How cultural shifts make DevSecOps work

As any business grows and scales, the way it produces a product changes, even if the product itself remains the same. For example, a start-up company that makes toys might start by hand-making toy molds and hand-pouring the resin for them; as the company expands, however, it can realize economies of scale by automating aspects of the mixing and pouring process, investing in larger equipment, or potentially even switching to a new material that is easier to mechanize. Scaling up production of a less tangible product such as software is no different: at scale, developers need the proper tools to quickly deliver quality products. With those tools, though, come new processes: just as someone hired to hand-pour resin cannot be expected to know how to operate an automatic mixing machine overnight, engineering teams need to understand how new DevSecOps tools change the way they perform their jobs.

Before teams can begin using new tools, organizations must start with the training needed to understand how to use them. Communicate to the entire team that your enterprise will be shifting to a DevSecOps approach and be clear about both the changes that will be expected of team members and the ways in which these changes will enable them to do their jobs more easily, efficiently, and effectively. Some of the initial challenges stem from technical understanding: employing an industry standard branching strategy (e.g., GitFlow), for example, is a complex task, and some team members may face a considerable learning curve. Other challenges come from changes to the process: a fully manual engineering team may have waited for an in-person request to move to another stage of development, but high maturity DevSecOps teams rely on automated and integrated tools to signal when work is ready. Stakeholders also need to understand how DevSecOps changes the process: they may be familiar with development, deployment, and testing as three distinct phases, for example, but in DevSecOps, these activities occur in parallel.

As discussed above, DevSecOps involves integrating toolsets to seamlessly orchestrate communications and tasking across teams in an automated and transparent fashion. Over the course of training, it is crucial for teams to understand how each tool fits into the broader DevSecOps ecosystem — and when organizations integrate those tools to the greatest extent possible, that process is much easier. It can be overwhelming for team members to be introduced to a slew of new tools, all seemingly doing entirely separate tasks. By integrating those tools, organizations are able not only to simplify the technical aspects of development, but also to enable holistic training of the end-to-end DevSecOps process.

Conclusion

Facilitating these cultural changes does more than simply make your engineering team more comfortable with your DevSecOps implementation — it maximizes the value of that implementation, delivering measurable ROI. By promoting functional understanding, rapid collaboration, and team empowerment, organizations nurture a collaborative and more productive work dynamic, as team efforts become more transparent and less siloed. Rather than separate siloed teams of developers, testers, and administrators passing work between each other, a mature DevSecOps culture fosters a unified and collaborative team.