BP: Security Concerns and Best Practices for Automation of Software Deployment Processes: An Industrial Case Study

SecDevOps is a paradigm for integrating the software development and operation processes considering security and compliance requirements. Organizations are reluctant to transform their development and operation processes to SecDevOps because of the expectation of incompatibility between security and DevOps. This paper reports about a study performed at IBM on transformation of five Business Intelligence (BI) projects to SecDevOps. The study revealed that main security concerns for the automation of the deployment process are: separation of roles, enforcement of access controls, manual security tests, audit, security guidelines, management of security issues, and participation of the security team. The major recommended best practices for a transformation of current processes to SecDevOps are: good documentation and logging, strong collaboration and communication, automation of the processes, and enforcement of separation of roles. Based on the empirical results, we conclude that separation of roles is the main aspect to be considered when planning to automate deployment processes. The results of the study are being used by IBM BI Unit and may be used by other organizations when planning to migrate to SecDevOps, especially for BI projects.

I. Introduction

DevOps is a practice that aims at integrating software development and operation processes [1]. It is expected to reduce deployment cycles, improve the quality of software, and shorten the time to patch bugs. This helps to increase the frequency of deployments, which helps to service customers faster [2]. Organizations that practice DevOps can deploy software changes as fast as 500 times per day [3]. CA Technologies found that 1254 out of 1425 surveyed organizations (i.e., 88%) will adopt DevOps by 2020 [4].