DevOps and Secured Coding
DevOps combines people, processes, and technology to shorten the software development life cycle (SDLC) while enhancing continuous integration and delivery (Düllmann et al., 2018). DevOps is essential because it brings together formerly siloed roles in Agile software development to collaborate and produce better and reliable products using automated tools like Jenkins and Bamboo while increasing confidence in the application building process. However, the fast pace of DevOps environments often lead to gaps between coding and secure coding. While DevOps engineers focus on the speed of application code development, security teams are left with little or no time to check the security of configurations, perform code review and analysis, vulnerability assessments, amongst others. Security in DevOps is challenging because traditional security methods do not accomplish the requirements and purpose of DevOps (Rafi et al., 2020), which is the collaboration between different teams to achieve rapid deployment of software and services by automating the software delivery infrastructure.
Why Incorporating Security into DevOps?
To develop applications that are secured and less prune to cyberattacks, organizations need to incorporate security techniques and best practices into DevOps environments to enhance the fast pace development lifecycle and release timeframes while ensuring secure code development and deployment (Zaydi & Nassereddine, 2020). Integrating security best practices like threat modeling, static and dynamic code reviews into the fast-moving DevOps pipeline usually creates a bottleneck and slows down the DevOps process. Thus, the fast-paced development cycles, release timeframes, and shortened feedback timeframe within a DevOps pipeline will be affected. However, safeguarding the DevOps environment by implementing relevant security strategies, policies, processes, and tools go a long way to uncovering insecure codes and vulnerabilities and averting cyberattacks on applications developed (Valani, 2018).
On the other hand, Information Technology (IT) services facilitated by DevOps become risky when organizations do not consider incorporating security best practices into the code development process (Zaydi & Nassereddine, 2020). These applications become vulnerable to common application attacks like SQL Injection, Code Injection, Buffer Overflow, Cache Poisoning, Cross-Site Scripting (XSS) as a result of application vulnerabilities like broken access control, and insecure access design, security misconfiguration, software, and data integrity failures (OWASP, 2021). Secure DevOps limits security vulnerabilities in applications, thus reducing the attack surface for cybercriminals.
What is the Cause of Insecure Coding in DevOps?
The root cause of insecure coding in DevOps includes the drive for the product to reach the market quickly and the delays caused by implementing cumbersome security testing and code analysis (static and dynamic) techniques (Zaydi & Nassereddine, 2020). The main objective of many software companies and developers is to create functional codes rapidly and deploy them in production. Thus, to developer’s time is of the essence, as injecting security practices come with delays. However, to ensure secure coding means organizations need to strike a balance between developing functional codes and secure, functional codes.
Importance of Adopting a DevSecOps Strategy in the SDLC
Introducing DevSecOps in the SDLC is the best way to reduce creating applications vulnerable to cyber-attacks. DevSecOps approach revolves around integrating security in DevOps efficiently from the beginning of the system development life cycle (SDLC). An effective DevSecOps program uses automated security programs and tools in testing codes continuously, and avoid slowing down development operations. However, implementing DevSecOps comes with the challenges of speed in code deployment, collaboration between teams, and integrating security tools into the DevOps environment (Desai & Nisha, 2021).
The use of DevSecOps tools like SonarQube, Codacy, Acunetix, GitLab, automatically review and scan codes to detect bugs and vulnerabilities, thereby addressing security concerns without slowing down continuous Integration and continuous delivery (CI/CD). While at the same time fostering collaboration between development, security, and operations teams. As a result, businesses can deal with insecure application code development and deployment by integrating security methodologies and best practices into DevOps.
Thus, the DevSecOps approach comes with the benefits of Continuous Integration, Continuous Security and Continuous Deployment (Deepak & Swarnalatha, 2019). Also, adequate training of DevOps and security team members on using DevSecOps tools and security best practices will foster an efficient DevOps environment. Finally, implementing preventive administrative, technical and operational controls to secure the various components of the SDLC, which includes codes, databases, networks, and physical environment, will reduce the chances of a security compromise within the DevOps environment.
References
Deepak, R. D. S., & Swarnalatha, P. (2019). Continuous Integration – Continuous Security – Continuous Deployment Pipeline Automation for Application Software (CI – CS – CD). International Journal of Computer Science and Software Engineering, 8(10), 247-253.
Desai, R., & Nisha, T. N. (2021). Best Practices for Ensuring Security in DevOps: A Case Study Approach. Journal of Physics: Conference Series, 1964(4), 042045. https://doi.org/10.1088/1742-6596/1964/4/042045
Düllmann, T. F., Paule, C., & Hoorn, A. v. (2018, 29-29 May 2018). Exploiting DevOps Practices for Dependable and Secure Continuous Delivery Pipelines. 2018 IEEE/ACM 4th International Workshop on Rapid Continuous Software Engineering (RCoSE),
OWASP. (2021). OWASP Top 10 – 2021. https://owasp.org/Top10/
Rafi, S., Yu, W., & Akbar, M. A. (2020). Towards a Hypothetical Framework to Secure DevOps Adoption: Grounded Theory Approach Proceedings of the Evaluation and Assessment in Software Engineering, Trondheim, Norway. https://doi.org/10.1145/3383219.3383285
Valani, A. (2018, 30 Sept.-2 Oct. 2018). Rethinking Secure DevOps Threat Modeling: The Need for a Dual Velocity Approach. 2018 IEEE Cybersecurity Development (SecDev),
Zaydi, M., & Nassereddine, B. (2020). DevSecOps practices for an agile and secure IT service management. Journal of Management Information and Decision Sciences, 23(2), 1-16.
