Pitfalls to avoid when adopting DevOps

devops2As DevOps continues to grow in popularity, some organizations still struggle with its successful implementation. Perhaps developers really don’t understand the practice and chafe at being forced to follow its concepts? Maybe the network engineers feel DevOps favors the software team, while automating many of their standard administrative tasks?

Whatever the reasons for its difficulty in adoption, getting things right offers many benefits to software shops of all sizes. DevOps plays a key role in boosting development efficiency to the point it becomes a competitive advantage. So, let’s take a look at a few common pitfalls to avoid when adopting DevOps.

Avoid these Mistakes when adding DevOps at your Software Shop

Rebecca Dodd, from the software development process experts at GitLab, wrote an article for DZone covering these major pitfalls to avoid during a DevOps implementation. She talked with a few people at GitLab responsible for project success with their customer base. They provided interesting food for thought on what issues hamper DevOps adoption.

Focusing Too Much on the Tools

GitLab noted that companies who make too much of an investment on their toolset tend to encounter difficulty when implementing DevOps. GitLab Technical Account Manager, John Woods, commented on the issue. “You think you have it all when you’ve got your issue tracker, version control system, CI/CD service, etc. However, what’s the cost of setting all those up and configuring them to ‘talk’ to each other?” said Woods. 

In essence, the time spent configuring and integrating multiple tools takes up valuable time and resources. GitLab calls this the “DevOps Tax.” Make it a point to ensure you use tools that support your DevOps policies and procedures; not the other way around.

In a similar fashion, some companies simply become too attached to their development tools. This adds difficulty if those tools aren’t really compatible with the unique DevOps methodology. GitLab notes some customers try to wrench decades-old tools into their fledgling modern workflow.

Ultimately, the smartest tack involves finding the right integrated toolset compatible with how software gets written in a DevOps world.

Deployment and Monitoring are as Important as Development and Testing

Another pitfall noted by Dodd involves companies not covering the entire SDLC when adopting DevOps. Instead, the only follow its principles for software development and QA, ignoring it for the deployment and monitoring processes. Ultimately, this isn’t a true DevOps implementation.

In most cases, companies leverage DevOps to achieve continuous integration or continuous delivery. Reaching these goals isn’t possible without a full adoption of the methodology. In short, go hard or go home!

Security needs to be part of the DevOps Equation

We previously talked about the importance of information security as part of any DevOps implementation. This is one of the reasons DevSecOps is a hot buzzword. In these days, cybersecurity needs to be a core concept within any software development practice – DevOps or not.

GitLab notes that companies adopting DevOps who still treat security as an afterthought ultimately struggle with its implementation. Valuable resources end up making security-related fixes at the last minute. Consider a DevSecOps approach.

Ultimately, steer clear of these pitfalls to ensure your DevOps adoption goes great!

Keep coming back to the Betica Blog for additional insights and dispatches from the wide world of software development. Thanks for reading!

Is DevSecOps making a Difference in Information Security?

devsecops
It seems nary a week passes without a story about a hacking incident making the evening news. Additionally, many CIOs report a skills gap when it comes to employing experienced information security professionals. As such, the demand for these IT pros is now going through the roof – as well are their salaries.

So what about DevSecOps, the cybersecurity focused variant of the DevOps methodology, slash, organizational structure? We’ve talked about it in the past and are wondering if it is truly making a difference in today’s technology world. Let’s take a closer look.

The Current State of DevSecOps in the Industry

Last month, SD Times looked at what inroads DevSecOps is making throughout the software development industry. They asked the same question as us: is it truly making a difference considering the never-ending scourge of cyber attacks and similar forms of nefarious behavior. Considering the difficulties some organizations encounter when implementing DevOps itself, it is simply too new to make much impact?

Derek Weeks, vice president and DevOps advocate at Sonatype, echoes that opinion. “I will say I think we’re early on in the DevSecOps movement of practices that are being implemented. I think with the organizations that have attempted to do it, they are seeing early successes and are happy with that. The vast majority of the market has not gotten their feet wet with DevSecOps practices yet,” said Weeks.

When looking at the recent tech news, however, it becomes time to quote Spock: “Mr. Scott, speed is of the essence.” The core of the issue involves successfully implementing security within a software engineering organization’s current DevOps initiatives. If those practices are still emerging, obviously adding the “Sec” to DevOps becomes more difficult.

A Cultural Change is Essential for a DevSecOps Implementation

A successful DevSecOps implementation requires both a cultural shift within a software development shop as well as buy-in from the executive team. Of course, these same things are necessary for switching to DevOps itself. Obviously, a mature DevOps organization will likely find it easier adding security to an existing framework.

Weeks feels security practices need to be actually embedded in the software development workflow, as opposed to tacked to the process after the fact. Making information security practitioners serve as a gatekeeper instead of collaborator isn’t the best approach. They need empathy for the entire SDLC. 

Training software engineers in the proper application of cybersecurity technology ultimately works better. This serves to foster the kind of teamwork and collaboration that is the hallmark of DevOps itself. It also provides companies the chance to close their information security skills gap in an internal fashion.

John Martinez, vice president of customer solutions at Evident.io, commented on the inroads DevSecOps is making at his firm: “I think the DevOps side of DevSecOps has definitely been much faster to respond and I think we’re starting to see, at least on our side, the cross-pollination on the security side where a lot of the agile practices are starting to fit over on the SecOps side.”

Ultimately, DevSecOps is a still emerging practice. However, the importance of companies successfully implementing it cannot be overstated.

That’s it for this edition of the Betica Blog. Stay tuned for additional insights from the wide world of software development. Thanks for reading!

DevOps needs an Influx of Information Security Talent

As DevOps continues to become an essential part of software development and the information technology world, it is also suffering from lack of engineers experienced in cybersecurity. The need for these skills remains paramount, as highlighted by the recent CCleaner malware incident at Avast, where hackers were able to inject nefarious code into Avast’s build process. Customers – unaware of the hack – then installed the malware on their system when installing CCleaner.

Industry surveys reveal a notable lack of information security talent throughout the IT industry, but especially when it comes to those working at a DevOps shop. Let’s take a closer look at the data. Perhaps it inspires your company to close a similar skills gap in your office if it exists?

Causes of the Cybersecurity Skills Gap

Veracode and DevOps.com recently combined to produce and publish the 2017 DevSecOps Global Skills Survey. One of the more interesting findings of the survey reveals that 70 percent of the 400 respondents currently working at a company that follows DevOps feel they didn’t receive enough training in cybersecurity. This applies both to university coursework and post-graduate professional training.

Considering 80 percent of the survey respondents hold either a bachelors or masters degree, it becomes obvious colleges need to ramp up cybersecurity content as part of their IT-related curriculum. Over two-thirds of those surveyed feel the security education they received didn’t sufficiently prepare them for the real world. Alan Shimel, editor-in-chief at DevOps.com, feels businesses also need to work diligently to close this skills gap.

“With major industry breaches further highlighting the need to integrate security into the DevOps process, organizations need to ensure that adequate security training is embedded in their DNA.  As formal education isn’t keeping up with the need for security, organizations need to fill the gap with increased support for education,” said Shimel.

Professional Cybersecurity Training is a Must

Unfortunately, the survey also notes an issue with DevOps professionals receiving sufficient cybersecurity training once they are employed. Less than half of the respondents said their companies paid for any additional security training. 70 percent of those surveyed felt their overall cybersecurity training was inadequate for the nature of their work.

Maybe an unforeseen benefit of the malware attack on Avast is an increased focus by companies on providing the right security training for their DevOps employees? Universities and technical colleges also need to improve their offerings. These are points echoed by Veracode’s VP of Engineering, Maria Loughlin.

“Our research with DevOps.com highlights the fact that there are no clear shortcuts to address the skills gap. Higher education and enterprises need to have a more mature expectation around what colleges should teach and where organizations need to supplement education given the ever-changing nature of programming languages and frameworks. The industry will have to come together to ensure the safety of the application economy,” said Loughlin.

When even companies specializing in cybersecurity become victims of hacking, like Avast, everyone takes notice. Ultimately, if your company leverages DevOps and its array of Cloud-based tools to make its software development practice more efficient, cybersecurity training for your team needs to be an important consideration.

Thanks for checking out the edition of the Betica Blog. Keep coming back for additional insights from the software development world.