Government Innovation, Readiness Will Require More Than Just DevOps

Over the past several months, when the spread of the coronavirus triggered major industry shifts, states looked to spring into action and deliver much-needed unemployment benefits to their constituents. While many systems worked well, some legacy systems were unprepared for the sudden rise in demand.

This story isn’t a new one: Many legacy systems work well during typical times, but when circumstances move beyond the status quo, organizations often find operations aren’t as efficient or effective as they would like. Oftentimes, it falls to IT operations teams to cobble together an infrastructure that will work on the fly.

But there are ways to prepare systems for major and sudden changes. Modernizing systems via a DevSecOps approach, fosters greater collaboration, which can help these teams prepare to take on unexpected fluctuations in demand.

So, what is DevSecOps, exactly?

Many are familiar with a DevOps approach, which combines development and IT operations. While DevOps on its own has many merits for government organizations, in order to further accelerate innovation and digital transformation, as well as continue to improve citizen services, the public sector needs to embrace security in this process, as well. This is DevSecOps, an approach that integrates security from the start and allows teams to build scalable, secure applications that they can continually improve and update, Microsoft experts say.

“Moving to a DevSecOps model lets teams react and respond much faster to the shifting needs of the population,” says Jon Wall, enterprise security executive at Microsoft.

From an IT operations standpoint, DevSecOps allows the team to set up more secure development and production environments, laying the groundwork for apps that are much more reliable and secure.

“You don’t want to wait until a customer tells you a system’s broken or that someone hacked into a user’s account,” says Reuben Cleetus, a senior cloud solution architect at Microsoft. “Having insights to what your customers are doing through metrics and telemetry, for example, can help you understand what normal and abnormal look like. Unless you can tell the difference, you won’t know when things go awry until it happens, and by then it’s too late.”

Benefits of DevSecOps for IT Operations

In software development, IT operations focus on providing developers with a stable environment to run applications. But they historically worked in silos: Developers wrote code and then created 100-page documents with step-by-step instructions for IT operations teams to deploy apps into production, says Harshal Dharia, an Azure specialist at Microsoft.

If operations accidentally skipped a step during deployment, it could cause a security vulnerability or some other failure. It was a model rife with finger-pointing if things went awry.

But with DevSecOps, operations and developers become a single, collaborative team and security is infused from the beginning. In fact, in DevSecOps, some organizations use infrastructure as code. Instead of manually configuring hardware and operating systems, they automatically provision the infrastructure needed to deploy apps. The IT operations team works with developers to create those automated scripts. 

“In this new model, half the time the developers are the ones deploying the apps. It makes the whole process easier,” Dharia says.

Security teams get a voice throughout the development pipeline, from the software planning, coding, building, testing and release phases to deploying, operating and monitoring applications. That helps IT operations stay proactive when it comes to security and ensure code vulnerabilities are spotted and fixed early in development, says Giulio Astori, a senior cloud solution architect at Microsoft.

“Adding security into the framework is a big benefit because it improves the security posture of your product from the beginning,” Astori says.

How to Set Up a Secure Environment with Zero Trust Policy and Continuous Feedback Loops

As part of DevSecOps, the government IT operations team must work with the security team to take a layered approach to security and implement a Zero Trust model.

Zero Trust models require strict access control, user authentication, device verification and real-time network and systems monitoring to detect threats and abnormal behavior. For example, Microsoft Azure analyzes 6.5 trillion points of security data every day.

“When you’re talking about Zero Trust, you’re talking about verifying identities with strong authentication, verifying a device with a set of policies and monitoring and controlling access with real-time analytics and metrics,” he says. “If we’re doing good DevSecOps, we’re designing with a Zero Trust model in mind,” Wall says.

The IT operations staff must also encrypt data at rest and in transit as well as segregate network traffic, so applications are on different networks, Cleetus says.

Public sector agencies also need to deploy a continuous feedback loop to get continual insight on security vulnerabilities and threats.

Agencies can deploy tools that enable continuous feedback throughout the development pipeline. That includes automated testing and monitoring tools and tools that ensure sensitive data or secrets are not inadvertently shared. When vulnerabilities or threats are discovered, the security, development and IT operations teams can collaborate to apply fixes quickly, Cleetus says. Reducing Mean Time to Recovery (MTTR) is a key benefit of DevSecOps.

Continuous feedback also means getting feedback from customers, understanding their wants and needs and continually making application improvements so customers are satisfied, Cleetus says.

“This is about government adopting these frameworks and models and doing it right, so they can be more efficient and build better systems and improve citizen services,” Wall says.

Learn more about how DevSecOps can help the public sector make collaborative, secure, agile innovation a reality across the federal government.

Be sure to check out other topics covered in this series:

• Rapid Deployment: Why DoD Is Ready for the DevSecOps Era
• Ways to Jump Cultural Hurdles to Realize Effective Government DevSecOps
• Shifting Left: How DevSecOps Strengthens Agency Security and Risk Management
• How Public Sector Developers Can Achieve DevSecOps Through Collaboration and Open Source Tool
• Breaking Down Silos: DevSecOps Makes Security Everyone's Business