There is no manual for Dev(Sec)Ops

Dev(Sec)Ops is a practice. So start practicing. 

In speaking with SecOps, Infrastructure and Development teams, the question is where to start or why are we struggling with adopting DevOps? More often than not it's a people, process and cultural challenge, however technology has a role to play. It can help teams talk a common language, i.e. visibility. What do my container environments look like? How is my cloud infrastructure configured? What changes are happening in my cloud assets? 

This is a great starting point for any Dev(Sec)Ops initiative, or to restart a stalled initiative. Having this visibility into these dynamic environments can allow Developers to educate Security professionals on the dynamic nature of their build pipelines and can help expose potential security vulnerabilities to the Developers. From here, they agree on what guide-rails to put in place and why (that's another topic about 'shifting left'). This visibility will help up-skill the teams, drive a culture of collaboration and improve the security posture of your application & cloud estate.

Technologies, such as Prisma Cloud, very quickly provide this visibility through a couple of clicks of a mouse.  

Add a AWS cloud account to Prisma Cloud (5min video)

Or connect Prisma Cloud Compute to a container registry:

Within minutes you'll have realtime visibility (similar to the image below) into your cloud and workload environments (works for hosts and serverless, as well as containers).

From here your Dev & SecOps teams can observe your environments, the change overtime and the security posture of these assets with insights from the Vulnerability Explorer...

or the Inventory explorer. Only two examples of a number monitoring capabilities in the platform.

If you want to understand more about making Dev(Sec)Ops work, here's some interesting reading for you.

NIST - Application Container Security Guide

DOD Enterprise DevSecOps Reference Design

Prisma Cloud Operationalising Guides

Being KubeCon week in the US, you may wish to register for this upcoming session with Ashley Ward (Technical Director, Office of the Cloud CTO) and Spot covering 'Kubernetes Container Security'.

Or just reach out to me directly.