DevOps: evolution to DevSecOps and key tools

DevOps (Development and Operations) is a methodology that seeks to integrate software development with infrastructure operations, with the aim of improving collaboration and efficiency in the software development lifecycle.  

DevOps is a relatively new approach that aims to improve collaboration and communication between software development and operations teams, in order to accelerate the delivery of high-quality software. The origins of DevOps can be traced back to the early 2000s, when developers began to realise that traditional software development practices were not working. 

The background of DevOps is found in Agile and Lean culture, which focus on delivering value to the customer quickly and continuously, and on continuous improvement of the development process. In particular, the Agile movement drove the creation of multidisciplinary and self-organised teams that work collaboratively and are in constant contact with the customer. 

Additionally, as security has become an increasingly important concern in software development, a new variant of DevOps has emerged: DevSecOps.  

DevSecOps focuses on integrating security throughout the software development lifecycle, from design to implementation and maintenance. The idea is that security should not be seen as a responsibility isolated to the security team, but should be integrated into the development and operations process at all stages. 

From DevOps to DevSecOps 

The evolution from DevOps to DevSecOps has been driven by several factors, including: 

• Increased security threats: with the growing sophistication of cyberattacks, security has become an increasingly important concern for businesses. 
• Greater regulatory demands: many companies are subject to increasingly strict regulations regarding data protection and privacy. 
• Greater adoption of the cloud: with the growing adoption of the cloud, security has become a critical aspect in data protection and risk management. 

Implementing DevSecOps, it is necessary for all involved teams, including security teams, to adopt practices and tools that enable the integration of security into the development and operations process. 

DevSecOps focuses on integrating security throughout the software development lifecycle

Some of these practices and tools include: 

• Continuous assessment of risks and vulnerabilities. 
• Automated security testing. 
• Continuous monitoring of security in production. 
• Implementation of security controls in the deployment process. 
• Security training for the entire team. 

Within the scope of infrastructure and information systems, the technological vertical to which this article focuses, implementing DevOps can be challenging due to the particularities of the environment. 

DevOps key tools 

Some tools that can help us carry out our DevOps strategy successfully are: 

• Jenkins: a continuous integration automation tool that enables source code integration, automated builds and testing, and continuous software delivery. 
• GitLab: an all-in-one DevOps platform that includes source code version control tools, continuous integration and delivery, testing, and application monitoring. 
• Docker: a container virtualisation tool that allows for the creation, distribution, and execution of applications in an isolated and portable environment. 
• Ansible: a configuration and orchestration automation tool that enables management of infrastructure and application configuration across multiple platforms. 
• Kubernetes: a container orchestration platform that enables management and scaling of containerised applications. 
• Puppet: a configuration automation tool that enables management of infrastructure and application configuration across multiple platforms. 
• Terraform: an infrastructure automation tool that enables the definition of infrastructure as code and resource management across multiple cloud providers. 
• Grafana: a metrics and logs monitoring and analysis platform that enables visualisation and analysis of application and system data. 

With a clear focus on security and transforming our corporate culture towards a DevSecOps approach, we may consider evaluating the following additional and complementary tools to the ones mentioned above: 

• SonarQube: a source code analysis tool that allows for identification and correction of vulnerabilities and weaknesses in the code. It provides detailed reports on code quality, security, and compliance with standards. 
• OWASP ZAP: an automated web application penetration testing tool that enables finding vulnerabilities and weaknesses in web applications through simulated attacks. 
• Qualys: a cloud security platform that offers a wide range of security tools, including vulnerability analysis, risk assessment, compliance monitoring, and continuous monitoring. 
• Aqua Security: a container security platform that includes tools for vulnerability assessment, policy management, and security event monitoring. 
• Twistlock: a container security platform that includes tools for vulnerability assessment, policy management, and security event monitoring. 

These are just some of the most popular DevOps tools in the market, and there are many other tools available that may be suitable for the specific needs and goals of each organisation.