Integrate, integrate, integrate

Issue 8 2022 IT infrastructure

It is time to adopt a security-focused approach to DevOps, one that integrates the security alarm bells and whistles into the flair and speed of development without the traditional frictions and complexities. A survey undertaken by ESG found that 68% of respondents were considering adopting developer-focused security solutions and shifting security to developers.

This is a good thing. As good a thing as DevOps itself – an approach that Forrester describes as one that “consistently reduces time to market, increases enterprise agility, and makes businesses more resilient”.

It’s also why the research firm believes that one of the key areas in which DevOps will advance is in the evolution of practices. Replacing processes will see security and risk personnel shifting to the left and joining projects at the start, rather than wedged into the middle or the end. It’s a view shared by Mandla Mbonambi, CEO of Africonology, who believes that the shift to the left has become as important and essential to the success of a DevOps project as the expertise and capabilities of the teams themselves.

“Security threats are evolving at such a rapid pace that organisations have to embed intense agility into their operations and development processes to keep up and stay secure,” he says. “Developers need to do more than just include security into their systems, they must embrace security within their own best practices and processes. This moves the DevOps approach to security, away from a ‘fill the gaps at the end’ mentality and towards a more robust and resilient one.”

Empowered by technology and security

Forrester believes that this transformation of mindset and strategy can fundamentally determine the success of an organisation in the future. The firm says that high-performing companies will be those which implement code-based change management empowered by technology and security, and that put security and development on the same tier. It’s not an unrealistic ideal, either. The ESG survey found that most security teams are comfortable with developers taking on security testing, with the biggest concern being that this could put undue pressure on development teams.

“There is a risk that by putting security into the development space, companies feel that they are saving money by incorporating the two, without giving the development teams the time or resources they need to perform both roles effectively,” says Mbonambi. “This could then potentially open solutions and the business to even greater risk, as neither the development nor the security is given the attention to detail they need. Speed to market is a very real pressure and teams can end up compromising when there shouldn’t be any compromise at all.”

It's not worth the compromise either. The European Cybersecurity Agency (ENISA) annual report of the threat landscape in 2022 reinforced the concerns that organisations and DevOps teams share when it comes to security risks. The report identified eight primary threat categories across ransomware, malware, social engineering, threats against data, denial of service (DDoS), internet threats, disinformation-misinformation, and supply chain attacks. It also emphasised how denial of service, zero-day exploits, and phishing have grown in both sophistication and use case.

The latter has evolved into spear-phishing, whaling, smishing and vishing, while DDoS attacks have become more complex at a greater scale. The ESG survey found that 38% of organisations had lost data due to the insecure use of APIs, and 37% had suffered an exploit because of vulnerabilities in internal code. This adds to 35% with services compromised due to account credentials, and 34% who had their systems exploited due to vulnerabilities in open-source software. The list does go on – the reality is that security remains a consistent and persistent priority.

“Ultimately, there shouldn’t be a trade-off when it comes to security in DevOps or development in security,” concludes Mbonambi. “Give your teams the best possible support at every point, be it security, operations or development, and ensure that they have the resources and time they need to architect solutions that are resilient and secure. This will not only embed a level of robustness into your business and your services, but it will save you money and time in the long term. Consider using an outsourced, third-party service provider to bolster your teams and to ensure that deadlines are met without compromise.”

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Five IT trends to watch in 2023
IT infrastructure
The efforts made by South African companies in 2021 and 2022 have positioned them well for the next wave of growth and innovation — or for continued economic disruption.

Boost enterprise data resilience
Arcserve Southern Africa IT infrastructure
Arcserve Unified Data Protection 9.0 offers unified, multi-tenant cloud-based management, enhanced data availability, durability, and scalability with Cloud Object Storage, and expanded support for Oracle DB and Microsoft SQL Server.

SAN market set for growth
Technews Publishing News IT infrastructure
Storage-area network (SAN) market to hit US$ 26,86 billion in revenue by the end of 2029 due to factors like widespread adoption of Hybrid SAN-NAS solutions.

Advanced server performance and energy efficient design
Editor's Choice IT infrastructure Products
Dell PowerEdge server portfolio expansion offers more performance, including up to 2.9x greater AI inferencing while Dell Smart Flow design and Dell Power Manager software advancements deliver greater energy efficiency.

CA Southern Africa unmasks container security
Technews Publishing IT infrastructure Cyber Security
Adoption of software containers has risen dramatically as more organisations realise the benefits of this virtualised technology.

Best practices for cybersecurity and network health in 2023
Axis Communications SA IT infrastructure
Securing a network from outside threats while making it easily accessible to employees can be challenging. What are the tell-tale signs of poor network security, and what should organisations do to secure their networks?

Fast, reliable and secure cloud services
Technews Publishing Editor's Choice Cyber Security IT infrastructure
Security and speed are critical components of today’s cloud-based services infrastructure. Cloudflare offers a range of services supporting these goals beyond what most people think it does.

ALM a key element of data security
IT infrastructure
ALM is core to any data security framework in the digital age and it is an element that no business can afford to be careless with.

The benefits of Managed File Transfer
IT infrastructure Products
Blue Turtle Technologies looks into how a Managed File Transfer platform benefits businesses, as opposed to the usual FTP or SFTP suspects.

Accelerating your Zero Trust journey in manufacturing
IT infrastructure Cyber Security Industrial (Industry)
Francois van Hirtum, CTO of Obscure Technologies, advises manufacturers on a strategic approach to safeguarding their businesses against cyber breaches.