Best Practices in DevSecOps As agencies get more experience with DevSecOps, essential principles have begun to emerge. They include: ☑ Treat security as a shared responsibility. Successful DevSecOps teams recognize that security is the responsibility of all team members, not just the security professionals on the team. Not everyone needs to be an expert, but they need to buy into the security objectives.
☑ Test everything. Continuous security testing is an essential element of DevSecOps, but it has to apply to everything, including the front and back ends, units, APIs, databases and passive security. Threats exist across a spectrum of techniques and tactics, so security testing has to match.
☑ Enlist leaders to support cultural change. Since DevSecOps requires that kind of transformational change, it means getting support from the top of the agency. Key steps — such as developing a comprehensive plan, educating developers, and ensuring cooperation among IT, security, and business teams — depend on leaders’ support. And when there is a leadership change, educate the newcomers and earn their commitment.
☑ Tailor tools to the job at hand. The suite of tools to be used should be tailored specifically to the job at hand and understood and used by all the team members equally: developers, operations teams and security experts.
☑ Starting small provides room to fail, adapt, learn and grow. Although Platform One is a very visible success story for the Air Force, DevSecOps started with a single specific project, laying the groundwork for the expansion to come. ☑ Use automation as much as possible. Security is essential, but the goal remains to speed up development and deployment times. Automation can do both for software development through tools such as dynamic application security testing, static application security testing and automated configuration. By embedding security controls early in the process, automation can ensure the consistency and reliability of testing and secure coding in a CI/CD deployment environment.
☑ Adapt continuously. One fundamental lesson in IT operations is that there never is a finish line. Change is the only constant, so agencies need flexible policies and processes that can adapt quickly to changed circumstances. ☑ Plan on building to scale. Agencies with DevSecOps initiatives need to work with a cloud platform that enables that scalability. ☑ Emphasize transparency. At a micro-cultural level, the most successful DevSecOps teams are transparent with one another, understanding each team’s core functions, strengths and limitations. And they play to those strengths.
☑ Teach security as part of the DevSecOps team’s ongoing training and skills improvement. In addition to building team rapport, it helps educate programmers on secure coding practices, which in turn builds team chemistry and further speeds the process.
30
A GovLoop + Carahsoft Guide
