Everything done within an organization should provide value to customers and other stakeholders. Value Stream Management (VSM) is a business practice that helps identify areas for improvement in a process to make operations more efficient and drive business value. In VSM, you need to know the value of the output and the value that each step in the process flow adds during the creation of the asset. A core tenant of lean management is that teams optimize value streams for what and how they do things. This commonsense approach is why VSM is valuable, especially in our modern digital economy. It has been adopted by more and more organizations since it was born out of Toyota’s manufacturing and business practices way back in the 1930s.
Of course, you may be thinking, “that makes sense, but what does this have to do with DevSecOps?”
Agile, Scrum, SAFe, and most other post-waterfall development methodologies involve developing software delivery flow and removing obstacles to deliver value faster and to increase productivity. DevOps focuses on figuring out how to integrate this into an organization's culture and tooling so that the organization can achieve those streamlined flows. DevSecOps is the latest iteration, and it highlights security as a core value-add within DevOps practices. All the tooling involved in DevSecOps has one thing in common, it proves some level of automation that removes manual bottlenecks in the application build and deployment lifecycle.
On any journey that involves utilizing DevOps as a part of software development, you need to use a lot of existing technology and processes. While a true fresh start can happen, that approach rarely works in the long term because services become so complex that migrating and rearchitecting them is a better use of time and money than rewriting from scratch. To start down this path, you need to learn the existing processes and technologies used by both software development teams and security teams to identify where to integrate principles like shift-left to a software development lifecycle (SDLC) to show off the value and efficiencies DevSecOps best practices can provide, like faster remediation of vulnerabilities.
As you learn existing processes and all the steps for taking a requirement from inception to production, it’s important to document the current state and why you performed each step. Even when you’re working with methodologies that appear “anti-documentation” (like Agile), that’s not the case; rather, they focus on value and eliminating overhead. As you build out a new pipeline to support existing applications, you want to make sure that every step has value. You want to make sure that you don’t lose the existing value that you are providing, so it’s important to document things “as-is” as well. You don’t need to write a master’s thesis that documents every little detail or who decided what, but you do need to capture the major steps.
Some of the information to capture includes:
Now that you know the existing state, it’s time to introduce tooling and processes built with DevSecOps practices that will automate the process from code to delivery as part of your VSM.
Some easy wins that will show value to stakeholders include the following:
Combining Value Stream Management with the implementation and expansion of DevSecOps practices is becoming the best-of-breed approach to optimize every stage of development and security end-to-end. By having everything in a single pipeline with optimized value streams and checks and controls for vulnerabilities and misconfigurations, you eliminate time-consuming manual reviews at later stages of the development process flow. These manual steps add costs and become bottlenecks that cause unpredictable delays as projects make their way to becoming products. Documenting every step of the process and the value that it adds to the final service increases transparency, security, and the trust that stakeholders and customers will have in the final product. Ultimately, this process improves business metrics and customer value.
Learn what works for other cloud native security experts:
The State of Cloud Native Security Report 2022
By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement. Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder.