How Coder can improve your DevSecOps initiative

John Andrew Entwistle

 on March 7th, 2020

Throughout the years DevOps best practices have driven IT innovation for large organizations’, shortening the development life cycle. But every year, organizations face IP theft, breaches, and inside threats. It’s these challenges that lead to a focus on security within the DevOps pipeline.

In this article we discuss how Coder can serve as the first foundational step in an organization’s DevSecOps process by providing developers with productive, consistent, and secure development environments.

Some Background: What is DevSecOps?

DevSecOps serves as an extension to DevOps by addressing security risks and vulnerabilities throughout the software development life cycle. As organizations adopt DevSecOps within their software development teams, it is essential to empower their data scientists and software engineers with the right tools to maintain consistent, secure, and performant development environments.

DevSecOps Best Practices & Some Failures

Volumes have been written about best practices for DevSecOps. There is no need to cover them all here. Instead, take a look at these three that would certainly make any comprehensive list of best practices for DevSecOps:

• source control all infrastructure templates
• automatically scan container images and source code for vulnerabilities
• scale services elastically in real-time

All three present good, sound advice, and all three are routinely ignored when it comes to traditional local development environments. Traditionally, developers have installed and configured development environments on their personal machines. When this occurs, as it does in most organizations, best practices are not applied.

Running the development environment on the user’s isolated endpoint limits the available resources for tasks and adds more security overhead by having to protect the intellectual property on each user’s isolated endpoint.

Furthermore, the development environment isn’t being source controlled like the infrastructure is in DevSecOps. This makes it difficult and time-consuming for new engineers or engineers switching projects to get their machine in the correct state to work on an application or data set. The engineer has to install the correct version of the project’s programming language, frameworks, and tooling just to start contributing. This installation and setup process is error-prone, very difficult in zero-trust environments, and creates onboarding overhead for development teams.

Bringing the Development Environment into DevSecOps

*With Coder, the development environment fits into the DevSecOps pipeline alongside the rest of the development workflow. *

All development actions and source code are centralized on an organization’s internal infrastructure. This allows engineers to use elastic compute resources to complete tasks, while also reducing the security overhead of the organization by keeping all intellectual property inside the centralized infrastructure. Coder works seamlessly within the most restrictive air-gapped environments, providing productivity in a zero-trust environment for software engineers and data scientists.

Each development environment is created from an image that is defined by the team. These images contain all of the required software dependencies to get started working on a project immediately, thus removing any installation and setup onboarding overhead. These image definitions can also be source controlled, providing an organization with “development environments as code”, similar to how “infrastructure as code” is currently used in a DevSecOps pipeline. This functionality allows for productivity and security to be in harmony, bringing the development velocity of a startup to the enterprise.

Conclusion

Providing developers with productive, consistent, and secure development environments is must for any successful DevSecOps. The best way to do that is move developer environments off of local machines and into the cloud where they can be orchestrated, managed, and best practices applied.

Coder makes reproducing and managing consistent development environments in the cloud simple, allowing you to define dev environments as code and spin up new environments quickly and securely.

Learn more about how Coder fits into your DevSecOps workflow or download our DevSecOps playbook for a broader overview of supporting remote development with cloud-based developer environments.