More often than not, when people hear the word “compliance” they assume it will be a roadblock to speed. For DevOps teams, reduced speed and productivity undermine their goals. At the same time, experiencing more data breaches leads to new compliance mandates as legislative bodies and industry standards organizations try to set minimum security baselines. Shifting security governance and compliance left by transitioning from DevOps to DevSecOps reduces the problems that teams face trying to incorporate compliance into their deliverables.

What is compliance in DevSecOps?

For DevSecOps teams, compliance entails using automation to maintain technical security controls. As digital transformation changes how companies deploy and how threat actors attack applications, automation gives teams a way to consistently manage allowed or disallowed actions.

Compliance audits scan configurations, containers, clusters, and systems to review their technical controls and ensure continued baseline cybersecurity hygiene. Some examples of compliance audits include:

• Build Automation: Review application, container images, and configurations during the build phase
• Container Orchestration: Test the running cluster and environment, including, for example, port forwarding reviews
• Cluster: Scan post-build for non-static issues like vulnerabilities

Does DevSecOps complement compliance?

Compliance is all about following rules and maintaining the same level of rule-following for the long term. More often than not, mistakes arising from human error lead to violations.

DevSecOps complements compliance because it focuses on processes and practices that reduce the potential for mistakes. For example, adopting DevSecOps requires:

• Automation: Compliance as Code automation keeps the speed of DevOps without the potential risks associated with manual monitoring.
• Feedback loops: Continuous feedback loops across development, production, security, and compliance keeps everyone involved updated and ensure appropriate documentation.
• Protecting source code: Reviewing source code and ensuring that it meets security requirements protects data while also preventing compliance violations arising from open-source components and third-party libraries.
• Documentation: Comprehensive security in production delivers runtime protection that gives DevSecOps teams the documentation needed to show that they reviewed for documented CVEs, OWASP vulnerabilities, and data leaks.

Adopting DevSecOps gives teams a way to move from “we think we’re secure” to “we can prove we’re secure.” From a compliance point of view, auditors need the documentation that proves an application follows the baseline requirements set out in the mandate.

What are five tips for implementing DevSecOps for audit-ready compliance?

All compliance roads lead to audits. Adopting DevSecOps involves building security into processes, but security governance requires having the right documentation and reviews. In order to meet compliance requirements, DevSecOps needs to find ways to streamline governance so that teams don’t compromise speed.

1) Create a cross-functional Security Governance and Compliance team

Just like DevSecOps brings together the security and DevOps teams, compliance also requires collaboration. Bringing the compliance and audit functions into the process helps ensure that everyone knows their roles and breaks down silos.

At the outset, the team should:

• Establish a common goal
• Outline responsibilities
• Set requirements
• Understand the purpose of requirements
• Find ways to integrate requirements into workflows

2) Review your processes

Most compliance mandates start with organizations engaging in a risk assessment so that they can set technical controls that mitigate risks.

From a DevSecOps perspective, this means:

• Setting access privileges according to the principle of least privilege
• Documenting business processes
• Setting incident response processes
• Building security policies into workflows

Since the cross-functional team sets the documentation requirements, DevSecOps teams can build the compliance processes directly into their workflows from the start. This reduces the amount of time spent gathering documentation for audits and eliminates the roadblocks usually associated with compliance.

3) Use visualizations

Security governance is more than technical controls. Most compliance mandates require that senior leadership and boards of directors understand their security posture. For DevSecOps teams, this means communicating differently.

With visualizations, DevSecOps teams can more effectively communicate with their audit, compliance, and senior leadership business partners. For example, some helpful visualizations would be:

• Bar graphs showing trends, such as the reduction of security risk in a branch of code
• Dashboards with color-coding for critical, moderate, and informational findings summaries
• Reports that break out risk into meaningful categories, such as a software bill of materials with vulnerable packages grouped by attacker reachability

4) Monitor controls continuously

Just as securing code a single time will not protect data permanently, doing point-in-time audits no longer effectively meets compliance mandates. Most regulations and industry standards recognize this and now require continuous monitoring to validate the effectiveness of security controls.

For DevSecOps, this aligns with the continuous development process. DevSecOps teams already use automation to build security into their daily workflows. By incorporating documentation proving these processes are in place, DevSecOps teams can help establish a stronger compliance posture.

For example, monitoring controls should include reviewing:

• Access controls
• Encryption
• Vulnerabilities

5) Incorporate security education

Employee security awareness education is fundamental to compliance. However, many people may not realize that employee security education should be tailored to specific job functions. For DevSecOps teams, this means having real-time, real-world training that helps developers review and secure code.

To comply with mandates, DevSecOps teams need an education that focuses on:

• Languages they use
• Issues they need to fix
• Realistic examples

All of these need to be built directly into existing development processes so that developers can effectively remediate weaknesses and mitigate risks. Since not all vulnerabilities are equally risky, developers need to know how to prioritize their activities so that they can efficiently secure applications.

Security governance and compliance in DevSecOps with ShiftLeft

ShiftLeft makes it easier to adopt DevSecOps while keeping compliance from becoming a roadblock. ShiftLeft gives DevSecOps teams a way to build security testing directly into their workflows so that they can continuously monitor application security during the development phase. Additionally, with ShiftLeft’s easy-to-read dashboards, DevSecOps teams can provide visualizations that help business leaders understand security and meet their compliance requirements.

To ensure a holistic approach to compliance, ShiftLeft Educate incorporates secure coding training directly into workflows. With our platform, customers can assign appropriate training to the right team, track reporting, and offer certifications needed to meet compliance requirements.

ShiftLeft CORE provides compliance reports for leadership, partners, and auditors. ShiftLeft CORE is the only code analysis platform to provide a software bill of materials (SBoM) that uniquely accounts for the attackability of open source packages used by the app. Unless attackability is determined, the security risk of your application is artificially inflated by vulnerabilities in open source libraries that are impossible for outsiders to reach given the architecture of the application.