DevOps (a portmanteau of “development” and “operations”) is the combination of practices and tools designed to increase an organization’s ability to deliver applications and services faster than traditional software development processes. This speed enables organizations to better serve their customers and compete more effectively in the market.
In simple terms, DevOps is about removing the barriers between traditionally siloed teams, development and operations. Under a DevOps model, development and operations teams work together across the entire software application life cycle, from development and test through deployment to operations.
DevOps security, more commonly referred to as DevSecOps, refers to the discipline and practice of safeguarding the entire DevOps environment through strategies, policies, processes, and technology. The DevSecOps philosophy is that security should be built into every part of the DevOps life cycle, including inception, design, build, test, release, support, maintenance, and beyond.
Traditional security operates from the position that once a system has been designed, its security defects can then be determined and corrected before release. With the change to a DevOps model, traditional security practices occur too late in the development cycle and are too slow for the design and release of software built by iteration. Thus, they can become a major roadblock to delivering applications and services at speed.
With DevSecOps, security becomes the focus of everyone on a DevOps team. DevSecOps has the goal of implementing security decisions at speed and scale without sacrificing safety. DevSecOps involves ongoing, flexible collaboration between release engineers and security teams. The concepts of “speed of delivery” and “building secure code” are merged into one streamlined process. Security testing is done in iterations without slowing down delivery cycles. Critical security issues are dealt with as they become apparent, not after a threat or compromise has occurred.
DevOps practices rely on effective tools to help teams rapidly and reliably deploy and innovate for their customers. These tools should automate manual tasks, help teams manage complex environments at scale, and keep engineers in control of the high-velocity pace that is DevOps.
The DevOps workflow consists of phases:
Planning. Schedule planning and task tracking tools are needed to ensure the DevOps team knows what tasks are at hand, what is currently being done, and whether there are any risks of falling behind schedule. Tools like Confluence and Jira help DevOps teams achieve a seamless and efficient project management cycle and ensure timely product delivery.
Build and delivery. Developers need rapid deployment of development and testing environments and can’t wait long for repairs when something goes wrong. Docker containerization ensures consistency across multiple development and release cycles and provides repeatable development, build, test, and production environments. Other popular tools for this phase include Kubernetes, Terraform, Chef, Ansible, and Puppet.
Testing. Look for tools such as Jenkins, CircleCI, and GitLab CI, which help minimize the time and effort devoted to testing without compromising the code quality or user experience.
Software monitoring and logging. Once software is moved to production, it must be monitored to ensure stable performance and increased customer satisfaction. This stage also involves performance analysis and logging, raising smart alerts on various issues, gathering customer feedback, and so on. Tools for performing these tasks include Prometheus, Grafana, Elastic (ELK) Stack, Splunk, and Sumo Logic.
DevOps is the direct descendant of agile software development, born from the need to keep up with increased software development velocity and throughput agile methods. Advancements in agile development highlighted the need for a more holistic approach to the software delivery life cycle, resulting in DevOps.
“Agile development” is an umbrella term for several iterative software development methodologies, many of which have carried over to DevOps:
Several key practices can help organizations innovate faster through automating and streamlining the software development management process. One fundamental DevOps practice is to perform very frequent but small updates. These updates are usually more incremental than the updates performed under traditional release practices. Organizations using a DevOps model deploy updates much more often than organizations using traditional software development practices.
Communication and collaboration are keystones of the set of DevOps practices. Automation of the software delivery process establishes collaboration by physically bringing together the workflows and responsibilities of development and operations. Communication across developers, operations, and even other teams, such as marketing and sales, allows all parts of the organization to align more closely on goals and projects.
DevOps practices such as continuous integration and continuous delivery let DevOps teams deliver rapidly, safely, and reliably. Monitoring and logging help DevOps teams track the performance of applications so they can react quickly to problems.
The microservices architecture is a design approach to build a single application as a set of small services. Each service runs in its own process and communicates with other services through a well-defined interface using a lightweight mechanism. You can use different frameworks or programming languages to write microservices and deploy them independently, as a single service, or as a group of services.
Organizations may also use a microservices architecture to make their applications more flexible and enable quicker innovation. Typically, each service is paired with a small, agile team who takes ownership of the service.
DevOps practices such as CI/CD let DevOps teams deliver rapidly, safely, and reliably. CI is a software development practice where developers regularly merge their code changes into a central repository, followed by automated builds and tests. The key goals of CI are to find and fix bugs quicker, improve software quality, and reduce the time it takes to validate and release new software updates. CD expands on CI by deploying all code changes to a testing or production environment after the build stage.
By capturing and analyzing logs generated by applications, DevOps teams can better understand how software changes or updates may affect users.
Moving to DevOps and DevSecOps is not a destination. It is a journey. DevOps is fundamentally changing how development and operations are done today. You can use the DevOps practices, process, frameworks, and workflow, based on the DevOps philosophy, to build security into your software development life cycle at speed and scale without sacrificing safety, while minimizing risks, ensuring compliance, and reducing friction and costs. DevOps and DevSecOps allow development, operations, and security teams to balance security and compliance with speed of delivery, and to build security into the full SDLC.
This guide gives a a step-by-step breakdown on how to achieve DevSecOps without sacrificing efficiency.Download the eBook
Gartner reported that DevSecOps, among several other use cases, is fundamental for AppSec solutions to address.Read the blog post
Webinar on injecting security into DevOps without sacrificing efficiency.Watch the webinar
Read the report