{"id":11239,"date":"2022-01-18T19:09:34","date_gmt":"2022-01-19T01:09:34","guid":{"rendered":"https:\/\/threecloud.wpengine.com\/?p=11239"},"modified":"2024-02-28T07:46:18","modified_gmt":"2024-02-28T15:46:18","slug":"putting-the-security-in-devsecops","status":"publish","type":"post","link":"https:\/\/3cloudsolutions.com\/resources\/putting-the-security-in-devsecops\/","title":{"rendered":"Putting the Security in\u00a0DevSecOps"},"content":{"rendered":"

For<\/span>\u00a0most developers<\/span>,<\/span>\u00a0the words\u202f<\/span>\u201c<\/span>Security Policy Review<\/span>\u201d<\/span>\u00a0can<\/span>\u00a0stir up images o<\/span>f long meetings late in a project<\/span>,<\/span>\u00a0with corporate security officers pouring over their code with the scrutiny of\u00a0<\/span>a\u00a0<\/span>tax\u00a0<\/span>audit<\/span>or<\/span>.\u00a0<\/span>The<\/span>\u00a0<\/span>meeting<\/span>s<\/span>\u00a0often end with\u00a0<\/span>a\u00a0<\/span>laundry list of dramatic changes to the code and architecture to meet the ever-present threats of the\u00a0<\/span>outside world.<\/span>\u00a0<\/span><\/p>\n

\u00a0<\/span>In the best case, we go through this exercise and find that our code is in good shape<\/span>,<\/span>\u00a0thanks to modern languages and platforms that are “secure by default.<\/span>\u201d<\/span>\u00a0In the worst case, we find that we have a lot of expensive mitigation late in the development cycle. Alas, the complexity and lack of time or expertise has an impact<\/span>, making<\/span>\u00a0a rigorous approach to application security impractical.<\/span>\u00a0Enter\u00a0<\/span>DevSecOps<\/span><\/a>,<\/span>\u00a0<\/span>p<\/span>art of the ongoing shift left of groups outside of traditional development and operations<\/a>,\u00a0<\/span>DevSecOps<\/span>\u00a0<\/span>is\u00a0<\/span>now considered a best practice for<\/span>\u00a0any compan<\/span>y<\/span>\u00a0that store<\/span>s<\/span>\u00a0custom or client data.\u00a0<\/span>\u00a0<\/span><\/p>\n

Why\u00a0<\/span>DevSecOps<\/span>\u00a0is a\u00a0<\/span>B<\/span>etter\u00a0<\/span>W<\/span>ay\u00a0<\/span>Fo<\/span>rward<\/span>\u00a0<\/span><\/h2>\n

The good news\u00a0<\/span>today\u00a0<\/span>is that<\/span>\u00a0<\/span>modern<\/span>\u00a0deterministic languages<\/span>,<\/span>\u00a0built on platforms designed to be “secure by default<\/span>,<\/span>” give us an advantage. We can combine rich tooling automation with analysis based on the extensive historical data we’ve discovered during the\u00a0<\/span>I<\/span>nternet\u00a0<\/span>A<\/span>ge<\/span>\u00a0<\/span>to catch software security\u00a0<\/span>issues\u00a0<\/span>and vulnerabilities before they start. The most prevalent practices for adding security into our development pipeline today include:<\/span>\u00a0<\/span><\/p>\n