-: DevSecOps.
In this lesson, we're going to talk about DevSecOps.
But before we do that,
we really have to take a step back and talk about DevOps.
Now, DevOps was created to speed up the development
and get things into production faster.
As I mentioned, DevOps really relies
on the concepts of continuous integration
so that we all can be working together on the same thing
and make sure we don't have big divergent changes.
Now, when we talk about DevOps,
this is an organizational culture shift
that's going to combine the software development
and the systems operations people into one team.
This is basically the practice of integrating
these two disciplines within a company.
So, often, especially if you worked 10 or 15 years ago,
you would see this type of a paradigm
where you have development all in one area
and they all work together.
And then, you have all the operations folks
who have to operate and maintain these systems
and they'd be off in another area.
And so, development would code something
and then throw it over the wall
and then operations has to live with it and support it.
Now, this is a problem because this led to developers
not doing their best work.
And what I mean by that is there was a lot of security bugs.
There was a lot of feature bugs
and a lot of things just didn't work right.
And so, somebody had the great idea
about 10 or 15 or 20 years ago to create DevOps
which was let's take some of these operations folks
and put them in with developers
and some of these developer folks
and put them in with operations
as we make these smaller teams where they work together.
This way, when a developer creates something,
the operations team can support it.
By putting operations and developers together,
you can build, test, and release software faster
and more reliably because the people who are building it
are also the people who are supporting it, right?
Now, one of the problems with this, though,
was a lot of things were getting very quick into operations.
And then security came along and said,
"Oh, this isn't secure.
There's problems here.
We need to fix all these vulnerabilities.
And you didn't do this within compliance for HIPAA or GLBA
or Sarbanes-Oxley or whatever."
And so, this was another problem.
So, they said,
"Well, if putting dev and ops was good together,
giving us DevOps,
well, why don't we just add security in there too?"
And that's essentially what they did
and they call it DevSecOps.
Now, this is development, security, and operations,
and it's a combination of software development,
security operations, and systems operations by integrating
with all those disciplines together in one team.
Now, this is a great way of doing things
because when you're using DevSecOps,
this is going to utilize a shift-left mindset.
Now, what do I mean by shift-left mindset?
Now, we haven't really talked
about what shift-left is in this course,
because it's really not a concept
that's focused on security.
When we talk about shift-left,
it actually comes from the information technology
service management world.
When we talk about shift-left, think about it like this.
You have a series of steps that needs to be done.
And for instance,
if I talk about the software development lifecycle,
we could use that as our example.
You're going to have some kind of a plan.
You're going to design something.
You're then going to build it.
You're going to integrate it.
You're going to put it into staging, put it into production.
And it goes through all these different series of steps.
Well, if you notice that eight-step methodology
in the waterfall method,
around step four or five or six
is when we can actually start testing things.
And then you start thinking about security towards the end.
Well, with shift-left, we're trying to shift it left
or earlier in the lifecycle.
So, the idea with DevSecOps is take security,
which used to be the last thing that happened,
and put it all the way back in the beginning
with the developers
so we can think about it from the beginning.
That's the idea of shifting left.
It's moving things earlier in the lifecycle
and to earlier people in the chain.
And in this case, by doing DevSecOps
and integrating a security person
with the development and operations people,
you can build more secure systems
and get them fielded faster.
Now, what are some big benefits of doing DevSecOps?
Well, for one, you're going to integrate security
from the beginning.
This is always going to be a good thing
because it's cheaper and easier to put security in
from the beginning than to add it on later.
Another thing you're going to do
is you're going to test during and after development.
So, we're not going to wait until step five or six
to do our testing.
No, we're going to write a block of code
and we're going to test it.
And then, we're going to integrate it back
using continuous integration to the master code base.
And this way, we can have 50 or 100 programmers
working on something at once
and not have a bunch of code conflicts
because we're all getting things back in early.
If we waited a week and then I had 50 changes to put in
and you had 50 changes to put in,
that can create a lot of conflicts,
especially if we both change the same line.
But, if we commit our changes very frequently,
every couple of hours or even every day,
that's going to have a lot less conflicts.
And then the third area
is we're going to automate our compliance checks.
Now, this is another great thing about DevSecOps
because we have developers
and they can build things with code, right?
And so, if they go through and code something,
like automate compliance checks,
we can have all these things that are scripted.
So, when you create a piece of code
and you happen to work in a hospital, well, guess what?
We're going to run it against the HIPAA compliance checks
and make sure everything is within compliance.
This way, we could figure that out very early
before we go into production.
And that way, we can fix those issues faster
and save us a lot of time and effort.