CommunityDevOps ExchangePartners
10 minutes

DevSecOps Roadmap: From Architecture to Automation

Written by
Copado Team
Table of contents

Originally published by New Context.

Every good DevSecOps roadmap starts with a strong foundation. A robust architecture that incorporates scalable, adaptable solutions will help firms create a platform that allows them to respond to emerging threats. One of the best possible ways to create this process is to look at traditional, successful business solutions of the past. The Lean business model is an ideal jumping-off point for establishing the DevSecOps framework. 

Lean works for information security because it’s a cycle of solutions repeated in perpetuity. As security issues are never static, it’s essential to have a dynamic response. A lean security approach is that solution. A DevSecOps roadmap should be based on the principles of observability, detection, delivery, and resolution to allow for continuous improvement. 

What Is Lean?

The Lean philosophy was initially born on the factory floors of an automotive manufacturer. Henry Ford developed the concept in 1913 to increase production by utilizing all his resources to their fullest extent. That included setting up the factory to allow one task to flow into another and eliminate unnecessary processes that wasted time. This initial method gave birth to a wide range of other business strategies to improve productivity and eliminate waste. 

Toyota was the next to switch their manufacturing methods to a lean model. However, one obstacle was the limitations when it came to variety. Ford’s production worked to create the same product over and over again. Toyota needed a method that allowed many different products. They managed this by focusing on the complete process rather than the individual products coming off the line. Updated machines permitted the creation of a variety of parts, applicable for multiple projects. Worker upskilling and continuous improvement perfected the process. All of this eventually constituted a basic cycle that set the standard going forward:

  1. Identify value. What value does the product have to the end-user? 
  2. Map the stream. What steps are needed to bring the project to completion? 
  3. Build flow.  How can the stream be improved? 
  4. Create pull. Allow the customer’s need to drive demand
  5. Perfect. Continuously review results and improve issues.

A quick review of the stages in this continuous cycle shows that it’s relatively easy to adapt the model to improve results in software and security. Leveraging it is almost entirely necessary to establish an automatic system capable of adapting to threats. This is the essence of DevSecOps.  

A DevSecOps Roadmap Based on Lean Security 

In the first half of 2020, we saw the number of records exposed due to cyber-attacks and breaches grow by 273% when compared to the first half of 2019. This shows us that hackers are growing more sophisticated and developing better tools to escape detection. A lean security cycle is built upon traditional methodologies while allowing companies to stay on top of these ever-evolving threats. This is a four-step process.

A DevSecOps Roadmap Based on Lean Security - Copado


#1: Observe

The right configuration management tools are essential for defining and enforcing proper behavior. Secrets management also builds in observability at an individual user level. Cyber threat intelligence allows companies to monitor threats and proactively prepare for them based on trends. 

In DevSecOps we look to achieve continuous monitoring of our pipelines and automation. There are many moving parts to any pipeline, making it important to separate signal from noise by focusing attention on the important aspects. Generally speaking, we’re concerned with  categories: what’s being built, what goes into the pipeline, what comes out of the pipeline, and what’s in production. We’ll break down those categories in a future article, but you can always contact us to discuss your immediate observability needs and blind spots.

#2: Detect

Proper log management allows firms to identify abnormal system behavior and respond to it as it happens. Immutable logs are vital here, as the activity is not traceable if its integrity is in question. A proper infrastructure allows for exception-based management, where leaders are informed of abnormal system behavior while regular activity stays in system logs. 

Detection is firmly coupled with observation, so you’ll find most tools in the space will pair one with the other. In order to ensure objectivity of your detection processes, it’s important that they are positioned adjacent to your systems. If the same systems run applications and their observers, it’s possible for a single attack to compromise the application and impede or prohibit awareness of the problem.

#3: Deliver 

Just as we use automation to build, test, and deploy our applications, DevSecOps strives to bring the same level of just-in-time convenience to the end points for the consumer. API management helps firms create and publish interfaces to respond to threats, enforce proper usage, and analyze the system to get a total view of its real-time status. Containerization separates running the application from the systems hosting it, which can eliminate bugs that interfere with function. 

#4: Resolve 

The resolve step is about the big picture of the program. During the delivery stage, firms respond to individual threats. In the resolve stage, they evaluate how those responses could apply to threats on the mass scale. Infrastructure as code and security as code are solutions that can be leveraged to respond to issues for the long term in a repeatable, scalable way. 

A DevSecOps roadmap based on lean principles ensures continuous improvement needed to respond to an ever-evolving list of threats. Solutions to small problems can roll out on a larger scale to automate future resolutions. Of course, all this starts on a secure framework like Copado’s Secure Compliant Data Platform. This builds in the functions that firms need to automate their security and stay several steps ahead of bad actors. 



Book a demo

About The Author

#1 DevOps Platform for Salesforce

We Build Unstoppable Teams By Equipping DevOps Professionals With The Platform, Tools And Training They Need To Make Release Days Obsolete. Work Smarter, Not Longer.

Master Salesforce DevOps with Copado Robotic Testing
Exploratory Testing vs. Automated Testing: Finding the Right Balance
A Guide to Salesforce Source Control
A Guide to DevOps Branching Strategies
Family Time vs. Mobile App Release Days: Can Test Automation Help Us Have Both?
How to Resolve Salesforce Merge Conflicts: A Guide
Is Mobile Test Automation Unnecessarily Hard? A Guide to Simplify Mobile Test Automation
From Silos to Streamlined Development: Tarun’s Tale of DevOps Success
Simplified Scaling: 10 Ways to Grow Your Salesforce Development Practice
What is Salesforce Incident Management?
What Is Automated Salesforce Testing? Choosing the Right Automation Tool for Salesforce
Business Benefits of DevOps: A Guide
Copado Brings Generative AI to Its DevOps Platform to Improve Software Development for Enterprise SaaS
Celebrating 10 Years of Copado: A Decade of DevOps Evolution and Growth
Copado Celebrates 10 Years of DevOps for Enterprise SaaS Solutions
5 Reasons Why Copado = Less Divorces for Developers
What is DevOps? Build a Successful DevOps Ecosystem with Copado’s Best Practices
Scaling App Development While Meeting Security Standards
5 Data Deploy Features You Don’t Want to Miss
Top 5 Reasons I Choose Copado for Salesforce Development
How to Elevate Customer Experiences with Automated Testing
Getting Started With Value Stream Maps
Copado and nCino Partner to Provide Proven DevOps Tools for Financial Institutions
Unlocking Success with Copado: Mission-Critical Tools for Developers
How Automated Testing Enables DevOps Efficiency
How to Keep Salesforce Sandboxes in Sync
How to Switch from Manual to Automated Testing with Robotic Testing
Best Practices to Prevent Merge Conflicts with Copado 1 Platform
Software Bugs: The Three Causes of Programming Errors
How Does Copado Solve Release Readiness Roadblocks?
Why I Choose Copado Robotic Testing for my Test Automation
How to schedule a Function and Job Template in DevOps: A Step-by-Step Guide
Delivering Quality nCino Experiences with Automated Deployments and Testing
Best Practices Matter for Accelerated Salesforce Release Management
Maximize Your Code Quality, Security and performance with Copado Salesforce Code Analyzer
Upgrade Your Test Automation Game: The Benefits of Switching from Selenium to a More Advanced Platform
Three Takeaways From Copa Community Day
Cloud Native Applications: 5 Characteristics to Look for in the Right Tools
Using Salesforce nCino Architecture for Best Testing Results
How To Develop A Salesforce Testing Strategy For Your Enterprise
What Is Multi Cloud: Key Use Cases and Benefits for Enterprise Settings
5 Steps to Building a Salesforce Center of Excellence for Government Agencies
Salesforce UI testing: Benefits to Staying on Top of Updates
Benefits of UI Test Automation and Why You Should Care
Types of Salesforce Testing and When To Use Them
What is Salesforce API Testing and It Why Should Be Automated
Machine Learning Models: Adapting Data Patterns With Copado For AI Test Automation
Automated Testing Benefits: The Case For As Little Manual Testing As Possible
Beyond Selenium: Low Code Testing To Maximize Speed and Quality
UI Testing Best Practices: From Implementation to Automation
How Agile Test Automation Helps You Develop Better and Faster
Salesforce Test Cases: Knowing When to Test
DevOps Quality Assurance: Major Pitfalls and Challenges
11 Characteristics of Advanced Persistent Threats (APTs) That Set Them Apart
7 Key Compliance Regulations Relating to Data Storage
7 Ways Digital Transformation Consulting Revolutionizes Your Business
6 Top Cloud Security Trends
API Management Best Practices
Applying a Zero Trust Infrastructure in Kubernetes
Building a Data Pipeline Architecture Based on Best Practices Brings the Biggest Rewards
CI/CD Methodology vs. CI/CD Mentality: How to Meet Your Workflow Goals
DevOps to DevSecOps: How to Build Security into the Development Lifecycle
DevSecOps vs Agile: It’s Not Either/Or
How to Create a Digital Transformation Roadmap to Success
Infrastructure As Code: Overcome the Barriers to Effective Network Automation
Leveraging Compliance Automation Tools to Mitigate Risk
Moving Forward with These CI/CD Best Practices
Top 3 Data Compliance Challenges of Tomorrow and the Solutions You Need Today
Top 6 Cloud Security Management Policies and Procedures to Protect Your Business
What are the Benefits of Principle of Least Privilege (POLP) for My Organization?
You Can’t Measure What You Can’t See: Getting to know the 4 Metrics of Software Delivery Performance
How the Public Sector Can Continue to Accelerate Modernization
Building an Automated Test Framework to Streamline Deployments
How To Implement a Compliance Testing Methodology To Exceed Your Objectives
Cloud Security: Advantages and Disadvantages to Accessibility
Copado Collaborates with IBM to Accelerate Digital Transformation Projects on the Salesforce Platform
Continuous Quality: The missing link to DevOps maturity
Why Empowering Your Salesforce CoE is Essential for Maximizing ROI
Value Stream Management: The Future of DevOps at Scale is Here
Is Salesforce Development ‘One Size Fits All?’
The 3 Pillars of DevOps Value Stream Management
Gartner Recommends Companies Adopt Value Stream Delivery Platforms To Scale DevOps
The Admin's Quick Glossary for Understanding Salesforce DevOps