DevOps & Security: Butting Heads for Years but Integration is Happening

DevOps has been a hot topic now for the better part of a half-decade - and IT security has been on fire for longer than that. However, the two disciplines have been going down parallel paths for years, never to meet, because infrastructure teams and application development groups tend to work in their own little silos and claim ignorance as to what they others group does.

Why? There appears to be no good reason other than, "that’s the way it’s always been." I believe there is some element of CYA in here, where if something doesn’t work, it’s easy to point a finger to a group you have nothing to do with. But by in large it’s just a legacy IT mindset. 

This sentiment seems to be changing and IT leaders are actually attempting to bring infrastructure and applications together. I attended a recent conference where Mike Giresi, the CIO of Royal Caribbean Cruise, discussed this issue and noted that "the fact [that] the infrastructure and application teams don’t work together is completely insane." He said there was a mandate inside Royal Caribbean that the DevOps and infrastructure teams would be goaled on the same thing – the success of applications. The common goal was in place to ensure collaboration and avoid finger-pointing. 

I get why DevOps teams may be hesitant to work with infrastructure groups. The primary focus of DevOps is speed and continuous innovation. Infrastructure, particularly security, thrives on keeping the lights on so "if it ain’t broke don’t fix it," which is in stark contrast to the agile mindset of DevOps. 

Recently, DigiCert, a vendor of encryption solutions for enterprise and Internet of Things (IoT) security, ran their "2017 Inviting Security into DevOps Survey" to find the status of enterprises integrating security with DevOps. 

Before I get into the survey results, le me get on my soapbox regarding the need to bring infrastructure, particularly security, and DevOps together. Digital transformation requires businesses to move with speed. Speed requires IT agility. IT agility requires app development and infrastructure to be agile and, in most organizations, security is anything but agile.  In fact, security is often left to the very end so companies can build a new app and then have to wait months until the security teams have made their changes and are ready. A better approach is to build security into the application development process.

The survey shows that a surprising 49% of organizations have completed the process of integrating security and DevOps, and another 49% are in the process of doing so. I suspect the group that says they were "finished" simply does not know what they do not know, so there’s likely more work to be done that they aren’t aware of it.  From personal interviews, I think that the number of companies that have completed the process is about 25% or less. 

Whatever the real number is, the survey shows that the results have been positive as respondents are 22% more likely to report they are doing well with information security, 21% more likely to report they are meeting application delivery deadlines, and 21% more likely to lower application risk.

The study also looks at the ramifications of not changing, and these results really hit home.  Respondents to the survey were concerned that failure to integrate security and DevOps would add to the following already existing problem:

I find it interesting that more respondents are concerned with cost and speed than increased security risks but that’s likely a function of how critical agile development has become to organizations. Another way to think about this result is that security doesn’t matter if costs skyrocket or application development is too slow, as the organization will fall behind its competitors. 

To DigiCert’s credit, the company didn’t just run the survey and show the results.  The company also provided some recommendations and best practices on how to bring these formerly independent worlds together:

DevOps and security have been butting heads for years but they don’t have to. A combination of culture change, automation, tools, and processes can bring security into the modern world where it can be as agile as other parts of IT. The DigiCert survey shows the importance of going down this path and the repercussions of not doing so. There’s never been a better time to bring security and DevOps together, so let's start now. 

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

Related Content: