Podcast
Sounds like a great methodology, right? DevOps…the end-all, be-all in innovation. Except that it’s not. Not by a long shot.
Why DevOps Falls Short
DevOps alone neglects to include critical tests, controls, and reviews added by privacy, security, and compliance functions in the organization. We need DevSecOps.
The Sec in DevSecOps, adds critical reviews, functions, and controls to prevent problems before they happen.
These include:
- Identifying threat models before code is created.
- Static code analysis as code is developed.
- Code reviews as code is assembled into an application.
- Once built, the application is penetration tested to ensure that the app won’t allow intruders, leak data, or be vulnerable to attack.
- Then, someone has to make sure the application complies with applicable law. Just ask TikTok if they could have used that $5.7 million fine from the FTC over COPPA violations for something more meaningful.
- As the application is deployed, log aggregation, collection, and protection must occur.
- And a big thanks to our auditors who step in upon deployment to ensure everyone is doing what they are supposed to.
- Security teams assemble, and as operations ensue, they gather threat intelligence to prepare for battle with the bad guys.
- Monitoring protocols, tools, and escalation paths are created to ensure that performance or security events are handled effectively.
- And the process continues in perpetuity until the application is retired and decommissioned.
Without the Sec in DevOps, an organization is highly vulnerable.
5 Key Benefits of DevSecOps in Cloud Environments
As a privacy and security professional, allow me to espouse five ways DevSecOps can help your organization de-risk your cloud environments, and protect your organization.
DevSecOps can help your organization by:
- Reducing the risk of data loss or leakage.
- Decreasing the risk of data privacy and confidentiality incidents.
- Minimizing the risk of misconfigurations that expose data, credentials, or enable unauthorized access.
- Allowing you to catch API vulnerabilities in third-party applications, or in your own apps.
- Decreasing efforts around patches and software upgrades.
Learn how DevSecOps secures your cloud environment by reducing risks, improving compliance, and streamlining operations across the development lifecycle.
If you have questions about DevSecOps, and getting buy-in from your organization, reach out to me. I’d love to connect you to people who can help.
