Debunking 4 Myths of DevSecOps Adoption
Every day organizations incorporate DevSecOps into their software development, security, and operations practices to ensure they can build critical security controls into their agile software delivery.
According to one survey, 84 percent of respondents said it’s difficult to reduce risk to their applications because they’re not able to monitor, detect, and prevent attacks at the application level. So for many organizations, DevSecOps is the transformative solution to securing applications through greater collaboration between development, security, and operations.
Furthermore, DevSecOps enables the realization of many agile principles by building working, secure code iteratively.
However, many organizations hold preconceived notions and misconceptions about what DevSecOps is and why their organizations will face challenges in adopting it. Here are four common myths about DevSecOps transformation, along with the truth.
Myth: Adopting DevSecOps (and the associated automation) means giving up control.
Reality: The automation associated with DevSecOps means you’re actually gaining more repeatability and consistency in terms of governance and compliance to your security standards. Instead of giving up control, you’re codifying what controls you want in place. You are able to more effectively enforce the required access controls and activities you govern than you would be able to with a purely manual process.
Myth: DevSecOps is something that can simply be bought and implemented across the organization.
Reality: You can’t buy DevSecOps. It’s as much about culture as it is the technology that enables it. Effective cross-functional delivery means integrating technologies and collaborating to create the most effective process the meet your practices and philosophies. While tools can help enable such a process, it’s the teams that make it happen, and they are the most important part of any transformation.
Myth: You can do DevSecOps without being agile.
Reality: While agile and DevSecOps are not the same thing, they coexist. What most high-performing teams find is you can’t effectively do one without the other. It’s like trying to create lemonade with just lemon or sugar. Agile provides the fundamentals to embrace collaboration and iteratively improve the software development process, while DevSecOps provides the methodologies necessary to make agile meaningful to all parts of the business.
Myth: DevSecOps means changes for development and operations, but not security.
Reality: Transformation and collaboration don’t happen in a silo. It requires all parties to work together, share their experiences, and be open to change the way they do things in order to be more effective. That means security organizations will have to take a hard look at what they are doing and how they will adapt to new technological paradigms.
