Examining the value artificial intelligence brings to DevSecOps and the entire software development cycle.
The term DevSecOps stands for development, security, plus operations and is an extension of DevOps. According to Amazon Web Services, each term defines different roles and responsibilities of software teams when they are building applications.
It goes on to define development as the process of planning, coding, building and testing applications. Security as it implies is the means of introducing this layer earlier in the software development cycle. For example, programmers ensure code is free of
While the notion of DevSecOps is not new to developers, they do not always code with security top of mind. The pressure to shorten the software development lifecycle timelines and deliver quality applications − ahead of the competition and that align with the business objectives − is immense.
Cyber security vendors are not only hugely investing in revolutionary AI tools, but delivering them to market.
Application delivery teams need to manage resources and balance agility, security, scalability and compliance requirements and more. Automation of DevOps through
AI adding value
AI has changed the role of developers today, making some jobs obsolete as generative AI (GenAI) can now find flaws, generate code patches, test cases and perform tests, changing the role of the human in the cycle from point tasks to software delivery.
The higher value tasks are strategy, planning, interoperability and dependencies across applications and multiple data environments. These tools assist with performing the basics, freeing developers to graduate to executing these higher value tasks.
Developers are no longer needed for devising lines of code − this is now the job of machines, leaving humans free to focus on creative design, quality assurance and resource management.
Creating new value
DevSecOps enables the integration of security testing earlier in the software development lifecycle, rather than at the end, when vulnerability findings requiring mitigation are more difficult and costly to implement. It is an extension and ideally an implied requirement of successful DevOps.
Infrastructure security is a requirement of DevSecOps with the right tools supporting the goal of continuously integrated security. This includes issues such as selecting an integrated development environment with security features. The tools and processes must also be able to automate some security gates to prevent any slowing down of the DevOps workflow − this last is essential.
DevSecOps helps development teams address security issues efficiently. It is an alternative to older software security practices that could not keep pace with tighter timelines and rapid software updates. Developers are now enabled with enhanced automation throughout the software and application delivery pipeline to eliminate coding mistakes and ultimately reduce breaches.
Implementing DevSecOps tools and processes to integrate security into the DevOps framework enables the release of secure software faster. Developers can test code for security and detect security flaws as it is written. By integrating DevSecOps with the tools developers are already using, dev teams can more easily improve the security aspect of web application development.
The direct business benefits of DevSecOps, outside of the positive security and compliance outcomes, includes reduced time to market.
It prevents the security assessment process from becoming a bottleneck in the development cycle. It drives collaboration between development, operational and security teams.
It helps the different players in the development cycle to prioritise the security of the software they are designing but also to continually strive to devise new ways to add value for the customer without compromising on security. This is only possible through the magic of AI.
In conclusion
According to Forbes, GenAI is the one subject that everyone in the world of technology had an opinion on in 2023. It states that in approximately the one-year timeframe since OpenAI’s ChatGPT put GenAI on everyone’s radar, it is reported to have caused wonder, fear, paranoia and a lot of hype.
Much of the public noise on it revolves around concerns regarding the accuracy − or lack of it − of large language models, such as OpenAI’s ChatGPT and Google’s Bard.
It’s important to note that both these platforms are trained on huge, opaque datasets gathered from the internet. Without careful attention and planning, GenAI can produce overly general, biased, or outright incorrect responses.
Such observations are generalisations and not applicable to the value being added in the development and security space by the implementation of automation made possible by AI.
Cyber security vendors are not only hugely investing in revolutionary AI tools, but delivering them to market − these solutions are aimed at integrating security precautions from the very outset of the software development lifecycle.
These state-of-the-art tools take a proactive approach towards potential threats and adapt to cater to the unique data needs of individual businesses, facilitating a more exhaustive insight into vulnerabilities in on-premises and cloud-based environments.
Written by: Paul Meyer, Security Solutions Executive, iOCO Tech
Originally featured here