Nudge DevOps Patterns Toward Security Standards

As DevOps teams have more tightly integrated development and operations work, as developers spin up and down their own infrastructure, and as automation has put more power in the hands of software delivery teams, the smashed silos are increasing speed of delivery and agility within IT departments. But they're also busting apart a lot of the important separation of duties that auditors demand, creating a "free-for-all [that] will need reining in for the sake of security," says Wendy Nather, head of advisory CISOs at Duo Security (now Cisco) and RSA Conference advisory board member.

"The need to reference a reliable, repeatable security process and model will likely result in leading tech companies sharing their experiences in working groups, and those practices will coalesce into firmer standards," she says.

Security leaders hoping to build standards and guardrails within their DevSecOps teams should be seeking out this kind of standardization work -- both to help contribute toward it for the sake of the community, and to keep track of developments to make internal improvements.

Image Source: Adobe (afishman64)