1 1 00:00:00,240 --> 00:00:02,190 DevSecOps. 2 2 00:00:02,190 --> 00:00:05,310 In this lesson, we're going to talk about DevSecOps, 3 3 00:00:05,310 --> 00:00:06,330 but before we do that, 4 4 00:00:06,330 --> 00:00:09,330 we really have to take a step back and talk about DevOps. 5 5 00:00:09,330 --> 00:00:11,910 Now, DevOps was created to speed up the development 6 6 00:00:11,910 --> 00:00:14,220 and get things into production faster. 7 7 00:00:14,220 --> 00:00:16,440 As I mentioned, DevOps really relies 8 8 00:00:16,440 --> 00:00:18,750 on the concepts of continuous integration 9 9 00:00:18,750 --> 00:00:20,970 so that we all can be working together on the same thing 10 10 00:00:20,970 --> 00:00:23,700 and make sure we don't have big divergent changes. 11 11 00:00:23,700 --> 00:00:25,200 Now, when we talk about DevOps, 12 12 00:00:25,200 --> 00:00:27,390 this is an organizational culture shift 13 13 00:00:27,390 --> 00:00:29,160 that's going to combine the software development 14 14 00:00:29,160 --> 00:00:32,280 and the systems operations people into one team. 15 15 00:00:32,280 --> 00:00:33,480 This is basically the practice 16 16 00:00:33,480 --> 00:00:36,450 of integrating these two disciplines within a company. 17 17 00:00:36,450 --> 00:00:39,750 So, often, especially if you worked 10 or 15 years ago, 18 18 00:00:39,750 --> 00:00:41,520 you would see this type of a paradigm 19 19 00:00:41,520 --> 00:00:43,440 where you have development all in one area, 20 20 00:00:43,440 --> 00:00:44,490 and they all work together. 21 21 00:00:44,490 --> 00:00:45,990 And then you have all the operations folks 22 22 00:00:45,990 --> 00:00:47,580 who have to operate and maintain these systems, 23 23 00:00:47,580 --> 00:00:49,290 and they'd be often in another area. 24 24 00:00:49,290 --> 00:00:51,330 And so development would code something, 25 25 00:00:51,330 --> 00:00:52,650 and then throw it over the wall, 26 26 00:00:52,650 --> 00:00:55,200 and then operations has to live with it and support it. 27 27 00:00:55,200 --> 00:00:56,340 Now, this is a problem 28 28 00:00:56,340 --> 00:01:00,240 because this led to developers not doing their best work. 29 29 00:01:00,240 --> 00:01:02,280 And what I mean by that is there was a lot of security bugs. 30 30 00:01:02,280 --> 00:01:03,690 There was a lot of feature bugs, 31 31 00:01:03,690 --> 00:01:05,550 and a lot of things just didn't work right. 32 32 00:01:05,550 --> 00:01:07,230 And so somebody had the great idea 33 33 00:01:07,230 --> 00:01:10,350 about 10 or 15 or 20 years ago to create DevOps, 34 34 00:01:10,350 --> 00:01:12,420 which was let's take some of these operations folks 35 35 00:01:12,420 --> 00:01:13,920 and put them in with the developers 36 36 00:01:13,920 --> 00:01:15,000 and some of these developer folks 37 37 00:01:15,000 --> 00:01:16,470 and put them in with operations. 38 38 00:01:16,470 --> 00:01:19,140 And so we make these smaller teams where they work together. 39 39 00:01:19,140 --> 00:01:21,300 This way, when a developer creates something, 40 40 00:01:21,300 --> 00:01:23,190 the operations team can support it. 41 41 00:01:23,190 --> 00:01:25,470 By putting operations and developers together, 42 42 00:01:25,470 --> 00:01:27,870 you can build, test and release software 43 43 00:01:27,870 --> 00:01:29,880 faster and more reliably 44 44 00:01:29,880 --> 00:01:31,380 because the people who are building it 45 45 00:01:31,380 --> 00:01:33,750 are also the people who are supporting it, right? 46 46 00:01:33,750 --> 00:01:35,550 Now, one of the problems with this though 47 47 00:01:35,550 --> 00:01:38,310 was a lot of things were getting very quick into operations 48 48 00:01:38,310 --> 00:01:39,907 and then security came along and said, 49 49 00:01:39,907 --> 00:01:42,660 "Ah, this isn't secure. There's problems here. 50 50 00:01:42,660 --> 00:01:44,400 We need to fix all these vulnerabilities. 51 51 00:01:44,400 --> 00:01:45,840 And you didn't do this within compliance 52 52 00:01:45,840 --> 00:01:49,590 for HIPAA or GLBA or Sarbanes-Oxley," or whatever. 53 53 00:01:49,590 --> 00:01:51,450 And so this was another problem. 54 54 00:01:51,450 --> 00:01:54,090 So they said, "Well, if putting Dev and Ops 55 55 00:01:54,090 --> 00:01:56,250 was good together, giving us DevOps, 56 56 00:01:56,250 --> 00:01:58,230 well, why don't we just add security in there too?" 57 57 00:01:58,230 --> 00:01:59,550 And that's essentially what they did, 58 58 00:01:59,550 --> 00:02:01,590 and they call it DevSecOps. 59 59 00:02:01,590 --> 00:02:04,050 Now, this is development, security and operations, 60 60 00:02:04,050 --> 00:02:06,180 and it's a combination of software development, 61 61 00:02:06,180 --> 00:02:08,610 security operations, and systems operations 62 62 00:02:08,610 --> 00:02:10,920 by integrating with all those disciplines together 63 63 00:02:10,920 --> 00:02:12,000 in one team. 64 64 00:02:12,000 --> 00:02:13,530 Now, this is a great way of doing things 65 65 00:02:13,530 --> 00:02:15,450 because when you're using DevSecOps, 66 66 00:02:15,450 --> 00:02:18,060 this is going to utilize a shift-left mindset. 67 67 00:02:18,060 --> 00:02:20,640 Now, what do I mean by shift-left mindset? 68 68 00:02:20,640 --> 00:02:22,710 Now, we haven't really talked about what shift-left is 69 69 00:02:22,710 --> 00:02:24,930 in this course because it's really not a concept 70 70 00:02:24,930 --> 00:02:26,730 that's focused on security. 71 71 00:02:26,730 --> 00:02:28,620 When we talk about shift-left, it actually comes 72 72 00:02:28,620 --> 00:02:31,590 from the information technology service management world. 73 73 00:02:31,590 --> 00:02:34,170 When we talk about shift-left, think about it like this. 74 74 00:02:34,170 --> 00:02:36,720 You have a series of steps that needs to be done. 75 75 00:02:36,720 --> 00:02:37,590 And, for instance, if I talked 76 76 00:02:37,590 --> 00:02:38,850 about the software development life cycle, 77 77 00:02:38,850 --> 00:02:40,530 we could use that as our example. 78 78 00:02:40,530 --> 00:02:41,820 You're going to have some kind of a plan. 79 79 00:02:41,820 --> 00:02:43,020 You're going to design something. 80 80 00:02:43,020 --> 00:02:45,150 You're then going to build it. You're going to integrate it. 81 81 00:02:45,150 --> 00:02:47,220 You're going to put it into staging, put it into production, 82 82 00:02:47,220 --> 00:02:49,800 and it goes through all these different series of steps. 83 83 00:02:49,800 --> 00:02:51,870 Well, if you noticed that eight-step methodology 84 84 00:02:51,870 --> 00:02:54,990 in the waterfall method, around step four, five or six 85 85 00:02:54,990 --> 00:02:57,000 is when you actually start testing things, 86 86 00:02:57,000 --> 00:02:58,980 and then you start thinking about security towards the end. 87 87 00:02:58,980 --> 00:03:01,680 Well, with shift-left, we're trying to shift it left 88 88 00:03:01,680 --> 00:03:03,660 or earlier in the life cycle. 89 89 00:03:03,660 --> 00:03:06,660 So the idea with DevSecOps is take security, 90 90 00:03:06,660 --> 00:03:08,760 which used to be the last thing that happened, 91 91 00:03:08,760 --> 00:03:10,440 and put it all the way back in the beginning 92 92 00:03:10,440 --> 00:03:12,120 with the developers so we can think about it 93 93 00:03:12,120 --> 00:03:13,170 from the beginning. 94 94 00:03:13,170 --> 00:03:14,580 That's the idea of shifting left. 95 95 00:03:14,580 --> 00:03:16,830 It's moving things earlier in the life cycle 96 96 00:03:16,830 --> 00:03:18,930 and to earlier people in the chain. 97 97 00:03:18,930 --> 00:03:20,850 And, in this case, by doing DevSecOps 98 98 00:03:20,850 --> 00:03:22,980 and integrating a security person with the development 99 99 00:03:22,980 --> 00:03:25,980 and operations people, you can build more secure systems 100 100 00:03:25,980 --> 00:03:28,260 and get them fielded faster. 101 101 00:03:28,260 --> 00:03:31,320 Now, what are some big benefits of doing DevSecOps? 102 102 00:03:31,320 --> 00:03:33,330 Well, for one, you're going to integrate security 103 103 00:03:33,330 --> 00:03:34,620 from the beginning. 104 104 00:03:34,620 --> 00:03:36,060 This is always going to be a good thing 105 105 00:03:36,060 --> 00:03:38,460 because it's cheaper and easier to put security 106 106 00:03:38,460 --> 00:03:41,280 in from the beginning than to add it on later. 107 107 00:03:41,280 --> 00:03:42,900 Another thing you're going to do is you're going to test 108 108 00:03:42,900 --> 00:03:44,880 during and after development. 109 109 00:03:44,880 --> 00:03:47,070 So we're not going to wait till step five or six 110 110 00:03:47,070 --> 00:03:47,910 to do our testing. 111 111 00:03:47,910 --> 00:03:49,500 No, we're going to write a block of code, 112 112 00:03:49,500 --> 00:03:50,580 and we're going to test it, 113 113 00:03:50,580 --> 00:03:51,870 and then we're going to integrate it back 114 114 00:03:51,870 --> 00:03:54,330 using continuous integration to the master code base. 115 115 00:03:54,330 --> 00:03:56,790 And this way we can have 50 or 100 programmers 116 116 00:03:56,790 --> 00:03:58,290 working on something at once 117 117 00:03:58,290 --> 00:04:00,180 and not have a bunch of code conflicts 118 118 00:04:00,180 --> 00:04:02,430 because we're all getting things back in early. 119 119 00:04:02,430 --> 00:04:05,010 If we waited a week and then I had 50 changes to put in, 120 120 00:04:05,010 --> 00:04:06,750 and you had 50 changes to put in, 121 121 00:04:06,750 --> 00:04:08,130 that can create a lot of conflicts, 122 122 00:04:08,130 --> 00:04:10,260 especially if we both change the same line. 123 123 00:04:10,260 --> 00:04:12,720 But if we commit our changes very frequently, 124 124 00:04:12,720 --> 00:04:15,030 every couple of hours or even every day, 125 125 00:04:15,030 --> 00:04:17,310 that's going to have a lot less conflicts. 126 126 00:04:17,310 --> 00:04:19,080 And then the third area is we're going to automate 127 127 00:04:19,080 --> 00:04:20,220 our compliance checks. 128 128 00:04:20,220 --> 00:04:21,210 Now, this is another great thing 129 129 00:04:21,210 --> 00:04:23,670 about DevSecOps because we have developers, 130 130 00:04:23,670 --> 00:04:25,980 and they can build things with code, right? 131 131 00:04:25,980 --> 00:04:27,930 And so if they go through and code something, 132 132 00:04:27,930 --> 00:04:29,760 like automate compliance checks, 133 133 00:04:29,760 --> 00:04:31,950 we can have all these things that are scripted. 134 134 00:04:31,950 --> 00:04:33,150 So when you create a piece of code 135 135 00:04:33,150 --> 00:04:35,640 and you happen to work in a hospital, well, guess what? 136 136 00:04:35,640 --> 00:04:37,680 We're going to run it against the HIPAA compliance checks 137 137 00:04:37,680 --> 00:04:39,930 and make sure everything is within compliance. 138 138 00:04:39,930 --> 00:04:41,640 This way we can figure that out very early 139 139 00:04:41,640 --> 00:04:43,380 before we go into production. 140 140 00:04:43,380 --> 00:04:45,660 And that way we can fix those issues faster 141 141 00:04:45,660 --> 00:04:47,510 and save us a lot of time and effort.