Rapid release

Rapid, frequent, and iterative releases are very common for cloud services. This normally drives the need for DevOps practices. This can be both an opportunity and a challenge to security. The challenge is that a short period of frequent releases may not include enough time to do a full cycle of security testing. There are three maturity levels of DevOps practices:

Maturity level	Achieved	Technology adoption
Continuous integration	Source code repository and version control CI workflow with a daily build and unit testing	Jenkins Git Unit testing
Continuous delivery	Automated deploy to the staging environment Integration testing on the staging environment Deployment to production is done manually	IaC(Puppet) Docker
Continuous deployment	Automated deployment and acceptance testing on production Production changes or configuration management	IaC (puppet) Docker Automated acceptance testing Configuration monitoring

The adoption of DevOps practices means more collaboration between development, QA, IT, and operation teams, and more in-progress adoption of continuous integration or continuous delivery tools. This provides a good foundation to move to DevSecOps. Depending on the maturity level of the existing CI/CD, security practices or tools can be added on top of the existing CI/CD framework. It's the most effective and least learning curve to introduce security is don't change existing development, QA, IT, operation team the way they work. Building security tools around the existing CI/CD is still the best approach. We will explore this more in upcoming chapters.

The diagram below shows the security involved with development, QA, and operations through the whole CI/CD lifecycle.