Hi, I'm Andrea Crawford with IBM Cloud. So, we're going to talk about DevSecOps. DevSecOps
is all about DevOps, with the lens on security.
The benefits of DevSecOps primarily address observability. This is observability in the
context of, ñhow observable is your application delivery process in and of itself?î Do we
know what's happening between user story all the way through to code, build, deploy, manage,
and continuous improvement?
Another benefit is traceability. So, are we able to understand what user stories are being
deployed and managed in the run-time environment and can we prove it?
The next benefit as confidence, and this is all about the business having a trustful relationship
with the IT organization that what is being delivered is actually what started off in
the beginning of the pipeline as a requirement or user story.
And the last benefit here is compliance. This becomes increasingly important for specific
industries like healthcare, public, federal, banking, and the like. We need to have compliance
built into this release pipeline and it needs to be engineered from day one.
DevSecOps can really involve a lot of different activities in the supply chain, or this pipeline.
Part of those are things like well-formed user stories over here. This user stories
have to be the appropriate size, well-formed, and be understandable by the development team.
Additional security features are going to be piped in over here in the code phase. These
involve things like test-driven development, pair programming. These are specific activities
and new ways of working that mitigate the risk of someone, or somebody, introduced saying
a bug or a defect at the coding level. We also are able to achieve better test code
coverage by writing our test cases first and then writing our code.
We also have security aspects that we can infuse into the build phase here, and this
is more along the lines of linting, and making sure that our code is able to conform to standard
coding practices. We also have this notion of scanning, particularly for things like
infinite loops or undeclared variables. These are all potential vulnerabilities that could
manifest themselves in very adverse ways once we get into production. And then some additional
security practices around the deploy aspect can also be infused.
So, with the advent of cloud native and images there are even things like notary services
where we can ensure that Images are, not only immutable, but Docker images that are being
deployed are, in fact, the same in images that are produced from the build process.
And then we have in the manage section, here, activities such as mutation detection. This
is all about making sure that any runtime containers that are in your operational environment
don't all of a sudden spark some sort of vulnerability in the runtime environment that you may not
have caught in the build phase.
So, DevSecOps is all about infusing risk mitigating activities throughout this pipeline here.
So, what are some of the use cases for infusing security? Well, pretty much everything - but
in particular, if you have issues with a lack of visibility and terms of how your applications
are progressing through the pipeline and whoÍs deploying what, when, and in which environment.
If you have cases where you are troubled with audits, and being able to approve with empirical
data that what you are delivering is, in fact, what you started out with in the beginning
of the pipeline, empirically tracing back all the way through from beginning to end.
If you have issues with unified governance, and being able to use this pipeline, here,
across your enterprise, in a uniform way, so making sure that we are delivering software
by appropriating the right kind of risk mitigation. Are we doing the right kind of activities
throughout this pipeline to mitigate the risk of getting our digital reputation in trouble
at an enterprise level?
So, these are the use cases for employing some of these Dev sack ops principles there
are industry standard organizations like OWASP, or Open Web Application Security Project,
that actually have software assurance maturity models to address, not just these pipeline
activities, but also governance, construction, and even recommending secure coding practices
that you would find over here.
So, to sum all of this up, DevSecOps is all about a holistic, secure-by-design approach
to code, to delivery, and it all involves people, process, and tools
Thanks for watching this video. If you have any questions or comments be sure to drop
a line below. If you want to see more videos like this in the future, be sure to like and
subscribe.