Putting the 'Sec' in DevOps: How to Train for DevSecOps

Most people tend to think that innovation only applies to new technology. But in the world of product engineering, the biggest changes can often be attributed to development methodologies and shifts in attitude. For example, the agile methodology, which emphasises "incremental, iterative, and evolutionary" development, transformed the way we create software. The shift from monolithic to microservices architecture was another cornerstone innovation that improved software efficiency and ease of development.

Over the last decade, we've seen a similar shift in the way we view security in the software development lifecycle (SDLC). DevOps—and subsequently DevSecOps—are relatively recent innovations that focus on Continuous Integration/Continuous Delivery (CI/CD) and integrating security at a fundamental level in the software being developed.

This article will tell you everything you need to know when looking for a career in DevSecOps, and how a DevOps engineer can train for DevSecOps. But first, we need to understand what these terms even mean, and how to differentiate between multiple disciplines.

DevOps vs. DevSecOps: What's the difference?

To really understand how DevOps and DevSecOps are different, we need to properly define both terms.

What is DevOps?

DevOps is a set of methodologies that combines the functions of development teams and operations teams to create a more integrated and efficient software engineering pipeline. That's where the name 'DevOps' comes from. By removing the boundaries or 'silos' dividing the two teams, organisations are able to deliver and integrate new builds at a faster rate. This is where the concept of CI/CD really took off.

What is DevSecOps?

If DevOps focused on rapid release cycles for software, DevSecOps is all about integrating security into each new build or release. Traditionally, security tended to be imperfectly tacked-on at the end of the development lifecycle as an afterthought. But as cybersecurity attacks became more of a threat, engineering teams realised that it was mission-critical to 'shift security left'. That is, building security measures into the software from the very beginning so it's baked into the code itself.

DevSecOps is the culmination of the DevOps and 'shift security left' movements, where development, security, and operations teams work as a single unit to efficiently — but also securely — release software. In that regard, DevSecOps can be seen as an evolution of DevOps.

Is DevSecOps right for you in 2021?

DevSecOps is currently one of the most highly sought-after skills in the world of software development. In 2019, the global DevSecOps market was valued at $2.18 billion, but is expected to reach $17.16 billion by 2027. That's a rise of nearly 800% in 8 years! And what's more, over 76% of cybersecurity leaders say they're facing a shortage of talent in the security industry. That's a gap you could very well help to fill.

In many ways, DevSecOps is considered an ideal that engineering teams strive to achieve, because of how it can transform not only the speed of the development and deployment process, but also ensure a high level of security without sacrificing efficiency.

But achieving DevSecOps is a lot harder than it sounds. First of all, the existing work culture at most organisations divides large development teams into smaller, specialised groups, which creates an atmosphere of tribalism between them. Moreover, different teams use different tools and techniques, so trying to unify all of these systems into one synergistic operation is a lot of work.

It's not all doom and gloom, though! More and more companies are seeing the value in adopting DevSecOps as a way to integrate security at a fundamental level on their apps. And you know what that means: tons of team leaders are looking for new talent with training in DevSecOps to make that process. New talent like you.

What skills do you need for DevSecOps?

DevSecOps is a multidisciplinary field, requiring a whole bunch of skills across software development, application security, and DevOps. But don't let that scare you! These are skills you can acquire over time, and AppSecEngineer even has Beginner-level courses to get you started.

Here are the most important skills you need for DevSecOps, whether you're looking to build a career in it or develop expertise:

• Knowledge of DevOps principles
• Understanding programming languages like Java, Perl, Python, PHP, and Ruby
• Comprehension of the latest security threats, vulnerabilities, tools, and best practices
• Knowledge of risk assessment and threat modelling techniques
• Strong communication skills

Who should learn DevSecOps?

The great thing about DevSecOps is that it's applicable to nearly every single domain of software development. Whether you're an application developer, a QA engineer, or something else, DevSecOps can be a useful skill to have. And if you're a beginner to application security, learning DevSecOps is a great way to set yourself above the rest of the candidates looking for a job.

But if you want to get specific, here's a list of roles for which DevSecOps is an absolute must-have skill:

• DevOps engineers
• Application security engineers
• Team leaders/CISOs
• Anyone interested in security and DevSecOps!

How to train for the DevSecOps Foundation certification?

The DevOps Institute offers a certification for professionals looking to get certified in DevSecOps. By taking an exam, you can validate your skills in DevSecOps culture, strategy, application and operational security, Identity Access & Management (IAM), compliance, and more.

AppSecEngineer offers a full learning path with 4 full-fledged courses to help you train for this certification and develop the skills needed to implement DevSecOps in a professional landscape.

Note: AppSecEngineer's courses are not official training material for the DevSecOps Foundation certification, but they are an excellent place to prepare for the exam.

What is the best way to learn DevSecOps?

DevSecOps, like any other domain of product engineering, poses challenges in the real world that no book (or article, for that matter) can properly prepare you for. Whether they are issues automating security tools, snags in implementing automation in a CI/CD pipeline, or something else, the experience of doing DevSecOps for real is almost impossible to replicate.

Almost.

AppSecEngineer is the only learning platform where you not only get training on par with the world's best security conferences (we've trained there, too), but you can access our signature hands-on labs. They are modelled after real-world security attack scenarios, so it's like you're doing the real thing.

All of our DevSecOps courses feature hands-on labs with every lesson, so you get to practice everything you learn. You'll get hands-on time with SAST and DAST automation, GitHub Actions for DevSecOps, SCA, Continuous Integration, and much more.

It's the best (and fastest) way to get real-world experience while you learn. You can try it for free with our 7-day free trial.