At CivicActions, we work hard to keep clients safe and secure at the foundational level. Sharjeel Aziz, Associate Director of DevSecOps, and Dave Sumner, Associate Director of DevSecOps, filled us in on the importance of the DevSecOps Practice Area at CivicActions, why it helps build solutions from the ground up, and why security is ultimately a shared responsibility.
Image via Unsplash
For those who don’t know, what is DevSecOps and why is it important to build a practice area around it?
DevSecOps is integrating security best practices into software development and operations processes. Building a practice area around it is essential because doing so puts us in a position to advise our clients through all stages of the application lifecycle. We work with our clients to build best of the breed solutions from the ground up rather than focusing on certain portions of the application and only working on deficiencies.
Since DevSecOps is one of the shift-left approaches to software development, deployment, and reliability, our development, operations, and security teams collaborate to enhance application security and reliability. We encourage our teams to accept security as a shared responsibility to make it easier to move security-related processes left. We realize that implementing this requires a change in culture and adopting additional tools and best practices. For instance, we encourage all our projects to implement and generate software bill of materials (SBOM) by providing enterprise-wide tools and knowledge sharing.
What are your top 10 best practices when implementing DevSecOps?
- Code analysis — Source code analysis to identify vulnerabilities in static (non-running) code.
- Code reviews — Implement formal code review practices in projects and provide technology support.
- Change management — Plan and manage changes, including migration to newer application versions, OS, middleware, and libraries — update documentation.
- Compliance management — Implement monitoring, logging, and audit trails to facilitate security compliance management and automation.
- Threat modeling — Follow a systematic process to identify threats to the software, system architecture, and the execution environment.
- Red teaming — Test the security of systems by emulating adversaries’ techniques and tactics.
- Security training — Provide an annual training budget (prodev) to each team member and a “take what you need” approach to using time for prodev during business hours.
- Supply chain vulnerability scanning — Embed security and compliance in DevOps workflows to provide holistic security scanning across hosts, containers, serverless, etc.
- Software Bill of Materials (SBOM) — Generate a nested inventory of all software components comprising an application and identify vulnerabilities and licensing requirements.
- Twelve Factors app principles — Follow the best practices to build resilient, secure, and portable applications.
How do you ensure security is integrated into the development process from the outset?
Knowing and following the security rules set by the client is important. Engineers need to use safe coding practices in all their work to make sure everything stays secure. It’s also a good idea to use automatic tools that check for security problems regularly and tell us the results. This helps us find and fix any issues quickly. Following the best practices as outlined earlier, we reduce risk on our projects and ensure everyone on the team is always thinking about security.
Why is DevSecOps so important to our client work?
CivicActions puts a high value on DevSecOps due to its pivotal role in safeguarding the digital landscape. This is especially critical in our client work, like with the National Science Foundation (NSF), where we work to create a scalable, robust, and secure infrastructure. This commitment ensures that our clients’ critical missions can move forward without sacrificing security.