Part five:
Security and governance

Adopting DevSecOps and robust governance models to enhance software security and maintain compliance throughout the development lifecycle.

Discover your DevOps state

Part five:

Security and governance

It’s never been more important to adhere to security procedures and strict governance models. This way, your development practices are both sustainable and secure.

In the previous chapter, we looked at the power of platform engineering in helping you deliver quality, reliable software. And by giving organisations a system to standardise typical DevOps processes, you’re also helping to enforce stronger security and compliance controls.

Part of the platform engineering team’s role is to implement security measures. By taking advantage of cloud computing and microservices, you can ensure your applications are as secure as possible. Alongside tools for automation and monitoring, cloud-computing platforms like Amazon Web Service (AWS) and Microsoft Azure include built-in security measures and processes so you can better keep track of data breaches and common vulnerability and exposure attacks.

Governance models

It’s imperative you have clearly defined security charters and have policies in place that outline the security roles and responsibilities for the business. When this happens, business leaders and security teams are aligned on security priorities and are able to handle any issues that arise in a collaborative and coherent manner.

Security governance has a number of important functions, from managing and reporting on risk to allocating related budgets and resources. You’ll need to choose a governance model that makes sense for your organisation – whether centralised, decentralised, or matrixed.

This will be dependent on:

Your organisation’s size and how distributed your organisation is

Existing security and compliance needs – are you part of a heavily regulated industry?

Your security maturity – how much responsibility is embedded through your organisation? Are you shifting security left and embracing DevSecOps or are security concerns very much siloed?

Luckily, there are a number of existing security frameworks you can follow to support the rapid and effective deployment of security governance infrastructure.

Discover your DevOps state

Continuous monitoring

Continuous monitoring enables DevOps teams to observe and detect issues with security and compliance at each stage of the software development pipeline. With real-time data at their fingertips, it makes implementing security measures that much easier, from threat assessment and incident response to root cause analysis.

With a well-oiled continuous monitoring system in place, including a well-time alert system, you’ll increase the transparency and visibility of your IT operations and enable rapid response. Security threats are unavoidable, but if you’re notifying the right people the minute an incident occurs, you can respond efficiently, minimising the damage to your business and the impact to your customers – and get back to business as usual as soon as possible.

Metrics worth mentioning

When it comes to the key metrics to indicate the performance of your software development team, DevOps Research and Assessment (DORA) is the gold-standard. Initially, they recommended tracking these four:

Deployment frequence
Lead time for changes
Change failure rate
Time to restore service

Those last two are particularly important when it comes to measuring stability, and how you respond to code failures or security breaches. By measuring these values regularly and iterating to move the line on these numbers, you can achieve much more secure, reliable software. In 2021, DORA added a fifth metric: reliability, to take into account availability, latency, performance, and scalability, encouraging organisations to prioritise operational performance alongside delivery performance.