Application security was often an afterthought in the traditional software development approaches. Testing usually wasn’t conducted until the final stages. Unfortunately, when vulnerabilities were discovered at that stage, developers had to go back to square one and rewrite countless lines of code.
That is changing as more organizations adopt the DevOps development methodology to deliver better software faster. A key element of the DevOps concept is to address security at every stage of the development lifecycle. By testing software early and often, you can identify and resolve flaws faster, with much less effort and expense.
Efforts to bake security into every phase of development have given rise to DevSecOps — a portmanteau that stands for Development, Security and Operations. The increased collaboration between these three critical elements of the IT team helps ensure the delivery of more secure and reliable applications.
Technologent can help customers address their software needs with our DevSecOps methodology. Our approach offers specific security tools and recommendations for each of the eight phases of the DevOps development lifecycle:
1.) PLAN
In the planning phase, key stakeholders hash out their vision for the project before developers start writing code. Security practices include building a database of all security and compliance requirements to ensure they are addressed throughout the development lifecycle. Automated threat modeling tools are also used to identify potential vulnerabilities early in the process and to anticipate how an attacker might compromise an application.
This is the phase in which developers begin designing the application and writing code. Using secure coding best practices helps prevent the inadvertent introduction of common vulnerabilities such as bugs, defects or logic flaws. The Open Web Application Security Project (OWASP) is among the many groups offering secure coding guidelines.
Once code has been written and committed to the source repository, it undergoes a series of automated tests to identify any flaws or potential integration issues. Key security tests in this phase include Static Application Security Testing (SAST) to discover security flaws in the source code and Software Composition Analysis (SCA) for visibility into open-source dependencies.
Once approved, the code is deployed to a staging environment for additional out-of-band testing. Key security checks in this phase are Dynamic Application Security Testing (DAST) and Interactive Application Security Testing (IAST). DAST looks for vulnerabilities in running applications, and IAST analyzes app performance using embedded agents.
After the application has been thoroughly tested, the release phase focuses on securing the runtime environment. Configuration management is an important element of this phase, helping identify any systems that need to be patched, updated or reconfigured. Penetration tests to assess any network security weaknesses are often conducted during this phase.
The code is moved into the production environment at this phase. This is when many organizations implement a continuous integration and continuous delivery (CI/CD) pipeline that uses automation to make rapid app updates and get new code into production as quickly as possible. Additionally, runtime verification tools can be used to extract information from a running system in order to detect potential security issues.
In this phase, the operations team takes over and implements a variety of security controls to protect the application environment. One of the most important security measures implemented here is a Runtime Application Self-Protection (RASP) tool, which detects and blocks application attacks as they occur. Web application firewalls, endpoint detection and response tools and app-based segmentation are other important security controls introduced during this phase.
Once apps are deployed and in use, IT teams must maintain a security focus with continuous monitoring to identify and resolve any issues. Information security continuous monitoring (ISCM) solutions collect, correlate and analyze security-related information from across the application environment, including servers and databases. This information is necessary to support ongoing risk management decisions.
Businesses today require continual software improvements to remain competitive, but security can’t be an afterthought. A DevSecOps approach can ensure the delivery of quality software with robust security. Contact us to learn more.