IT Insights DevOps What Does it Mean for You?
DevOps has become a hot topic of conversation of late. But what is DevOps and what does it mean for your business? IN THE MOST BASIC SENSE, DevOps is a model for modern Agile software development in which software development (Dev) and Information Technology (IT) operations (Ops) intersect. More specifically, it is a combination of practices, tools and organizational structures designed to enhance agility and deliver higher iteration velocity. In most DevOps models, development, quality assurance and operations teams work closely together — or sometimes even on a single cross-functional team — to build, test, release, monitor and plan in a closed loop across the application life cycle. In other versions of the model, security also becomes embedded across the application life cycle; this is typically referred to as DevSecOps. By closing the gap between formerly “siloed” teams, DevOps enables organizations to develop, enhance and deliver applications and services with more speed — without sacrificing quality. This means businesses can be more responsive to customer needs and changing market conditions. Maintaining this innovative edge can also help businesses retain their existing customers and attract new ones — and even shorten time-to-market for new products and services. All of this can ultimately provide a competitive edge and enhance the bottom line. Conversely, misunderstanding and incorrectly adopting DevOps could lead to significant risk exposure throughout the application life cycle. There are risks posed by organizational inertia, the lack of a common definition for DevOps, and the ability to circumvent governance in the absence of common standards for software architecture, release management and environment management. Implemented poorly, DevOps could result in a lack of accountability as multiple hands touch the code and production environment; this could manifest itself as developers with production access, a classic segregation of duties conflict. It could also lead to taking shortcuts with documentation.
IT Insights: DevOps - What does it mean for you? The introduction of such risks and the breakdown of internal control has several potential negative consequences. For example, organizations that deliver Software-as-a-Service (SaaS), cloud-hosted applications or web applications may be unable to obtain the American Institute of Certified Public Accountants’ (AICPA) System and Organization Controls (SOC) report or other critical attestation reports that rely on management’s demonstration of adherence to predefined criteria (such as the AICPA’s Trust Services Criteria). This could negatively affect the ability to attract or retain customers. Extensive planning and forethought, enforcing consistent practices and robust controls and maintaining rigorous documentation standards all can aid with mitigating the DevOps adoption risks. As such, organizations thinking of moving to a DevOps model should be sure they also adhere to an established controls framework (ISACA’s COBIT 5, ISO 27000 series, NIST, ITIL, etc.). Industry organizations such as ISACA recommend several key controls to mitigate the risks associated with DevOps adoption, for example:
Automated software scanning
Developer application security training
Access and activity logging
Toolsets can also play a key role in mitigating risk. With a focus on automation from testing through deployment, DevOps enables modern concepts such as Microservices, including continuous integration, continuous delivery/deployment and continuous monitoring/logging. This ultimately facilitates the streamlining of software development and improves scalability while also reducing governance and compliance risks.
“
Extensive planning and forethought, enforcing consistent practices and robust controls and maintaining rigorous documentation standards all can aid with mitigating the DevOps adoption risks.
2
”
IT Insights: DevOps - What does it mean for you? In summary, when implemented correctly, DevOps can decrease operational and business risk exposure. The key is to ensure that processes, controls, and toolsets are appropriate, aligned and right-sized to both achieve a DevOps model and support it over time. For many organizations, this means engaging an outside firm with expertise in both attestation reports (such as SOC 1, 2, or 3) and modern development methodologies to help guide the transition by offering best practices insights and tailored recommendations regarding the processes, controls and toolsets that are best for the organization’s immediate and long-term needs.
DEFINITIONS AGILE Agile is a time-boxed, iterative, incremental and evolutionary approach to software development and delivery. It builds software incrementally from the start of the project, instead of trying to deliver it all at once near the end; delivery of working software is the primary measure of progress. Agile focuses on short feedback loops that enable the adaptation cycle to be more responsive to the customer and changes to requirements.
MICROSERVICES Microservices is a modular approach to software development that structures applications as a collection of lightweight, loosely coupled services using well defined and technology-agnostic APIs and protocols. These services are owned by small, self-contained teams. Microservices architecture makes applications easier to scale and faster to develop, enabling innovation and accelerating time-to-market for new features.
3
IT Insights: DevOps - What does it mean for you?
About Us Weaver’s IT advisory services group focuses on delivering performance-enhancing consultations that address your IT and business agendas. We work directly with CIOs and others to create a more risk-aware, effective IT organization that can drive process efficiencies throughout your company and better support and deliver transformational business change. Specific services we provide include: • Application controls review • Business continuity/disaster recovery • Cloud computing assessment • Data analytics • Data privacy • Information security and vulnerability assessment • ISO27001 reviews • IT audit • IT governance and organizational effectiveness • IT risk assessment • Pre- and post-implementation application reviews • System and Organization Controls (SOC) reporting
Disclaimer: This content is general in nature and is not intended to serve as accounting, legal or other professional services advice. Weaver assumes no responsibility for the reader’s reliance on this information. Before implementing any of the ideas contained in this publication, readers should consult with a professional advisor to determine whether the ideas apply to their unique circumstances. © Copyright 2018, Weaver and Tidwell, L.L.P.
4 www.weaver.com | 800.332.7952
CONTACT US Raveen Bhasin, CISM, CISA, ITIL, CSM Manager, IT Advisory Services raveen.bhasin@weaver.com Brian Thomas, CISA, CISSP, QSA Partner-in-Charge, IT Advisory Services brian.thomas@weaver.com