Integrate, integrate, integrate

Issue 8 2022 Infrastructure

It is time to adopt a security-focused approach to DevOps, one that integrates the security alarm bells and whistles into the flair and speed of development without the traditional frictions and complexities. A survey undertaken by ESG found that 68% of respondents were considering adopting developer-focused security solutions and shifting security to developers.

This is a good thing. As good a thing as DevOps itself – an approach that Forrester describes as one that “consistently reduces time to market, increases enterprise agility, and makes businesses more resilient”.

It’s also why the research firm believes that one of the key areas in which DevOps will advance is in the evolution of practices. Replacing processes will see security and risk personnel shifting to the left and joining projects at the start, rather than wedged into the middle or the end. It’s a view shared by Mandla Mbonambi, CEO of Africonology, who believes that the shift to the left has become as important and essential to the success of a DevOps project as the expertise and capabilities of the teams themselves.

“Security threats are evolving at such a rapid pace that organisations have to embed intense agility into their operations and development processes to keep up and stay secure,” he says. “Developers need to do more than just include security into their systems, they must embrace security within their own best practices and processes. This moves the DevOps approach to security, away from a ‘fill the gaps at the end’ mentality and towards a more robust and resilient one.”

Empowered by technology and security

Forrester believes that this transformation of mindset and strategy can fundamentally determine the success of an organisation in the future. The firm says that high-performing companies will be those which implement code-based change management empowered by technology and security, and that put security and development on the same tier. It’s not an unrealistic ideal, either. The ESG survey found that most security teams are comfortable with developers taking on security testing, with the biggest concern being that this could put undue pressure on development teams.

“There is a risk that by putting security into the development space, companies feel that they are saving money by incorporating the two, without giving the development teams the time or resources they need to perform both roles effectively,” says Mbonambi. “This could then potentially open solutions and the business to even greater risk, as neither the development nor the security is given the attention to detail they need. Speed to market is a very real pressure and teams can end up compromising when there shouldn’t be any compromise at all.”

It's not worth the compromise either. The European Cybersecurity Agency (ENISA) annual report of the threat landscape in 2022 reinforced the concerns that organisations and DevOps teams share when it comes to security risks. The report identified eight primary threat categories across ransomware, malware, social engineering, threats against data, denial of service (DDoS), internet threats, disinformation-misinformation, and supply chain attacks. It also emphasised how denial of service, zero-day exploits, and phishing have grown in both sophistication and use case.

The latter has evolved into spear-phishing, whaling, smishing and vishing, while DDoS attacks have become more complex at a greater scale. The ESG survey found that 38% of organisations had lost data due to the insecure use of APIs, and 37% had suffered an exploit because of vulnerabilities in internal code. This adds to 35% with services compromised due to account credentials, and 34% who had their systems exploited due to vulnerabilities in open-source software. The list does go on – the reality is that security remains a consistent and persistent priority.

“Ultimately, there shouldn’t be a trade-off when it comes to security in DevOps or development in security,” concludes Mbonambi. “Give your teams the best possible support at every point, be it security, operations or development, and ensure that they have the resources and time they need to architect solutions that are resilient and secure. This will not only embed a level of robustness into your business and your services, but it will save you money and time in the long term. Consider using an outsourced, third-party service provider to bolster your teams and to ensure that deadlines are met without compromise.”

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Enhanced cellular connectivity is critical for farm safety
Infrastructure Agriculture (Industry)
In South Africa, the safety of our rural communities, particularly on farms, is a pressing concern. Nearly 32% of South Africa’s 60 million people live in these areas, where security challenges are constantly in the spotlight.

All aspects of data protection
Technews Publishing Editor's Choice Information Security Infrastructure AI & Data Analytics
SMART Security Solutions spoke to Kate Mollett, Senior Director, Commvault Africa, about the company and its evolution from a backup specialist to a full data protection specialist, as well as the latest announcements from the company.

Revolutionising networking technology for the future
Infrastructure IoT & Automation
[Sponsored] In the fast-evolving landscape of networking technology, RUCKUS Networks stands out as a trailblazer, offering innovative solutions that redefine connectivity experiences across various industries.

Edge could help transform South Africa’s healthcare
Axis Communications SA Infrastructure
Edge computing has emerged as a game-changing technology for many industries, and the healthcare sector is no exception. In particular, South Africa’s healthcare industry could significantly benefit from the potential of this technology.

Cloud platform for cyber resilience in the hybrid enterprise
The Commvault Cloud brings together data protection, security, intelligence, and recovery on one platform, offering AI capabilities to defeat cyber threats, and includes integration with Microsoft Azure OpenAI Service.

Rapid rise in DNS attacks drives demand for new approach
Infrastructure Risk Management & Resilience
As ransomware grows more sophisticated and DNS attacks become more frequent, businesses are increasingly trying to protect themselves by adopting innovative approaches and technologies to bolster the integrity and security of their backup systems.

Majority of South African companies concerned about cloud security
Information Security Infrastructure
Global and local businesses share a common concern when it comes to cloud security. 95% of global businesses and 89% of local businesses are concerned about the security of public clouds.

Consolidated cybersecurity management
Technews Publishing Editor's Choice Information Security Infrastructure
SMART Security Solutions spoke to Gareth Redelinghuys, Country Managing Director, African Cluster at Trend Micro, to find out what makes Trend stand out from the crowd and also its latest market offerings.

Access to data centre secured
Suprema Access Control & Identity Management Infrastructure
GBM required a modern access control system to increase the security of its facilities in a productive environment without affecting the operation of the offices and the data centre, which are carried out 24/7/365.

Africa’s growth lies on shoulders of renewable energy
News & Events Infrastructure
The Africa Tech Festival from 13 to 16 November in Cape Town will unpack the challenges and discuss the pivotal role of sustainability & renewable energy in advancing technological development in Africa.