DevSecOps vs. DevOps: What’s the Difference?

DevOps culminated from efforts to solve the disconnect and dysfunction built into the software development process. Although they had the same ultimate goal, software developers and IT operations traditionally worked separately, under different leaders and toward different objectives and priorities. Without avenues for collaboration, developers’ and ops professionals’ differences grew into roadblocks that negatively affected time to market and customer satisfaction.

DevOps is defined as a business-driven approach for delivering customer value using agile methods, collaboration and automation. It makes software development more holistic by breaking down traditional silos, encouraging communication and moving away from the rigidity of the waterfall methodology. Done right, it allows organizations to release a greater volume of software more quickly (or continuously) while maintaining a high level of quality. Customer satisfaction and value are the primary measures of DevOps success.

DevSecOps builds on DevOps by adding security and compliance explicitly into the mix. In an environment of escalating risk, it makes good business sense to eliminate security breaches and vulnerabilities wherever and as early as possible. Whereas traditional application security testing is done late in the software development cycle, the DevSecOps approach builds in security during development. Runtime protection is an essential part of a DevOps strategy. 

DevSecOps views application security as part of a continuous improvement process that spans development and operations. However, the object is not to eliminate all vulnerabilities during development, but rather to speed up development without compromising security and compliance.

Aside from having development and operations in common, DevOps and DevSecOps both rely on an agile, collaborative approach that emphasizes automation. In an ideal software development scenario, all software would be developed with security in mind. As security is in everyone’s interest, developers ideally consider it whether working with a DevOps or DevSecOps approach. With DevOps, collaboration is implicit; with DevSecOps, collaboration is explicit.

Both ways of working foster alignment versus division, communication versus assumptions, problem solving versus blame, and continuous improvement.

DevSecOps explicitly integrates security into DevOps with the express purpose of solving the bottlenecks between developers and security teams. Security team collaboration, testing tools and processes such as threat modelling are available earlier in the development process, ideally as the developers are designing code. Regardless of the term used — DevOps or DevSecOps — the security group needs to be collaborated with and controls to enable security must be built in throughout the whole delivery value stream. In the end, it’s the focus on the customer and optimizing value, cost and risk in the time frames required that matters, not the label used. Pick the term that resonates the most with your organization and move ahead from there.