{"id":5154,"date":"2023-06-19T15:35:47","date_gmt":"2023-06-19T13:35:47","guid":{"rendered":"http:\/\/correcta.es\/devsecops-the-evolution-of-security-in-projects\/"},"modified":"2023-06-19T15:35:52","modified_gmt":"2023-06-19T13:35:52","slug":"devsecops-the-evolution-of-security-in-projects","status":"publish","type":"post","link":"https:\/\/correcta.es\/en\/devsecops-the-evolution-of-security-in-projects\/","title":{"rendered":"DevSecOps, the evolution of security in projects"},"content":{"rendered":"\n

Previously, we talked about how DevOps culture<\/a><\/span> culture consolidated to revolutionize development and operations departments. This made the two go hand in hand and learn together to improve business processes. Nowadays, there is a third essential component in this equation: IT security<\/strong>. This is known as DevSecOps (short for development, security and operations).<\/p>\n\n

In the past, security played an isolated and secondary role. It was not until the end of the development stage of a product or service that it was implemented<\/strong>. With the evolution of the DevOps methodology (where development cycles started to become more agile), the premature incorporation of security began to be valued. It was observed that, many times, when implemented at the end, there were errors that formed bottlenecks and even reversed the efficiency of DevOps initiatives.<\/p>\n\n

Therefore, nowadays, many companies know that, for optimum performance, both the development and systems departments must also collaborate with the security department.<\/p>\n\n

What is DevSecOps?<\/strong><\/h2>\n\n

“DevSecOps is the working philosophy that automates the integration of security into every phase of the software development lifecycle, from initial design through integration, testing, deployment and software delivery. It represents a natural and necessary evolution in the way development organizations approach security.”<\/p>IBM<\/a><\/span><\/cite><\/blockquote>\n\n

What is the difference with DevOps?<\/strong><\/h2>\n\n

The main difference, of course, is the inclusion of security from the first phase of the entire DevOps process<\/strong>. In other words, all phases of planning, programming, testing, packaging, etc., involve a security review or application process. In this way, programmers will be in contact with the security and operations teams to work together to achieve a more secure code and application.<\/p>\n\n

Why is it so important?<\/strong><\/h2>\n\n

If we start applying security from the first planning phase (in this case threat modeling), what we do is prevent and control the appearance of security problems<\/strong> in the code of our application from the very moment it is created. In short, we are programming and deploying it securely.<\/p>\n\n

In addition, the joint work of these three areas from the first minute avoids later communication or deployment problems, which can affect delivery times or malfunctions.<\/p>\n\n

\"\"<\/figure><\/div>\n\n

Benefits of DevSecOps<\/strong><\/h2>\n\n