Agile development has become the benchmark for software development. No more waiting around for all of the desired features to be perfectly polished before pushing code to production – today we live in a flexible era of rapid release cycles.
This development and deployment model provides consumers and users with an ever-evolving (and ever-improving) user experience (UX). These are positive developments spurred by innovative tools like continuous deployment (CD) and continuous integration (CI), which have revolutionized the industry and enabled more innovation to happen faster than ever before.
However, with great speed comes great responsibility. Developers adhering to agile development processes may feel encouraged to prioritize speed and quality over other critical concerns, like software security. True, most tech leaders recognize the significance of software security. Yet many neglect to adopt methodologies prioritizing security during the development process.
One popular model of development is DevSecOps, which represents the intersection between development, security and operations. Let’s discuss the perks of DevSecOps and review some leaders’ misconceptions about this leading strategy.
What is DevSecOps?
Agile development teams face a challenge: deploying code on time while observing a long list of manual check-in policies. The intent of these policies can range from operational – for example, build checks that require previous builds to be successful before new changes are stacked on top – to security-based.
For instance, most teams adhere to user restrictions that ensure code is approved for deployment by an authorized individual.
Policy check-ins are integral to application security. And yet, agile developers often find themselves unable to make tactile deployments while adhering to manual policy checks. In these instances, security becomes an afterthought – a sacrifice to the bottom line, if you will.
But security and speed are not antithetical causes in software development. These two can, and do, coexist through DevSecOps. DevSecOps differs from other approaches to development by integrating security into the core software development lifecycle (SDLC). As a result, DevSecOps encourages:
- Early identification and mitigation of security vulnerabilities – DevSecOps encourages developers to “shift left” by embedding automated security scans into the earliest stages of development. Only deployments that pass all rigorous scans and checks are approved for production.
- Reduced time-to-market for secure software – Manual security checks are the enemy of timely deployment. DevSecOps addresses this issue by automating the security scanning and checks process, allowing developers to work concurrently to improve UX and security protocols.
- Enhanced collaboration and communication between teams – DevSecOps necessitates collaboration between traditionally disparate teams. This development model encourages all team members to become security and development experts, alleviating silos arising from fragmented workflows. DevSecOps also merges all responsibilities under one north star: timely, secure deployments. As a result, team members work together to address the same issues.
According to GitLab research, 96% of developers say their organization would benefit from automated security and compliance procedures. And those desires are increasingly being realized by DevSecOps adoption. In 2022, 36% of developers said they developed software using DevSecOps, compared to 27% in 2020.
But – for the sake of bolstered security and improved deployment velocity – these numbers still have a long way to go. To increase adoption rates, we must alleviate concerns about DevSecOps related to change management.
Barriers to DevSecOps adoption
Balancing security and development speed may seem like a delicate operation, but with the right toolkit, it’s more than possible – it’s highly probable. So why haven’t more development teams adopted a DevSecOps strategy?
Resistance to change, especially regarding deeply embedded processes like manual security checks, is the primary culprit. Manual check-in procedures are highly documented and controlled parts of the DevOps workflow; therefore, many developers may hesitate to switch them up. Additionally, many leaders – particularly non-technical executives – may view automated processes like vulnerability scans as a liability.
However, this couldn’t be further from the case. Automation helps to expedite necessary security measures, making it more feasible to conduct these procedures thoroughly and without missing a step in your development workflow.
Take, for example, the emergence of pipelines-as-code, a DevSecOps practice that embraces the heart of shifting left. Instead of manually managing pipelines through a graphical user interface (GUI), pipelines-as-code models allow developers to manage each pipeline through pre-configured builds, tests and deployments.
Information about these pipelines is stored in a central repository that authorized users can access for audit information – providing enhanced, more secure version control capabilities. Furthermore, pipelines-as-code models allow developers to automate compliance procedures, providing greater peace of mind that deployments are 100% compliant.
The future of DevSecOps
We’re currently sitting at around 36% adoption for DevSecOps, and over the last half-decade, we’ve seen immense progress in the development lifecycle. I would argue this progress is not coincidental. As more development teams embrace the core tenants of DevSecOps – that is, security at the heart of development – we’ll march toward a more secure future.
Statistics suggest this future is well within reach. Industry research forecasts the DevSecOps market will climb to $41.66 billion by 2030, growing at a CAGR of 30.7% between now and then. More widespread adoption of DevSecOps could ultimately lead to an industry where security is seamlessly integrated into every stage of software development, bettering our practices as developers and UX. In my view, that’s a future to look forward to.
##
ABOUT THE AUTHOR
Anna Daugherty
Anna Daugherty is the Director of Product Marketing at Armory where she helps create continuous deployment solutions for all developers, at any scale. When she’s not shuddering over DORA metrics, she enjoys tabletop roleplaying games, the city of Detroit, and Carly Rae Jepson.
