Many federal agencies still utilize the "waterfall" method when it comes to software systems and development. One department completes a task, the project moves to the next department, and the next item on the list is started—everything is completed in silos. This is the way of the past.
Today's modern agency calls for the flexibility to transform software rapidly while ensuring that security tools and processes are baked into the software delivery lifecycle. This shift in mindset is the foundation behind DevSecOps, a term you’ve likely heard but may not have your head fully wrapped around.
This guide will walk you through what DevSecOps is, why it’s important, the path to implementing it in your agency, and resources for doing so.
DevSecOps is an evolution from the old waterfall method to a new lifecycle model that integrates, as the same suggests: development, security, and operations. DevSecOps emerged as a pivotal response to older, bottleneck-riddled security processes with siloed delivery pipelines.
Building and automating the development process bridges the traditional gap between IT and security while ensuring fast, scalable and reliable delivery of code. For government agencies, once-siloed teams are brought together to share the responsibility of security tasks during the delivery process. In agencies using DevSecOps, security is no longer a singular task or box to check — it’s a central component of every piece of a project.
Under old models, there were competing priorities — speed of delivery vs. secure code. With DevSecOps, however, these two important elements of every project are merged into a streamlined system. Using lean-agile practices, security testing is done in iterations without slowing down delivery cycles. Security issues are dealt with as they arise; not after a threat of compromise has occurred.
DevOps emerged in the corporate world as companies were experiencing timeline and budget overages as they released products that were out of date on launch day.
Product teams brought development and operations together and began implementing lean/agile methodologies, taking a page out of manufacturing’s playbook.
But as processes were being improved to shorten delivery times, system security was left in the dust as an afterthought. DevSecOps works to balance all these priorities and integrate security into the DevOps pipeline without sacrificing quality or slowing down delivery.
DevOps is the collaboration between development and operations teams to create a more agile, streamlined deployment framework. It's a critical shift away from the traditionally siloed mentality of many IT teams, which prioritized areas of specialization over communications.
DevOps has become a driving force in many forward-thinking agencies—born from the need to deliver software and services more reliably and quickly. The ideals of continuous testing and automation are essential to successful DevOps implementations. New deployments must be tested from the moment code is written to the hour the final product is released—and then regression tested through the product’s entire lifecycle.
DevSecOps introduces the concept of security into the existing DevOps paradigm. It's critical to apply the notion of developing a "security-as-code" culture that prioritizes both secure deployment and speed, rather than attempting to separate the two.
DevSecOps integrates key security policies such as code analysis, compliance monitoring, threat investigation, and vulnerability assessments into typical DevOps workflows. The ideal result? Native security built into new product deployments, which limits the risk of zero-day flaws and software recalls.
For years, security has been an afterthought in the DevOps process. The “old way” looks like:
When you adopt a DevSecOps approach, you intertwine three different areas—development, security, and operations—into one seamless unit. The unit then focuses on six key components:
DevSecOps sounds nice. But can it actually make your agency more efficient?
In most cases, the answer is a resounding yes. When you combine the processes of three different departments—development, operations, and security—you naturally become a more effective unit that can:
A typical DevOps pipeline includes different stages for each piece of work to be completed. For example, a typical software development lifecycle (SDLC) includes phases like plan, code, build, code, test, and deploy.
In DevSecOps, specific security checks are added in each phase:
An example DevSecOps pipeline, including the tools used at each stage, for customized version of Geocent's Apios DevSecOps pipeline.
As you improve your DevSecOps pipeline and laser focus your security efforts, you’ll identify opportunities for automation, which can further your efforts to streamline and secure the development process.
Leveraging automation makes it possible to address form and function issues at speed rather than relying on outdated manual frameworks.
Automation can:
DevSecOps allows agencies to build, test, and release secure software faster and more reliably. It’s now the standard in tech, but many government agencies are still using outdated methodologies.
Change, no matter how it arrives, is never easy. For government agencies, it can be even harder. Systems, processes, and mindsets are more entrenched because of the extreme vetting that goes into adopting these frameworks. The same goes for shifting to a DevSecOps approach to your software tech systems.
So how do you catch up to the standard and even get ahead of the curve in one undertaking?
The government sector, by and large, lags behind the commercial sector in software technology.
We’ve seen many clients still using the “waterfall” method. Each department works independently, with their own territory to lord over. They feel ownership over it, naturally, and when management comes in and wants to reclaim that territory or give it a different look, resistance is natural.
People worry. Will I lose my job? Can I keep up?
Management worries, too: Will this new approach actually work? We’ve done it one way for a long time—why are we abandoning our tried-and-true way? Why rock the boat?
You might be surprised how entrenched some people can be about this change (then again, it may not surprise you at all). And if you believe your team is truly using a DevSecOps approach, but your development and operations teams still aren't communicating or working cohesively, you lose.
No matter the challenge, DevSecOps will radically improve how your government agency works.
Gone are the worries about security checks. And the amount of time and effort saved with a continuous-integration, continuous-deployment (not delivery) environment can have a monumental impact. Your software creation and implementation can become faster, more efficient, and more secure.
The benefits seem obvious, but getting buy-in from stakeholders can be the most difficult part of going from behind the curve to cutting-edge. To fully embrace DevSecOps, you must break down barriers and foster open collaboration between development, security, and operations teams. Remember, DevSecOps is a software engineering CULTURE.
The cultivation of shared responsibilities is vital. All DevSecOps team members must see the delivery of secure services as their responsibility, rather than something handled by other teams during development or after services are deployed.
Not everyone in your organization may be as excited about the culture shift as you. Not everyone likes change, and there's one thing for certain, DevSecOps will bring change—how you work, what you do, how you interact with other people on the team, and beyond.
If you encounter persistent resistance, it may mean some staffing changes are in store. But when the work your government agency does is so important, it’s worth it in the long-term.
At Geocent, DevSecOps is more than just a buzzword. It’s integrated into every project we do—not just the projects where it’s required by contract. DevSecOps isn’t a box we tick and move along. We take a proactive approach to make sure we’re delivering quality, secure software continuously and with efficiency.
We’re a DevSecOps-focused organization, and here’s how we bring it to our clients:
There’s no one-size-fits-all DevSecOps implementation checklist out there that you can plug-and-play in your agency. You’ll likely want an experienced DevSecOps partner like Geocent by your side as you reframe priorities and bring siloed departments together.
The Department of Homeland Security Citizen and Immigration Services (USCIS) needed to modernize its systems used for immigration status verification. Geocent used DevSecOps methodologies to help replace these burdensome legacy systems with agile, efficient, cloud-based applications that help USCIS process claims more quickly and effectively.
The Marine Corps was used to taking months or years to make even minor software updates to their legacy systems. They needed a cloud-enabled platform that allows users to access and build applications for Marine Corps use, including the ability to rapidly update with a continuous authority to operate (ATO)—the first of its kind in the USMC. Our team constructed the majority of the automated testing and development, which enables the DevSecOps process within the MCBOSS environment.
Known as the Software Factory that fights wars, the goal of Kessel Run was to change how the Air Force, and by extension the Department of Defense, develops and delivers software run on classified networks that adopts the best practices from the commercial industry.
The program, once thought of as far-fetched, successfully demonstrated continuous delivery of software development, or in developer terms, the holy grail. It was a huge win for the Department of Defense.
A DevSecOps Approach to Cloud Transition