DevOps

Attackers are already using their own
form of continuous delivery to overwhelm
the good guys. The reason security
teams can’t keep up is because the bad
guys have already figured out how to use
automation and cloud-style technologies
to scale up their attacks, says Tim
Prendergast, CEO of Evident.io and a
long-time DevOps and security
practitioner. Predergast is best
known for his former
role, leading up cloud
architecture and
security for Adobe.
“But the
defenders are
still relying
on this model
where you’ve
got a person
in front of a
console,” says
Prendergast.
“They’re just
outgunned and
outnumbered, so they
have to move into this
automation philosophy. They
have to make time for renovating their
approach and they have to be open to
new ideas.”
This means getting unstuck from
security patterns they’ve settled
into for the past 15 or 20 years, says
Prendergast.
“DevOps is bringing a whole new
Understand
That Attackers
Already Deliver
Continuously
approach to security to the table that’s
actually way better than what we used
to be doing,” he says, explaining that
security teams will be able to pivot more
quickly with attack trends if they learn
how to deploy platforms and protection
mechanisms in lean, iterative cycles
rather than relying on “big-bang releases.”
And rather than trying to be a
‘gating factor’ at the tail end of
enterprise development,
security should
be baked into
operational
practices and
automated
tooling
throughout the
development
pipeline.
“A DevOps
team will deploy
code and when
a bug pops up,
they’re very well
instrumented to
gather telemetry on the
bug, get it into repair and turn
a fix around the same day and redeploy,”
he says. This approach is in contrast to
the old model of rolling back the entire
deployment on the hunt for a pristine
deployment, delaying necessary
features for the sake of a whole list of
bugs that may take days or weeks to
take care of.
What is
Rugged
Software?
“Rugged” describes software development
organizations which have a culture of rapidly
evolving their ability to create available, survivable,
defensible, secure, and resilient software.
—From www.ruggedsoftware.org