DevOps

DevOps blends the processes of development, quality assurance, and production. This requires steady collaboration between systems engineers, developers, testers, system administrators, and product owners, organized and focused by scrum masters, with an eye to deploying small components of functionality rapidly to the user community.

The rapid and consistent DevOps deployment pipeline requires software teams to review and modernize their test and production environments to align better with DevOps approaches. For example, infrastructure teams are now doing away with traditional patch management cycles, instead opting simply to provide end users with the ability to tear down virtual machines and containers, and rebuild them whenever needed.

DevOps organizations utilize infrastructure as code, whereby system administrators become developers creating configuration files and scripts to deploy applications and microservices to Virtual Machines (VMs) and containers in the production environment. 

Tools such as Puppet, Chef, Ansible, nScale, and many others support automated deployment processes, but their implementations must be carefully architected and planned. A powerful DevOps approach is to cross‐train developers and system administrators, enabling a collaborative atmosphere across these disciplines.

A key aspect of DevOps is the ability for developers to understand what is happening in the production environment. DevOps works best when software developers instrument their code up front, so that the—ilities (for example, scalability, availability, usability, and so on) of the product can be measured and fed back into the system as requirements.

DevOps engineers can receive metrics concerning their software from the field. These metrics often drive the creation of backlog creation that the stakeholder community did not anticipate, and also help in the identification of Defect Reports (DRs). These are all important feedback mechanisms that help improve the product. This blending of development and operation provides a framework for rapid feedback on the quality of software in the field.

All of these principles can also be applied to the domain of cyber security. With DevSecOps, security stakeholders embed within the development, QA, and deployment of the software. The constant feedback from instrumentation, collaboration across previous silos, and a focus on automation benefits security practitioners. These qualities of DevOps pair nicely with the concept of Information Security Continuous Monitoring (ISCM). 

The process workflow shown in the following figure provides a view into a DevSecOps process. Sources of security requirements vary, but can include STIGs as well as requirements defined in the NIST SP 800-53 series. A focus on testing includes unit tests, compliance scans, and static/dynamic analysis as part of an ISCM approach:

Automation is key, and is enabled through configuration management tools, deployment, and deployment scripts. Documentation of the system is captured in real time as the design evolves and development continues, using tools such as Confluence.

Continuous deployment is enabled and benefits from a QA/staging area implemented using virtualized test infrastructures and mirrored environments. An ISCM program focuses on continuously monitoring the posture of the system to ensure that the risk profile is understood, and the authorizing official for that system can make a calculated decision based on that risk.

Just as with Agile, the adoption of DevSecOps requires process reengineering across the adopting organization and programs. DoD programs that want to adopt a DevSecOps approach should focus on transforming their programs with the following goals in mind:

• Automate: Aim for continuous deployment of small chunks of functionality. Engage your development teams to automate deployment scripts and configuration files using tools such as Puppet, Chef, and Ansible. Automate security tests, and ensure that feedback from those tests is passed back to the product backlog. 
• Blend operations, QA, and development: DevOps was inspired in part by the movement towards cloud computing. Cloud hosting makes it easier to launch and tear down virtual instances, and to be responsive when changes are required to software baselines. Take the time to work with the end users of your software to understand as best you can the operational environment, and use virtual test beds such as Ravello whenever possible to catch deployment issues early. 
• Instrument and provide continuous feedback: Look for ways to capture data across the life cycle of the software. Introduce acceptance criteria or user stories in the backlog to push your development teams to instrument their code, so they can receive metrics during operation. Use these metrics as input when needed to create new backlog stories. Set up security defect-monitoring architecture, to maintain awareness of the security state of your software.
• Be transparent: Create and keep security documentation up to date in real time using tools such as Confluence, and provide access to all stakeholders including any security evaluators. 
• Be vigilant: Security is everyone's responsibility. Even though you need skilled security experts to lead the charge, everyone should be armed with the knowledge needed to identify basic security issues through code reviews and scanning. This includes the need to look out for code not developed by your teams. The push towards faster code releases in a DevOps environment often results in the use of open source tools within programs. All tools should be evaluated by security staff before use, and a repository of approved open source libraries should be maintained for quick access.

Selecting and refining an optimal approach to secure design is a process well worth the investment. Product life cycles impact:

• The methodologies we select to develop and manage security requirements
• Satisfaction of those requirements in the design
• How we respond to changes (and vulnerabilities) in the marketplace

Waterfall, Spiral, Agile, and DevOps approaches all possess advantages and disadvantages. Agile methodologies can be leveraged to build security into the design of your IoT product or system in very small increments.

No matter which methodology your team chooses, make sure that your security engineers become partners and collaborators with your developers.