97 Things Every Information Security Professional Should Know

Chapter 59. DevSecOps: Continuous Security Has Come to Stay

Michelle Ribeiro

After twenty years in the InfoSec industry, my technical debt was becoming too great to avoid, and I decided to understand what all the buzz was about DevOps. Three months later, I was in Ghent, celebrating the tenth anniversary¹ of the movement and meeting figures such as Patrick Debois and Andrew Shafer,² the masterminds behind the DevOps idea.

Debois patiently talked about continuous security and how our focus must be to contribute value to the business, to make it resilient, shifting from a reactive security mindset to a proactive approach. On the flight back, I read again The Phoenix Project,³ now giving special attention to the John Pesche character. He was the typical CISO from the waterfall times: a gatekeeper, acting upon fear, in the final stages of development, just before deployment into production. Or before an audit.

I realized that, just like in the book, even after the adoption of DevOps, scheduled security audits remained a reality. Security checks happened when the code was fully baked, against some predefined list of requirements. Weeks later, the audit team would issue a PDF report with hundreds of pages. C-level executives would read only the executive summary and the conclusion. The findings would take another pair of weeks to land in the backlog.

It’s easy to see how InfoSec is ...