5 key organizational models for DevOps teams GitLab

Devs today are creating, monitoring, and maintaining infrastructures, roles that were traditionally the province of ops pros. Ops are spending more time managing cloud services, while security team members are working on cross-functional teams with dev and ops more than ever before. Without a clear understanding of DevOps and how to properly implement it, a DevOps transformation is usually constrained to reorganizations or the latest tools. Properly embracing DevOps entails a cultural change where teams have new structures, new management principles, and adopt certain technology tools.

All of the components described below are going to imply the necessity for some foundational elements; for example, infrastructure-as-code, source control, automation, clear communication pipelines, and many others. Individual platforms may implement these differently, but we will see those common elements emerge as designed. The decisions that would drive successful release should be codified devops team structure in code. If it is not feasible to capture in code, checklists with clear yes/no decision points are preferred to heavily documented standard operating procedures (SOPs). Joseph is a global best practice trainer and consultant with over 14 years corporate experience. His specialties are IT Service Management, Business Process Reengineering, Cyber Resilience and Project Management.

Create one team, maybe “no ops”?

Most organizations understand the need to transform their organizational structure and ways of working to succeed under an agile organizational model. However, many focus on one or two of these dimensions but fail to fully plan for the transformational journey and don’t provide the right support to their teams and staff during the transition. Winning organizations are applying these three dimensions to their organizational structure so they can respond more quickly and efficiently to market dynamics. Being on a team requires a willingness to make personal and workgroup goals subservient to the larger mission.

Access an exclusive Gartner analyst report and learn how AI for IT improves business outcomes, leads to increased revenue, and lowers both cost and risk for organizations. This becomes more efficient and cost-effective since integrated security cuts out duplicative reviews and unnecessary rebuilds, resulting in more secure code. This domain encompasses the holistic nature of DevSecOps around the platform itself, capturing the flow of work into the environment and release of software out of it. When a DevSecOps platform meets a certain level of maturity, it qualifies for a streamlined delivery and ATO process. You may decide your organization just doesn’t have the internal expertise or resources to create your own DevOps initiative, so you should hire an outside firm or consultancy to get started. This DevOps-as-a-service (DaaS) model is especially helpful for small companies with limited in-house IT skills.

Implement security orchestration and automation

This can include a release manager who coordinates and manages applications from development through production, to automation architects who maintain and automate a team’s CI/CD pipeline. The problem is that the original concept of DevOps did not include security at all. The DevOps pipelines always contained tests for whether the application behaves according to the expectations.

Teams can build the DevOps toolchain they want, thanks to integrations with leading vendors and marketplace apps. Because we believe teams should work the way they want, rather than the way vendors want. The excellent work from the people at Team Topologies provides a starting point for how Atlassian views the different DevOps team approaches. Keep in mind, the team structures below take different forms depending on the size and maturity of a company.

DevSecOps

Software composition analysis can be applied holistically to confirm that any open-source dependencies have compatible licenses and are free of vulnerabilities. A behavioral by-product of this is that developers feel a sense of ownership over the security of their applications, getting immediate feedback on the relative security of the code they’ve written. Cloud means use of newer technologies that introduce different risks, change faster, are more publicly accessible — eliminating or redefining the concept of a secure perimeter. It also means many of the IT and infrastructure risks are moved to the cloud, and others are becoming purely software defined, reducing many risks while highlighting the importance of permission and access management. Defining security compliance policies as code — and using automated tools to help enforce them — helps ensure that software and infrastructure adhere to security and compliance standards and regulations.

• In this model, development teams provide logs and other artifacts to the SRE team to prove their software meets a sufficient standard for support from the SRE team.
• In this example, the job can fail only if a merge request event triggers the pipeline and the target branch is not protected.
• DevSecOps doesn’t just provide enhanced application security — it front-loads considerations like  security risks and vulnerabilities much earlier in the development cycle, helping to avoid surprises later.
• In this team structure, there are still separate dev and ops teams, but there is now a “DevOps” team that sits between, as a facilitator of sorts.
• A mature implementation of DevSecOps will have a solid automation, configuration management, orchestration, containers, immutable infrastructure, and even serverless compute environments.
• Traditionally, security is one of the last things that gets considered during the development cycle.

The complexity of a GitLab pipeline is often determined by specific use cases. Another use case might involve building applications that target different platforms with varying dependencies, which is where our DAG pipelines shine. DevSecOps brings several advantages to the software development process, particularly when it comes to web security. DevSecOps hardens the processes within, and the products of, the development cycle. Utilizing a DevSecOps CI/CD pipeline helps integrate security objectives at each phase, without adding burdensome bureaucracy and gatekeeping, allowing the rapid delivery of business value to be maintained.

What is DevSecOps?

Usually, an organization which uses IaC will also use immutable infrastructure.Server settings, port closures, protocol closures, NACLs, security group settings, and other configurations can all be automated. This not only increases security, it is also required for some forms of compliance. As a result, a wide variety of tools have become available for various types of IaC hardening. You can also develop a threat model and establish security policies early during the SDLC process. Automated remediation tools may be adopted to address frequent vulnerabilities that are introduced as Devs and QA teams follow rapid release cycles and fast sprints at the pace of DevOps. Gone are the days of waiting until the end of a development lifecycle to execute security testing and implement security best practices.

The difference between DevOps and DevSecOps is, to put it simply, the culture of shared responsibility. DevOps is a concept that has been talked about and written about for over a decade, and many definitions of DevOps have emerged. At its core, DevOps is an organizational paradigm that aligns development and operations practices as a shared responsibility.

Automation compatible with modern development

This team structure is dependent on applications that run in a public cloud, since the IaaS team creates scalable, virtual services that the development team uses. Traditionally, security is one of the last things that gets considered during the development cycle. Engineers tended to create apps first, and then test them for vulnerabilities as an afterthought. DevSecOps mandates that good security practices should be enforced all through development, and not only in production. It is the management of infrastructure components (subnets, networks, servers, databases, services, etc.) through code. This has many advantages, including the ability to fortify the infrastructure automatically.

Modern DevOps teams employ value stream mapping to visualize their activities and gain necessary insights in order to optimize the flow of product increments and value creation. When we’re in trouble, we don’t get many chances so we need to maximize our likelihood of success! Consequently, we should identify a value stream that supports our long-term objectives, carefully select who is involved in the transformation, and elevate existing constraints that limit our ability to scale. We’ll also set the stage with a bit of DevSecOps overview and then point you on your way with some best practices for implementing DevSecOps.

Take GitLab for a spin

Using CI/CD rules, security and quality assurance teams can dynamically run additional checks based on specific triggers. For example, malware scans can be added when unapproved file extensions are detected, or more advanced performance tests are automatically added when substantial changes are made to the codebase. With GitLab’s built-in security, including security in your pipelines can be done with just a few lines of code.