed to run anywhere on any server and on top of that are highly linked. The concept of perimeter security does not hold ground anymore as in the majority of the cases there isn’t even a boundary to define.

The orthodox security practices which were actually an afterthought once the whole online setup was made are redundant now. They are inefficient when it comes to complete security and slow down the process and manual controls severely affect the transparency. DevOps aims for a more automated and comprehensive cybersecurity setup.

What is DevSecOps?

Over the course of time, DevSecOps has been established as a form of DevOps that ensures cybersecurity is an integral part of the development funnel. DevSecOps is an integral part of the development process right from designing and iteration to final release and maintenance. In essence, this transforms network management and risk management from compliance-based activities, typically completed later in the development lifecycle, into key framework ideas that span the entire product pipeline.

DevSecOps does not just limit itself to a particular firm but makes sure that best practices and policies are also incorporated into development tools and underlying platforms, making security a shared responsibility throughout the whole IT company. DevOps practices and tools are revolutionizing the way IT companies innovate.

Let’s cut through the hype and get to some perspicacious best practices that will help the enterprise world recognize cybersecurity professionals as essential to the DevOps workflow and the software life cycle as developers, and create a software development landscape that’s fast enough for anyone and safe enough for everyone.

Break from the past when it comes to cybersecurity

The DevOps methodology emphasizes speed in software development and deployment. Developers create and deliver programs to infrastructure directly; in fact, they code infrastructure as well! Things have become so fast that waiting around for even a week to provide a remedy or a patch to address the client’s concerns is a thing of the past.

Being able to function at this speed as a cybersecurity team is crucial to being accepted and valued as part of the process. That means abandoning the usual methodology of offering 30 pages of recommendations on how to secure a project (in a cybersecurity vernacular that a developer may or may not understand).

Instead, cybersecurity professionals working with DevOps teams are now an equally important part of the story. Flexibility and interactivity are essential – cybersecurity professionals must participate in the process, communicating requirements, managing code reviews for the developers, and providing test cases on the same level as the coding and deployment wings of a DevOps team.

The security team’s goal should be to automate if the DevOps team is automating. Cybersecurity professionals must analyze software delivery pipelines where possible and qualify where codified security measures can be implemented. Many manual review cycles can be eliminated by incorporating test-driven security into the workflow.

Cybersecurity to expand beyond the IT department

Paul Teague recently wrote an essay for Procurement Leaders about how procurement and IT must work hand-in-hand to reduce the risk of personal data violations. The reasoning for it is simple: Since on average, the total breach in security cost around $3.86 million in 2020, securing data is more than just a matter of privacy; it also has profound ramifications for the enterprise’s financial health.

That being said, the benefits of a DevOps-style approach to cybersecurity become more prominent. DevOps favor automation in the security process while maintaining an accord throughout various teams, designing, development, IT, etc. on one hand and adapting the security mechanism to new cyber threats, on the other hand. As Steve Hall, a noted columnist, pointed out, the objective here isn’t so much to incorporate security into DevOps as it is to put DevOps into security.

The emergence of a trend of such closer collaborations is warranted by and large, chiefly owing to the importance of application software and more particularly cloud apps. The IT sector is exceedingly influenced by consumer technology, as evident from the blossoming of trends like Alexa, wearables, mCommerce, etc. Furthermore, malicious elements also target end-users and try to gain their confidential information through email accounts via malpractices like spear-phishing, rather than the network architecture of a company.

A future-proof cybersecurity skillset

When it comes to cybersecurity specialists, the issue of expertise is constantly up. The demands of the new virtualized environments that DevOps developers are embracing might be a major transition for individuals used to working on on-premises, physical infrastructure.

DevOps tools like Amazon Web Services (AWS) Lambda, Microsoft Azure Cosmos, Docker, and others might be intimidating to folks who aren’t familiar with programming. However, in the field of cybersecurity, nothing has ever remained static. For the past 30 years, technology has been constantly evolving.

While handling code may seem like something that only developers should worry about, concepts like containerization and infrastructure-as-a-service (IaaS) have long been part of what cybersecurity professionals have done. As a result, the leap that may be required is evolutionary.

Practically, this means better aligning the security as per the business goals. Also, it means that the data protection mission is included early in the creation of any service or application and subsequently automated (a DevOps process) for better maintenance throughout its lifetime.

Conclusion

The aim is “Secure the code as soon as you write it.”

Many startups, companies, and developers have relied on DevOps to adjust to a cloud-centric future where upcoming solutions can be readily made available to a large number of users while retaining good quality. To keep pace with the risks posed by phishing, man-in-the-middle, malware, and denial-of-service attacks, cybersecurity increasingly requires both speed and attention to detail; hence enters DevSecOps.

In redesigning cybersecurity for these updated issues, there is a lot to learn from DevOps. And it will not be an evolutionary leap taken alone. Professionals who feel passionately about cybersecurity may take up CompTIA cybersecurity certifications to validate the standards of their skills across industries, ensuring that they have what it takes to secure the infrastructure.