Threat Assessment: Ignoble Scorpius, Distributors of BlackSuit Ransomware
Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012 and CVE-2024-9474 (Updated Nov. 19)
FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications
See all Unit 42 Threat Research
Table of Contents
Cloud Security

What Is DevOps?

5 min. read
Table of Contents

In a traditional software development model, developers write large amounts of code for new features, products, bug fixes and such, and then pass their work to the operations team for deployment, usually via an automated ticketing system. The operations team receives this request in its queue, tests the code and gets it ready for production – a process that can take days, weeks or months. Under this traditional model, if operations run into any problems during deployment, the team sends a ticket back to the developers to tell them what to fix. Eventually, after this back-and-forth is resolved, the workload gets pushed into production.

This model makes software delivery a lengthy and fragmented process. Developers often see operations as a roadblock, slowing down their project timelines, while Operations teams feel like the dumping grounds for development problems.

DevOps solves these problems by uniting development and operations teams throughout the entire software delivery process, enabling them to discover and remediate issues earlier, automate testing and deployment, and reduce time to market.

To better understand what DevOps is, let’s first understand what DevOps is not.

DevOps Is Not

  • A combination of the Dev and Ops teams: There are still two teams; they just operate in a communicative, collaborative way.
  • Its own separate team: There is no such thing as a “DevOps engineer.” Although some companies may appoint a DevOps team as a pilot when trying to transition to a DevOps culture, DevOps refers to a culture where developers, testers and operations personnel cooperate throughout the entire software delivery lifecycle.
  • A tool or set of tools: Although there are tools that work well with a DevOps model or help promote DevOps culture, DevOps is ultimately a strategy, not a tool.
  • Automation: While very important for a DevOps culture, automation alone does not define DevOps.

DevOps Defined

Instead of developers coding huge feature sets before blindly handing them over to Operations for deployment, in a DevOps model, developers frequently deliver small amounts of code for continuous testing. Instead of communicating issues and requests through a ticketing system, the development and operations teams meet regularly, share analytics and co-own projects end-to-end.

CI/CD Pipeline

DevOps is a cycle of continuous integration and continuous delivery (or continuous deployment), otherwise known as the CI/CD pipeline. The CI/CD pipeline integrates development and operations teams to improve productivity by automating infrastructure and workflows as well as continuously measuring application performance. It looks like this:

 

Figure 1: Stages and DevOps workflow of the CI/CD pipeline

  • Continuous integration requires developers to integrate code into a repository several times per day for automated testing. Each check-in is verified by an automated build, allowing teams to detect problems early.
  • Continuous delivery, not to be confused with continuous deployment, means that the CI pipeline is automated, but the code must go through manual technical checks before it is implemented in production.
  • Continuous deployment takes continuous delivery one step further. Instead of manual checks, the code passes automated testing and is automatically deployed, giving customers instant access to new features.

DevOps and Security

One problem in DevOps is that security often falls through the cracks. Developers move quickly, and their workflows are automated. Security is a separate team, and developers don’t want to slow down for security checks and requests. As a result, many developers deploy without going through the proper security channels and inevitably make harmful security mistakes.

 

To solve this, organizations are adopting DevSecOps. DevSecOps takes the concept behind DevOps – the idea that developers and IT teams should work together closely, instead of separately, throughout software delivery – and extends it to include security and integrate automated checks into the full CI/CD pipeline. This takes care of the problem with security seeming like an outside force and allows developers to maintain their speed without compromising data security.

 

DevOps FAQs

Infrastructure as Code (IaC) involves managing and provisioning IT infrastructure through machine-readable definition files. IaC platforms like Terraform and AWS CloudFormation enable the automation of infrastructure setup, allowing for consistent and repeatable deployments. By treating infrastructure as software, organizations can apply version control, testing, and continuous integration practices to infrastructure changes, enhancing agility and reliability.
Continuous integration (CI) is a development practice where developers frequently merge code changes into a central repository, triggering automated builds and tests. CI detects integration errors as quickly as possible, enhancing software quality and reducing the time to deliver new updates. It forms the foundation for the continuous delivery of applications to production environments.
Continuous delivery (CD) extends continuous integration by automatically deploying all code changes to a testing or production environment after the build stage. CD enables developers to ensure that their code is always in a deployable state, facilitating a more seamless and speedy delivery to end users. It bridges the gap between development and operations, fostering a more agile and responsive software lifecycle.
Continuous deployment is the automatic release of validated changes to production, without the need for manual intervention. It's a step beyond continuous delivery, where every change that passes all stages of the production pipeline is released to customers. This practice accelerates the feedback loop and improves the release process's efficiency and reliability.
Automation operates by executing predefined instructions to manage tasks without human intervention. In cloud security, automation tools deploy policies, scan for vulnerabilities, and respond to threats, streamlining security operations. They interact with cloud APIs, employing scripts and workflows to provision resources, enforce compliance, and orchestrate complex processes efficiently.
Configuration management refers to maintaining systems in a desired, consistent state. It tracks changes and configurations to software and hardware to prevent drift and unauthorized alterations. Tools like Ansible, Puppet, and Chef automate configuration changes across the IT environment, ensuring systems are configured correctly and uniformly.
Orchestration automates the management of complex tasks and workflows across multiple systems and services. It coordinates automated tasks into a cohesive process, managing interdependencies, and sequencing actions. In cloud environments, orchestration tools like Kubernetes manage containerized applications, handling deployment, scaling, and networking to optimize resource utilization and maintain application performance.
Microservices are a design approach where applications are composed of small, independent services that communicate over well-defined APIs. Each service is focused on a single business capability, runs its own process, and is deployable independently. This architecture enhances scalability, accelerates development cycles, and improves fault isolation.
Monitoring and logging are critical for maintaining operational performance and security in cloud environments. Monitoring provides real-time visibility into infrastructure, applications, and services, allowing for proactive management of system health and performance. Logging records events and data points, which are vital for troubleshooting, forensic analysis, and compliance auditing. Together, they enable rapid detection and response to incidents, ensuring continuous availability and security.
Version control systems track and manage changes to code, documents, or other collections of information. They facilitate collaboration among development teams, maintain a history of changes, and enable reverting to previous versions if needed. Version control is foundational in managing codebases, reducing conflicts, and ensuring that deployments are consistent and traceable.
Common deployment strategies include blue-green deployments, where two identical environments run in parallel, and one serves as the live environment while the other hosts the new version. Canary releases incrementally roll out changes to a small subset of users before wider deployment. Rolling updates gradually replace instances of the old version with the new one, reducing downtime and risk.
Containerization encapsulates an application and its dependencies into a container that can run on any computing environment. This approach provides a lightweight alternative to virtual machines, offering efficiency and consistency across development, testing, and production environments. Containerization simplifies deployment, scaling, and management of applications, isolating them from the underlying infrastructure.
Docker is used to create, deploy, and run applications by using containers. It enables developers to package an application with all its dependencies into a standardized unit. Docker provides the tooling and platform to manage the lifecycle of containers, including building images, container orchestration, scaling, and networking.
Kubernetes orchestrates containerized applications, managing their deployment, scaling, and operations. It ensures that the desired state of applications matches the actual state in the cloud environment. Kubernetes automates load balancing, monitors application health, and provides self-healing capabilities by restarting or replacing containers that fail or do not respond. It also handles service discovery and can manage configuration and sensitive information as secrets.
A build pipeline consists of a series of automated processes for compiling code, running tests, and deploying software. It starts with code retrieval from version control, followed by building executables, running automated tests, and deploying to various environments. The pipeline is designed to provide feedback at each stage, ensuring code quality and streamlining the path from development to production.
Testing automation accelerates the validation of software functionality, security, and performance. It enables repetitive and extensive testing without manual effort, enhancing consistency and coverage. Automated tests can run on multiple environments and devices simultaneously, providing quick feedback to developers and reducing the time to market for new releases.
A code repository is a storage location for code and its associated files, facilitating version control and collaboration. It acts as the central hub for storing, tracking, and managing changes to the codebase. Repositories support branching and merging, allowing developers to work on features, fixes, or experiments in isolated environments before integrating changes into the main code.
Release management encompasses the planning, scheduling, and controlling of software builds through different stages and environments. It includes managing the release pipeline, coordinating with stakeholders, ensuring compliance with release criteria, and deploying software to production. The process aims to deliver new features and fixes reliably and efficiently, with minimal disruption to services.
Agile methodology emphasizes iterative development, customer collaboration, and responsiveness to change. It advocates for small, incremental releases, continuous feedback, and adaptive planning. Agile principles promote cross-functional team collaboration, sustainable development pace, and reflective practices to continuously improve processes and products.
Serverless architecture allows developers to build and run applications without managing server infrastructure. It abstracts the servers, enabling developers to focus solely on writing code. Cloud providers manage the execution environment, dynamically managing the allocation of resources. Serverless architectures scale automatically with demand and users only pay for the compute time consumed.
Performance tuning involves optimizing system settings and code to improve performance metrics such as response time, throughput, and resource usage. It requires profiling and monitoring applications to identify bottlenecks, followed by adjusting configurations, optimizing code, and ensuring efficient resource allocation to enhance overall system efficiency.
Resilience and reliability are ensured through designing fault-tolerant systems that can handle and recover from failures without service disruption. Implementing redundancy, failover mechanisms, regular testing of disaster recovery procedures, and real-time monitoring contributes to robust system architecture. These practices help maintain consistent performance and availability despite system stresses or unexpected issues.

Related content

Get the latest news, invites to events, and threat alerts