a guide to navigating devsecops

Nearly everything you need to know to make it happen!

Many federal agencies still utilize the "waterfall" method when it comes to software systems and development. One department completes a task and hands the project to the next department, who builds the next item on the list. This is the way of the past. Today's modern agency calls for the flexibility to transform software rapidly while ensuring that security tools and processes are baked into the software delivery lifecycle. 

Not sure how to navigate to a DevSecOps approach? Not really sure what it is and how it fits into your modernization plans? Don’t worry. You’re not alone.

By adopting a DevSecOps mindset, you’ll set your development, security, and operations teams up for success with the right tools necessary to scale the mountain of transformational change required for your mission goals.

Still lost?

We’ll show you the way, help you maneuver around risks, and spot problems before they spot you.

Table of Contents

DSO Illustration

Introduction

Many federal agencies still utilize the “waterfall” method when it comes to software systems and development. One department completes a task and hands the project off to the next department, who builds the next item on the list. This is the way of the past. Today’s modern agency calls for the flexibility to transform software rapidly while ensuring that security tools and processes are baked into the software delivery lifecycle.

Let’s explore more.

compass

PDF Download

Need to print it?

Click the link below to download your copy of the guide (with bonus content) to take offline. Ready to explore more on DevSecOps? Scroll on to Continue your journey.

Download Your Free Guide to DevSecOps

DSO-02

What is DevSecOps?

DevSecOps is an evolution from the old waterfall method. It’s the pivotal response to older, bottleneck-riddled security models on the modern continuous delivery pipeline. Building and automating the development process bridges the traditional gap between IT and security while ensuring fast, scalable and reliable delivery of code. For government agencies, once-siloed teams are enhanced by increased communication and share the responsibility of security tasks during the delivery process.

In DevSecOps, normally opposing goals — speed of delivery and secure code — are merged into a streamlined system. Utilizing lean-agile practices, security testing is done in iterations without slowing down delivery cycles. Security issues are dealt with as they arise; not after a threat of compromise has occurred.

 

DevSecOps-01-1
Kessel Run Logo

The Kessel Run Model

Known as the Software Factory that fights wars, the goal of Kessel Run was to change how the Air Force, and by extension the Department of Defense, develops and delivers software run on classified networks that adopts the best practices from the commercial industry. 

The program, once though of as far-fetched, successfully demonstrated continuous delivery of software development, or in developer terms, the holy grail. It was a huge win for the Department of Defense. 

DSO Pillar Page Images-03

Understanding the DevSecOps Pipeline

DevSecOps Pipeline Example-05

A typical DevOps pipeline includes different stages. For example, a typical software development lifecycle (SDLC) includes phase like build, code, plan, test, and deploy. 

In DevSecOps, specific security checks are added in each phase.

  • Plan: Execute security analysis and create a test plan to determine scenarios for where, how, and when testing will be done. 
  • Code: Deploy linting tools and Git controls to secure passwords and API keys.
  • Build: While building code for execution, incorporate static application security testing (SAST) tools to track down flaws in the code before deploying to production. These tools are specific to programming languages. 
  • Test: Use dynamic application security testing (DAST) tools to test your application while in runtime. These tools actively investigate running applications with penetration tests to detect possible security vulnerabilities. 
  • Deploy: After completing the above tests in runtime, send a secure build to production for final deployment. 

 

DevOps vs. DevSecOps

As agencies rethink how they develop, manage, and secure applications, DevOps—a moniker combining "development" and "operations"—is morphing into DevSecOps. 

DevSecOps adds robust security methods to traditional DevOps practices from day one. 

 

 

DevOps: A Critical Combination

DevOps is the collaboration between development and operations teams to create a more agile, streamlined deployment framework. It's a critical shift away from the traditionally siloed mentality of many IT teams, which prioritizes areas of specialization over communications. 

DevOps has become a driving force in many forward-thinking agencies — born from the need to deliver software and services more reliably and quickly. The ideals of continuous testing and automation are essential to DevOps implementations. New deployments must be tested from the moment code is written to the hour the final product is released. Leveraging automation makes it possible to address form and function issues at speed rather than relying on outdated manual testing frameworks. 

DevSecOps: Logical Next Steps

DevSecOps introduces the concept of security into the existing DevOps paradigm. It's critical to apply the notion of developing a "Security-as-code" culture that prioritizes secure deployment and speed rather than attempting to separate the two concepts. 

DevSecOps integrates key security policies such as code analysis, compliance monitoring, threat investigation, and vulnerabilities assessments into typical DevOps workflows. The ideal result? Native security already built into new product deployments, which limits the risk of zero-day flaws and software recalls.

DSO-01

Changing Course: The Culture Shift Required

 

 

Change, no matter how it arrives, is never easy.

For government agencies, it can be even harder. Systems, processes, and mindsets are more entrenched because of the extreme vetting that goes into inputting these frameworks.

The same goes for adopting a DevSecOps approach to your software tech systems.

Bringing Government Systems into the 21st Century

The government sector, by and large, lags behind the commercial sector in software technology.

We’ve seen many a client still using the “waterfall” method, where work is done department-by-department, with no two groups actually working together on the project.

With DevSecOps, that all changes—for the better.

Your software creation and implementation becomes faster, more efficient, and more secure. Getting buy-in from stakeholders, however, can be the most difficult part of going from behind the curve to cutting-edge.

The Challenge

A waterfall approach is full of silos.

Each department works independently, with their own territory to lord over. They feel ownership over it, naturally. And when management comes in and wants to reclaim that territory or give it a different look, resistance is natural.

People worry. Will I lose my job? Can I keep up?

Management worries, too: Will this new approach actually work? We’ve done it one way for a long time—why are we abandoning our tried-and-true way? Why rock the boat?

You might be surprised how entrenched some people can be about this change. And if you believe your team is truly using a DevSecOps approach, but your development and operations teams still aren't communicating or working cohesively, you lose.

The Solution

The facts don’t change, no matter the challenge: DevSecOps will radically improve how your government agency works. Gone are the worries about security checks. The amount of time and effort saved with a continuous-integration, continuous-deployment (not delivery) environment can have a monumental impact.

Maybe that means some staffing changes are in store if you encounter persistent resistance. But when the work your government agency does is so important, it’s worth it in the long-term

Who will give you the most pushback on your journey to Devsecops enlightenment?

To fully embrace DevSecOps, you must break down barriers and foster open collaboration between development, security, and operations teams. Remember, DevSecOps is a software engineering culture. 

The cultivation of shared responsibilities is vital. All DevSecOps team members must see the delivery of secure services as their responsibility, rather than something handled by other teams during development or after services are deployed. 

As it turns out, not everyone in your organization may be as excited about the culture shift as you. Not everyone likes change, and there's one thing for certain, DevSecOps will bring change—how you work, what you do, how you interact with other people on the team, and beyond.  

Here are five types of people or roles who might pushback against a move to DevSecOps. 

  1. Not invented here: "Been there, done that." We've all heard this. If your management has decided that a move to DevSecOps should be undertaken—even if the existing practices have been working—there's probably been a realization that things could be more efficient, faster, and more secure. 
  2. Losing control: People who have gained a level of experience in a particular area or domain and feel threatened by new processes. They often feel they are giving up control or diluting their expertise. 
  3. Stuck in the middle: Middle managers are often stuck trying to balance their operations, preventing them from seeing the big picture when it comes to change. They will most likely accept something once it has been tested and proven and has reliable people backing it.
  4. Burned by the past: These people, who have had bad experiences or wrong incentives from the organization, have either been through too many reorganizations or think DevSecOps is another fad. 
  5. A careful CIO: You've likely met this person. Their fiefdom is crumbling, they've been burned by previous incidents, or they've been mandated to adopt and are playing catch-up. 

Learn how to respond to these five types of pushback.

DSO-02

Field Guides: Real-world examples

Department of Homeland Security: U.S. Customs & Immigration Services

Many government agencies are behind when it comes to cloud computing and DevSecOps adoption. Not USCIS. From the top down, the agency has rebuilt its software systems with the most cutting-edge techniques and processes in the government sector. Geocent was thrilled to help them along the way.

Department of Defense: U.S. Marine corps

We were proud to be part of the OASIS team, which helped the Marine Corps transition its legacy software systems onto a brand-new, ATO platform that allows internal customers to acquire and build the software they need in a timely manner, all in a secure process. See how we did it.

DSO Pillar Page Images-06

Packing the Right Tools

Your toolkit for navigating a DevSecOps environment.

DSO Pillar Page Images-07

Start Building!

Congratulation! Now that you know everything that's needed to build a DevSecOps environment, check us out! We can help you modernize your application development and achieve your mission goals. 

Stay up-to-date with the latest Agile information by subscribing to our newsletter. 

Subscribe