Read Blog Post

Read Blog Post

Contributed on February 17, 2021

3

319

DevSecOps

Blog: Capgemini CTO Blog

Development expectations have fundamentally changed and IT teams need to enable significantly faster time-to-release, align more closely to product and business teams, improve security, and enable the shift to new ways of working.

However, there are many barriers to achieving agility that organizations face. In our work with clients, we’ve uncovered a number of inefficiencies that are typical of organizations that don’t have a solid DevSecOps strategy in place, from unnecessary time spent on manual tasks to software vulnerabilities. In fact, we’ve found that 40 percent of time is spent completing tasks that can be automated, 85 percent of testing is done manually, and 35 percent of time is spent on rework

DevSecOps, when done well, can help organizations overcome these hurdles at pace and with the desired level of security. It can reduce effort, accelerate release velocity, reduce costs, and improve security and compliance. In fact, some of our clients have realizes 80 percent gains in efficiency, 30 percent faster release times, and 100 percent process compliance.

Key ingredients for a successful implementation

An effective DevSecOps strategy includes the following components.

• People transformation: Though DevSecOps is often thought of primarily as a technology or process change, people are at the heart of its success. Moving from the traditional way of working to the DevSecOps mindset requires a cultural shift. In fact, these initiatives most often fail because of people-related issues. To overcome this, leaders need to clearly define new DevSecOps roles and responsibilities, restructure teams accordingly, and choose team members who have what it takes to kickstart the new way of working to motivate and inspire others.
• “Everything as code” automation: Manual tasks should be completely eliminated, and automation should be the name of the game. “Pipeline as code” ensures continuous integration, “infrastructure as code” enables continuous deployment, and “containerization as code” enables dockerization. In short, when everything is delivered as code, you can begin to work in a truly agile manner.
• “Continuous everything” processes: In DevSecOps, every single step should be automated, including unit tests, integration tests, deployment, and performance and security tests, and replayability should all be continuous.
• “Shift left” and fail-fast focus: To ensure quality while lowering costs with DevSecOps, teams need to become proactive rather than reactive when it comes to code quality. This means that quality compliance should “shift left,” or occur much earlier in the development lifecycle. By testing as soon as possible and enabling test-driven development, you can detect issues quickly to prevent costly quality problems later.
• Proper tooling: There are a lot of DevSecOps tools out there, with new ones being released every day. It’s important to choose the right tools.

Getting started

Successfully implementing a DevSecOps strategy with the components laid out above requires careful planning and consideration, which is why we recommend a three-part assessment and roadmap phase to ensure a successful DevSecOps transformation journey:

1. Begin by defining your current maturity, whether you’re at the very beginning of your DevSecOps journey or are more advanced
2. Then, build a roadmap with a diagnostic approach
3. Finally, categorize and sequence applications for implementations based on complexity.

Capgemini’s DevSecOps Acceleration Platform helps organizations achieve DevSecOps success and maturity. Combining and streamlining all DevSecOps tasks in one simple and intuitive user interface with a highly configurable deployment workflow and automated recommendations to make application improvements at every stage of the lifecycle significantly accelerates time to market. For more information about how to jumpstart your DevSecOps journey, please reach out or visit our webpage.