Michelle Ribeiro - Learning DevSecOps: Integrating Continuous Security Across Your Organization

The cultural aspect, especially the idea of shared ownership that brought Dev and Ops teams to work together, is the keystone of any DevOps program. So, we just need to get InfoSec to the room and wait for better results, right? Perhaps, but in reality, creating this collaborative environment took almost a decade to gain traction.

In my view, its important to remember that technical transformation takes time so we can allow our teams to adapt at their own pace. For example, in established organizations with separated groups, Ive found it risky to start a DevOps journey and simultaneously put security into the mix. It can be much more costly and time-consuming than it would be in a startup that is beginning from scratch.

To help understand how the IT industry got into this moment, illustrates how we used to create software in the old times of the waterfall model, composed of a linear workflow. First, during the Concept and Planning stage, system analysts gathered a list of stakeholders requirements. Then developers would spend months working on the softwares Architecture and Design. Only when the code was fully baked would the IT operations team get involved to begin to prepare for Implementation (usually involving late work or weekend journeys).

During the Testing and Bug Fixing phase, the company would conduct several assessments, including application security audits. Then the security auditors would provide a list of vulnerabilities along with a remediation plan, and, you guessed it, the company could take even more valuable time to implement it. Or to release it anyway.

Figure 1-1. Waterfall models workflow

In 2001 the Agile movement acknowledged the fact that any software project is constantly changing and urged retirement of the idea of linear workflow. Through the fast and continuous release of software, the Agile development lifecycle allowed developers to receive earlier feedback from their customers and identify problems before the product reached implementation, as shown in .

Figure 1-2. The Agile development lifecycle indicates the steady flow of feedback

In 2008 Patrick Debois presented the notion of Agile Infrastructure at the Agile Conference in Toronto. He was looking for means to support the development team to accelerate the push of new code into production, a concept also proposed by Andrew Shafer. In 2009, at the OReilly Velocity Conference, John Allspaw and Paul Hammond from Flickr gave their now-famous talk entitled 10 Deploys a Day, consolidating the notion that IT operators could be as agile as developers.

Allspaw and Hammond demonstrated that by stimulating a cultural change based on communications and cooperation between the two teams, Flickr automated its infrastructure and reached the process of continuous integration and deployment, as shown in Figure 1-3. At the end of that year, Debois organized the first DevOpsDays conference in Ghent, Belgium. Since then, other DevOpsDays events worldwide have promoted the culture, methodologies, and tools, mainstreaming the term DevOps.