The DevOps movement has claimed it’s rightful place in our hearts. If it hasn’t, go read up on it. Working in a proper DevOps environment is amazing, and I cannot recommend enough for any organization to try it.

But, let’s be real. DevOps has been around for a while. It is not the shiny new thing it used to be anymore.

We need something new.

Maybe something security related, security is always an important aspect of creating software. Moreover, I definitely would not want my organization to leak the source code for a few of our big products. Maybe we can piggyback onto the DevOps train, and claim to improve it on the way? The term DevOps was coined as the combination between Development and Operations. Three letters, so let’s abbreviate security as well. Sec. We just put it in there somewhere, so we will call it DevSecOps, or SecDevOps, or DevOpsSec. Whichever order we put them in, now that the letters ‘sec’ are part of our abbreviation, we can finally make our software and processes secure. All of those critical security fixes that were denied because security was not in the name can finally be merged! Because you know, if it is not explicitly mentioned, you should not think about it or do it.

Speaking of explicitly mentioning things, having our software be reliable is probably also important. What if that application we made for the national bank suddenly falls over, and nobody is able to access their money? We cannot have that. We will have to add it. Reliability, three letters. That gives us Rel. DevRelSecOps.

We can go on and on with this, there is so many things important that should be considered that are not explicitly mentioned. So where does it end? If we don’t watch out, we might end up with a massive franken-abbreviation like DevRelPerfSusAgiSecBizOps.

Software and everything around it should be secure by default. It is one of the key pillars, as is performance, as is business focus as are other things. Do we really have to mention explicitly that something is part of our way of working to do it, and do it well?

So how can you get started with doing DevOps securely? Here’s five easy steps to get you started.

  1. Use a secret manager like Azure Keyvault with managed identity in your application to store any secrets, certificates and keys in a central place and access them securely. This way, even if your machine is compromised, the chance of your secrets leaking is reduced.

  2. Use a secret scanning tool like Github’s built in secret scanning, or gitleaks to prevent any secrets from being committed to your main branch. Automate this, so preferably use it in your pipelines

  3. Scan your external dependencies (eg packages) for security issues and outdated versions and keep them up to date with tools like SonarCloud

  4. Scan your own compiled binaries/artifacts for potential vulerabilities . For instance using Nexus Scan

  5. Use Privileged Identity Management to manage access to production infrastructure and data. Nobody has access by default, but can easily gain access without too much slowdown, and it leaves an audit trail for whoever touched production.