Businesses today are in a highly regulated world where data privacy and trust have become critical to retaining customers and avoiding fines. To keep up, organizations are “shifting-left” on security and compliance by building these features into the development process early, rather than addressing them through later reviews.
There is a natural tension between the need for speed and the need to ensure compliance. To balance the dance between these two, IT teams need a strong platform that helps them deliver software faster while remaining compliant and protecting critical data and processes.
Integrated compliance monitoring provides a framework to do this, enabling teams to move quickly while providing traceability and more reliable controls. DevSecOps leverages the strengths of both compliance teams and DevOps teams to yield a process that works better for both.
A solid DevSecOps solution brings together all the key elements of a compliance framework by embedding compliance best practices, policies, and tools into each phase of your development lifecycle.
Ideally, you want an innovation pipeline that builds compliance in, while boosting quality and productivity and shrinking time to market. To balance speed and compliance, consider these four aspects of compliance.
1. Get your people working together
The essence of DevOps is breaking down the silo between Dev (those who change/evolve systems) and Ops (those who maintain the stability of systems). In the same way, the essence of DevSecOps is ensuring that the goals and voice of security and compliance are heard and seen as harmonious with the goals of the development and operations teams.
Just as people often fear auditors, development teams can fear and resent security and compliance officers getting involved in the development workflow. Security and compliance can feel like something that’s enforced from outside, as a “necessary evil,” and as something antithetical to the goals of innovation and performance.
Performing a security review or a compliance check as a late-stage task before go-live can lead to serious inefficiencies, as key design decisions may have to be revisited, delaying the final delivery.
To break down this silo, align everyone around shared goals up front. A common goal could be “delivering a secure, high-performance solution that respects privacy and complies with applicable laws.” Security and compliance officers can make clear what requirements need to be met, and explain the reasons behind them.
Development and operations teams can collaborate with security squads to find efficient ways to meet these requirements that can be integrated with the teams’ daily workflow.
This panel discussion with auditors from major accounting firms debunks the myth that compliance officers cannot understand a DevOps process, and that they don’t care about burdening teams with bureaucracy. Mutual education and collaboration can actually enhance everyone’s performance, and it’s key to integrating security and compliance with the development workflow.
2. Examine your processes
Identity and access management is central to any development process. Every person who contributes to or can access systems or software must be identified, and controls must be in place to prevent unauthorized access, shared logins, or user spoofing.
Each user must also have an assigned level of access that’s appropriate for their role and the needs of the organization.
Having established these controls, the workflow should then offer traceability that makes it easy for individuals and teams to collaborate and understand who has made which changes, at what time, and for what reasons.
Many compliance regulations emphasize clear documentation of business processes, and how incidents should be handled. A mature DevSecOps system allows you to weave such policies into the workflow in an automated fashion. Instead of simply dictating that a particular test should be run prior to declaring work completed, you can automate the execution of that test as part of the workflow.
This is both more efficient and more reliable than relying on manual compliance, and tracking test results in a central system provides traceability in the event of an audit.
Make information visual when you can
Wherever possible, it’s important for teams to be able to visually define and review these processes. As the saying goes, “A picture is worth a thousand words (of documentation).” When building DevSecOps collaboration between team members with vastly different skill sets and goals, having a clear user interface is more than just a convenience.
Compliance and security auditors are human users, just like the rest of us. They too depend on information being accessible and reliable so that they can ensure that controls are being enforced.
A user interface that accurately depicts controls, and audit trails that show a full history of events, can make it far easier to meet compliance requirements. For example, these can show whether particular tests were run, who made changes to a particular record, and whether certain access is systematically restricted.
In these ways, the visibility and automation that ease the daily work of developers can also be key aspects of ensuring security and adherence to regulations. Similarly, processes that provide ongoing monitoring of production systems can help both administrators and security officers ensure that systems remain reliable and trusted.
The marriage of DevOps and security is inevitable. Such standardization reduces compliance exceptions caused by human error.
3. Mind your data-access controls
Public concern and regulations around data privacy and security are serious and still growing. As you’re building applications, you need to consider data access controls from the beginning.
Although you may implement restrictions at the outset of a project, the law of entropy dictates that such controls will weaken if not continually reinforced. Provide automated mechanisms to ensure that controls remain in place; this will ensure that you will catch potential data leaks long before they hit production.
Your developers and testers need realistic data as they do their work. It’s incumbent on the team to ensure that you have a way to regularly refresh this data while still scrubbing sensitive information (such as PII).
4. Create and audit secure systems
It is critical that the underlying systems on which you build are highly secure and reliable, so do your due diligence when searching for a solution that provides the highest levels of service, security, and privacy. A DevSecOps solution should meet top industry regulatory standards such as ISO 27001, GDPR, HIPAA, EU/US Privacy Shield, the Sarbanes-Oxley Act, and the Federal Information Security Management Act (FISMA).
Don’t be afraid to ask how these certifications were granted and who conducted the relevant audits.
You also need to refine your compliance and security controls over time. Ensure that your tool providers adopt best practices and assume responsibility for maintaining a well-controlled and secure environment on behalf of their customers.
A bulletproof DevSecOps platform must be resilient from many points of view. Independent penetration testing can give you confidence that the platform is secure. Transparency and communication are as important as security.
Does the platform have an incident response process, and a plan of attack about how to respond to system alerts and events, including security events? This process should also include a crisis communications plan that includes instructions on how to notify customers in the event that a large-scale incident occurs.
The unsung heroes of risk
DevSecOps is a natural outgrowth of optimizing for performance without sacrificing security or compliance. DevOps aims to address the tension between innovation (dev) and reliability (ops) by aligning teams to a common goal and adopting common systems.
In the same way, DevSecOps addresses the tension between how software is meant to be used, and how it could potentially be misused.
Security and compliance officers are the unsung heroes when it comes to protecting organizations and individuals from risk. Healthy organizations will align people around the joint goals of performance and security. By embedding compliance into your teams’ daily processes, paying special attention to data, and ensuring the security of underlying systems, you can achieve that joint goal.
