Accelerate and stay secure

Secure DevOps is helping IT organizations optimize for speed and security – so they can both deliver and defend the value they want to provide to customers. 

DevOps methods help software companies provide their customers with fast and regular improvements and updates to software products and services.  But accelerating the push of software code to production drives new risks. Meanwhile, cyber attackers are embracing DevOps techniques to create new threats and deploy them quickly. Numerous factors are their side: 

1. The cost of powerful attacks continue to decline. Toolsets like Metasploit quickly put robust hacking tooling within reach for attackers worldwide just days after vulnerabilities are discovered.
2. The low barriers to entry create more attackers. With easy access to “off the shelf” hacking capabilities, more threat actors are in a position to impact organizations.
3. The talent to defend applications is scarce. Information security expertise is in scarce supply, creating shortages of the very skillsets required to defend against an increasingly risky threat landscape.

Even so, sacrificing security in response to demands to push code faster is a bad bargain—one that often results in new risks. With Secure DevOps, KPMG offers a defined approach that recognizes security’s role in enabling better competitiveness while reducing risk.

Picturing secure DevOps

Secure DevOps seeks to make security as frictionless as possible in the application delivery pipeline so the business can deliver value rapidly. It also aims to align risk-reducing security activities to the business strategy via ever-tighter feedback loops, and by tying system metrics to business metrics.

Teams focused on Secure DevOps aim to:

• Reduce the security friction on software development
• Make the work visible so everyone can better understand where constraints happen and work together to solve them
• Enable continuous learning so developers and operations teams can reduce security risks continuously over time.

The risks of not embracing Secure DevOps are considerable: today, competing successfully depends on your ability to accelerate securely.