DevSecOps explained — Venture Capital perspective
Everyone knows how important security is, especially in IT. If you are still wondering why should you care, look at the chart below: the DevSecOps market size is forecasted to grow over 30% YoY reaching almost USD 6 Billion in 2023.
In this blog post, I will try to explain how security is implemented into DevOps pipeline, what are the essential categories of tools used, and what investment opportunities in the future we should look forward to. If you are not familiar with the DevOps concept, I encourage you to read my previous article “DevOps explained — Venture Capital perspective” first. Just like previously, this summary targets non-tech audience, especially Venture Capital investors like us — Inovo Venture Partners.
What is DevSecOps?
DevSecOps is the philosophy of integrating security practices within the DevOps pipeline, ensuring two seemingly opposed goals: speed of delivery and secure code. Critical security issues are dealt with as they become apparent at almost all stages of the SDLC process, not just after a threat or compromise has occurred. It’s not only about additional tools that automate tasks, but also about the mentality of your developers.
The shared ownership of security is critical because, at the end of the day, developers are able to skip many of the security tests and push their changes anyway.
DevSecOps enables “shifting left” many issues, and by that, I mean finding bugs and holes at earlier stages of the development. The earlier you find the problem, the cheaper it is to fix. The more automated the process, the more time your security team has to focus on challenging and non-trivial issues, instead of solving the same thing over and over again. Implementing DevSecOps is the next step of DevOps which ensures fast, safe delivery of code as well as decreases downtime and number of vulnerabilities.
What is the future of DevSecOps? We asked Konstantin Vinogradov from Runa Capital to answer this question:
DevSecOps Pipeline
In this section, I’m will try to categorise DevSecOps tools only. You should be familiar with core DevOps tools, and you can always revisit this article in case you aren’t.
- IDE Plugins — IDE extensions that can work like spellcheck and help to avoid basic mistakes at the earliest stage of coding (IDE is a place/program where devs write their code for those who don’t know). The most popular ones are probably DevSkim, JFrog Eclipse, and Snyk.
- Pre-Commit Hooks — Tools from this category prevent you from committing sensitive information like credentials into your code management platform. There are some open-source options available, like git-hound, git-secrets, and repo-supervisor.
- Secrets Management Tools allow you to control which service has access to what password specifically. Big players like AWS, Microsoft, and Google have their solutions in this space, but you should use cloud-provider-agnostic ones if you have multi-cloud or hybrid-cloud in place.
- Static Application Security Testing (SAST) is about checking source-code (when the app is not running). There are many free & commercial tools in the space (see here), as the category is over a decade old. Unfortunately, they often result in a lot of false positives, and can’t be applied to all coding languages. What’s worse is that they take hours (or even days) to run, so the best practice is to do incremental code tests during the weekdays and scan the whole code during the weekend.
- Source Composition Analysis (SCA) tools are straightforward — they look at libraries that you use in your project and flag the ones with known vulnerabilities. There are dozens of them on the market, and they are sometimes offered as a feature of different products — e.g. GitHub.
- Dynamic Application Security Testing (DAST) is the next one in the security chain, and the first one testing running applications (not the source code as SAST — you can read about other differences here). It provides less false positives than SAST but is similarly time-consuming.
- Interactive Application Security Testing (IAST) combines SAST and DAST elements by placing an agent inside the application and performing real-time analysis anywhere in the development process. As a result, the test covers both the source code and all the other external elements like libraries and APIs (this wasn’t possible with SAST or DAST, so the outcomes are more accurate). However, this kind of testing can have an adverse impact on the performance of the app.
- Secure infrastructure as code — As containers are gaining popularity, they become an object of interest for malware producers. Therefore you need to scan Docker images that you download from public repositories, and tools like Clair will highlight any potential vulnerabilities.
- Compliance as code tools will turn your compliance rules and policy requirements into automated tests. To make it possible your devs need to translate human-readable rules received from non-tech people into code, and compliance-as-a-code tools should do the rest (point out where you are breaking the rules or block updates if they are not in line with your policies).
- Runtime application self-protection (RASP) allows applications to run continuous security checks and react to attacks in real-time by getting rid of the attacker (e.g. closing his session) and alerting your team about the attack. Similarly to IAST, it can hurt app performance. It’s 4th testing category that I show in the pipeline (after SAST, DAST, and IAST) and you should have at least two of them in your stack.
- Web Application Firewall (WAF) lets you define specific network rules for a web application and filter, monitor, and block HTTP traffic to and from a web service when it corresponds to known patterns of attacks like, e.g. SQL injection. All big cloud providers like Google, AWS and Microsoft have got their WAF, but there are also specialised companies like Cloudflare, Imperva and Wallarm, for example.
- Monitoring tools — as mentioned in my DevOps guide, monitoring is a crucial part of the DevOps manifesto. DevSecOps takes it to the next level and covers not only things like downtime, but also security threats.
- Chaos engineering. Tools from this category allow you to test your app under different scenarios and patch your holes before problems emerge. “Breaking things on purpose is preferable to be surprised when things break” as said by Mathias Lafeldt from Gremlin.
- Vulnerability management — these tools help you identify the holes in your security systems. They classify weaknesses by the potential impact of malicious attacks taking advantage of them so that you can focus on fixing the most dangerous ones. Some of the tools might come with addons automatically fixing found bugs. This category is full of open source solutions, and here you can find the top 20.
Additional reading:
DevSecOps reference architectures 2018
I hope that this blogpost increased your understanding of the DevSecOps space. If you have any comments, see any gaps in the pipeline or if you know (or are building) better solutions for DevSecOps that I haven’t mentioned above, make sure to reach out to me on LinkedIn.
Inovo Venture Partners backs early-stage, post-traction startups that can grow 100x. We partner up with ambitious founders like Stefan from Booksy, Maja from Zowie, or Marcin from Spacelift. We invest between €0.5–2m in startups from Poland and the region.
