[Autogenerated] one of the most obvious benefits is that Dave said
cops can reduce time on rework for security.
Vulnerabilities in order to help you to quantify this for your organization.
We need to understand how it achieves this time reduction time can be
saved when security issues are found within the context of where these
security issues are being introduced.
What do I mean by that?
Well if you have a developer who has just committed or checked in code to the
code repository and that code has a vulnerability in it,
it will be far quicker for that developer to make an amendment and fix
the bug in the code shortly after they've committed it to the code
repository in comparison to if they have to come back weeks later and
remember the code they were working on.
So security issues found earlier in their life cycle reduced the cost of
remediation and rework all that memory and brain power required to recall
the code you were working on is no longer required.
What this means is that more vulnerabilities will be addressed
because it's easier for the developers to action them more
quickly reducing risk for Globomantics as an organization And as
customers is a real benefit,
if security issues are remediated close to their point of generation,
then there is a higher likelihood that the security issues
will be remediated in the first place,
we all know about customer requests and feature requests for
products that end up on a backlog and take weeks,
months or years to even get prioritized never mind implemented.
Security vulnerabilities are bugs and feature requests.
Also, it may take weeks, months or years for some vulnerabilities to get fixed.
The time it takes for vulnerabilities to get fixed is a risk
exposure both for the organization and its customers.
I said earlier in this course that DevOps hiccups is not
all about security tools or processes,
but it's very much about collaboration and this is very true.
It's one of the spin off benefits of implementing their
sick apps When DNSSEC apps is done well.
You don't have a security team that fixes every security issue.
Security becomes everyone's responsibility.
The engineers that write the code must fix the issues that
they have introduced the operations.
People must ensure that all systems are fully patched
before the deployment can take place.
All of this just forces security to become everyone's issue
and increases the level of collaboration.
Another major benefit of DEV setups is the introduction of more
consistency or standardization through the automation that dev.
Sec apps requires.
By introducing automation,
we're ensuring that consistently security scans are run
at the right time in the life cycle,
we could call this continuous security because
these are not discretionary steps.
The minute someone checks in code,
the security scans will kick off the minute an
application is built for deployment.
Further security scans will kick off all of this is hands off.
It's automated, meaning that you get consistency throughout the stages,
within the software development lifecycle,
all of this leads for better compliance levels and
this has never been more important, secure by design is a requirement by law.
In some jurisdictions, we have seen that the GDP our laws,
the general data protection regulation,
requires secure by design and privacy by design to be
implemented as part of development life cycles.
Other requirements from laws such as the California
Consumer Privacy Act are also stipulating requirements
within the development of software.
Better automated security testing helps compliance with various laws.