Security Isn’t a Four-Letter Word: How Infrastructure as Code (IaC) Amplifies DevOps Through the Inclusion of Security

Our fast-paced lives are fueled by innovative, cloud-native companies. We are able to watch our favorite programs and movies from anywhere in the world on any device. We are able to collaborate with our colleagues on an upcoming presentation, regardless of whether we’re in the office or at home. Many companies responsible for these contemporary conveniences use a DevOps approach. DevOps isn’t just a portmanteau of “development” and “operations”— it’s a culture, a mindset dedicated to delivering the best product as quickly as possible. And for many DevOps teams, it’s a great time to be in business. Speed, agility, and innovation breed success for many businesses using this approach, and the DevOps team is often recognized as the hero of the story.

But in the midst of the exciting and dynamic continuous integration/continuous delivery (CI/CD) product lifecycle, security teams are often unfairly portrayed as villains. Sure, they might not cause destruction of epic proportions, but they are often seen as obstructionists, blocking both speed and innovation. At very best, security teams are viewed as the bearers of bad news. They tell developers to fall in line and threaten to shut down their work if they don’t comply. It’s not uncommon for the importance of the security team’s messages to become diluted, and for developers to ignore or resent their guidance.

However, with the move to the cloud, security needs to be a core function of everyone’s job. Self-service access means ownership and responsibility. We need look no further than the weekly announcements of the latest breach to understand the incredible impact that poor security practices have on companies and their customers. Thus, security should be a fundamental concern for any business working in the cloud. Without security, an empire turns into a house of cards. One misconfigured setting leads to a data breach, which leads to astronomical fines, consuming all profits.

What if cloud security was part of the DevOps process? What if cloud security was part of the solution instead of a constraint? Organizations shifting left by integrating security earlier in the CI/CD pipeline are more secure and have greater chances of achieving long-term success.

Tools that facilitate security and compliance early in the development process using automation are essential to an organization’s ability to shift leftward.

DivvyCloud by Rapid7’s infrastructure-as-code (IaC) security feature addresses cloud security far before runtime, saving valuable time and resources. It enables our customers to have a full understanding of how their “to-be-built” infrastructures or changes to their code will affect the security and compliance of their cloud footprints. This capability bridges the divide between the DevOps and security teams and creates a better experience for everyone. Ultimately, there will be a greater likelihood that developers will participate actively in security.

Earlier inclusion and more participation fosters the harmony that CISOs are seeking—that sense of ownership and shared responsibility for security. Within this ideal state, developers work with greater efficiency and produce more secure applications. Learn more about IaC security and what it can do for you.