Instructor: DevSecOps. 2 2
In this lesson, we're going to talk about DevSecOps, 3 3
but before we do that, 4 4
we really have to take a step back and talk about DevOps. 5 5
Now, DevOps was created to speed up the development 6 6
and get things into production faster. 7 7
As I mentioned, DevOps really relies 8 8
on the concepts of continuous integration 9 9
so that we all can be working together on the same thing 10 10
and make sure we don't have big divergent changes. 11 11
Now, when we talk about DevOps, 12 12
this is an organizational culture shift 13 13
that's going to combine the software development 14 14
and the systems operations people into one team. 15 15
This is basically the practice 16 16
of integrating these two disciplines within a company. 17 17
So, often, especially if you worked 10 or 15 years ago, 18 18
you would see this type of a paradigm 19 19
where you have development all in one area, 20 20
and they all work together. 21 21
And then you have all the operations folks 22 22
who have to operate and maintain these systems, 23 23
and they'd be often in another area. 24 24
And so development would code something, 25 25
and then throw it over the wall, 26 26
and then operations has to live with it and support it. 27 27
Now, this is a problem 28 28
because this led to developers not doing their best work. 29 29
And what I mean by that is there was a lot of security bugs. 30 30
There was a lot of feature bugs, 31 31
and a lot of things just didn't work right. 32 32
And so somebody had the great idea 33 33
about 10 or 15 or 20 years ago to create DevOps, 34 34
which was let's take some of these operations folks 35 35
and put them in with the developers 36 36
and some of these developer folks 37 37
and put them in with operations. 38 38
And so we make these smaller teams where they work together. 39 39
This way, when a developer creates something, 40 40
the operations team can support it. 41 41
By putting operations and developers together, 42 42
you can build, test and release software 43 43
faster and more reliably 44 44
because the people who are building it 45 45
are also the people who are supporting it, right? 46 46
Now, one of the problems with this though 47 47
was a lot of things were getting very quick into operations 48 48
and then security came along and said, 49 49
"Ah, this isn't secure. There's problems here. 50 50
We need to fix all these vulnerabilities. 51 51
And you didn't do this within compliance 52 52
for HIPAA or GLBA or Sarbanes-Oxley," or whatever. 53 53
And so this was another problem. 54 54
So they said, "Well, if putting Dev and Ops 55 55
was good together, giving us DevOps, 56 56
well, why don't we just add security in there too?" 57 57
And that's essentially what they did, 58 58
and they call it DevSecOps. 59 59
Now, this is development, security and operations, 60 60
and it's a combination of software development, 61 61
security operations, and systems operations 62 62
by integrating with all those disciplines together 63 63
in one team. 64 64
Now, this is a great way of doing things 65 65
because when you're using DevSecOps, 66 66
this is going to utilize a shift-left mindset. 67 67
Now, what do I mean by shift-left mindset? 68 68
Now, we haven't really talked about what shift-left is 69 69
in this course because it's really not a concept 70 70
that's focused on security. 71 71
When we talk about shift-left, it actually comes 72 72
from the information technology service management world. 73 73
When we talk about shift-left, think about it like this. 74 74
You have a series of steps that needs to be done. 75 75
And, for instance, if I talked 76 76
about the software development life cycle, 77 77
we could use that as our example. 78 78
You're going to have some kind of a plan. 79 79
You're going to design something. 80 80
You're then going to build it. You're going to integrate it. 81 81
You're going to put it into staging, put it into production, 82 82
and it goes through all these different series of steps. 83 83
Well, if you noticed that eight-step methodology 84 84
in the waterfall method, around step four, five or six 85 85
is when you actually start testing things, 86 86
and then you start thinking about security towards the end. 87 87
Well, with shift-left, we're trying to shift it left 88 88
or earlier in the life cycle. 89 89
So the idea with DevSecOps is take security, 90 90
which used to be the last thing that happened, 91 91
and put it all the way back in the beginning 92 92
with the developers so we can think about it 93 93
from the beginning. 94 94
That's the idea of shifting left. 95 95
It's moving things earlier in the life cycle 96 96
and to earlier people in the chain. 97 97
And, in this case, by doing DevSecOps 98 98
and integrating a security person with the development 99 99
and operations people, you can build more secure systems 100 100
and get them fielded faster. 101 101
Now, what are some big benefits of doing DevSecOps? 102 102
Well, for one, you're going to integrate security 103 103
from the beginning. 104 104
This is always going to be a good thing 105 105
because it's cheaper and easier to put security 106 106
in from the beginning than to add it on later. 107 107
Another thing you're going to do is you're going to test 108 108
during and after development. 109 109
So we're not going to wait till step five or six 110 110
to do our testing. 111 111
No, we're going to write a block of code, 112 112
and we're going to test it, 113 113
and then we're going to integrate it back 114 114
using continuous integration to the master code base. 115 115
And this way we can have 50 or 100 programmers 116 116
working on something at once 117 117
and not have a bunch of code conflicts 118 118
because we're all getting things back in early. 119 119
If we waited a week and then I had 50 changes to put in, 120 120
and you had 50 changes to put in, 121 121
that can create a lot of conflicts, 122 122
especially if we both change the same line. 123 123
But if we commit our changes very frequently, 124 124
every couple of hours or even every day, 125 125
that's going to have a lot less conflicts. 126 126
And then the third area is we're going to automate 127 127
our compliance checks. 128 128
Now, this is another great thing 129 129
about DevSecOps because we have developers, 130 130
and they can build things with code, right? 131 131
And so if they go through and code something, 132 132
like automate compliance checks, 133 133
we can have all these things that are scripted. 134 134
So when you create a piece of code 135 135
and you happen to work in a hospital, well, guess what? 136 136
We're going to run it against the HIPAA compliance checks 137 137
and make sure everything is within compliance. 138 138
This way we can figure that out very early 139 139
before we go into production. 140 140
And that way we can fix those issues faster 141 141
and save us a lot of time and effort.