97 Things Every Information Security Professional Should Know

Chapter 78. DevOps for InfoSec Professionals

Sasha Rosenbaum

The term “DevOps” first appeared in 2009, at the eponymous DevOpsDays conference in Belgium.¹ Since then, the term has become popular in the industry and evolved to cover a range of related concepts. In this article, we will review the two primary pillars of DevOps: culture and automation.

Culture

As computer science matured as a field, IT departments began to split vertically along the technology stack, creating separate teams for development, QA, application security, operations, and so on. In large organizations, these teams were often separated by a ticketing system, with lengthy handoffs and significant administrative overhead.

To make matters worse, it appeared that the teams had opposite incentives—developers were asked to create new features as quickly as possible, whereas operations were asked to prevent system outages. Since most outages occurred during new releases, operations were reluctant to push any changes to production. Many organizations delivered software on a two- to three-year cadence, and the process of creating a production-ready version could take months. Applications were often “down for maintenance” for entire weekends. Speed of innovation appeared to be in conflict with reliability.

As the world moved increasingly towards a software as a service (SaaS) model, organizations needed a way to ...