The Importance of Segregation of Duties (SoD)
Today’s rapidly evolving tech environment has led to the rise of DevOps as an operational model. Short for “development and operations,” DevOps is a set of practices that combines software development and IT operations. The ultimate goal of the DevOps model is to accelerate the systems development lifecycle. It’s undeniably a popular model, with the global DevOps market set to grow at a CAGR of 22.9% over the next several years.
Existing DevOps processes don’t sufficiently monitor changes and ensure appropriate segregation of duties (SoD) between developers and operational staff. Segregation of duties – designing a workflow so that more than one person is required to complete or sign off on a task – relies on workflow roadblocks to increase security.
In software development, SoD takes a particular shape. Ensuring that individual workers or organizations don’t perform multiple tasks in the software development life cycle – like design and development or inspection and approval – is crucial to reducing risk. In addition, proper SoD practices monitor and control software & data changes.
How Does SoD Reduce Risk?
Why is that so valuable? For one thing, promoting lousy code can lead to security vulnerabilities and potential data loss. According to the DHS, roughly 90% of cybercrimes result from vulnerabilities discovered in a software’s code or design. Working to fix these problems in a later stage of development can be difficult and costly, which is why an approach that bakes in security from the start is so valuable.
Understandably, SoD methodology can put it at odds with DevOps, which relies on integration. That’s why most experts agree it’s critical to find a balance between security and availability, even in the federal sector, where the emphasis tends to lean more towards security rather than speed. This emphasis is understandable; federal contractors and subcontractors often deal with highly-sensitive data, so making sure it’s secure is critical.
Complying with strict federal regulations and documenting compliance proves to be challenging for federal agencies. Implementing a full DevSecOps lifecycle that integrates SoD helps provide the necessary evidence of change management, testing, and approval while optimizing performance. But how does it do this?
Modern identity solutions understand that machine identities (such as bots, IoT devices, and workloads), much like human identities, need to be secured. Therefore, finding a way to extend the access control process to them is critical. Enterprise identity solutions function by creating secure digital identities for users and applications, allowing the access process to be safely automated. In addition, some solutions offer out-of-box SoD rulesets mapped to applications and compliance regulations to make things even simpler.