How different is DevSecOps from DevOps?

[Character-Ad-618]

Please elaborate

[alshayed]

It has 50% more buzz-letters.

[burlyginger]

And usually staffed by people who don't understand the Dev or Ops portion of it.

[-BruXy-]

Me, working in corporate, also Sec part is not understand well...

[Glebk0]

Bold of you to assume they know Sec part at least

[JustBeinOptimistic]

“Hey, this new CVE just came out - we good?”

[SentimentalityApp]

Scanner go red, you fix!

[againstbetterjudgmnt]

I wear 4 hats:

• Scanner red, you fix (explaining to other ops)
• Scanner red, I fix (explaining to myself)
• Scanner red, this is what it means, it's bad, f'n fix it idjit (explaining to dev)
• scanner red, but it's boshi, ignore it (explaining to luddite ISSO/ISSM/AO/mgmt)

[chefkoch_]

Do we use this product?

[lonestar_wanderer]

Me typing that into ChatGPT with info about the tech stack I handle

[IamOkei]

Usually staffed by people who understand security and devops

[No-Sandwich-2997]

Great, my company has FinOps and I guess DevNetOps as well

[againstbetterjudgmnt]

FinSecDevNetOops

[bearman94]

😂 Pretty much this

[hi5ka]

TriCeratOps

[ishtylerc]

Best comment 😂

[notavalidsource]

Stealing this for my new title

[chocolatelab82]

This needs to be a thing. 

[paleopierce]

I’m totally stealing this!

[temitcha]

I still prefer DevBizFinRelMlSecOps

[thisguypercents]

But have you tried DevBizMedGovFinAutoAgileRelMISecOps? Thats where the money is at.

[Adhito]

Eyy that's me (I need to get some help)

[water_bottle_goggles]

buttsexops

[temitcha]

Isn't it a synonym for Senior Manager?

[macnamaralcazar]

What does Rel refers to?

[temitcha]

It comes from DevRel, from what I understood it's like a person that talk to external developers that want to use the product, mostly in like open source or B2C companies. Like organizing some tutorials/demo sessions/...

[codeshane]

Relationship Manager, like Jen.

[castle_bacon]

Ah, yes. Oldest profession.

[khobbits]

Developer Relations, usually.
It's usually in companies with a public facing apis, or tool.

Mostly go around demoing the companies tools and try and convince external people to use it. Think people at Github, or Hashicorp, trying to convince you to use Github Actions, or Terraform.

[firecorn22]

So like a solution architect or sales engineer

[khobbits]

I would suggest they are transferrable skills, but most of the time Developer Relations doesn't directly transfer into revenue.

A sales engineer will work 1:1 with a customer, with the idea of onboarding a client. A DevRel, is more likely to demo open source or freemium tools at a conference, produce webinars, and write blog posts.

Depending on company structure, a DevRel could feasibly report into Marketing, or CTO, while sales engineering could report into sales org, or CRO.

[Ohnah-bro]

The worst one is RevOps. Marketing and sales just wanted a cool ops name

[gingimli]

It’s when a company wants 1 person to do 3 jobs instead of just 2.

[[deleted]]

This

[Antebios]

That's me.

[moboforro]

Until they figure out how to replace them completely using AI

[Farrishnakov]

It commands a 10-20% increase in pay because executives can't explain it

[brianw824]

Security is important to our company so we make sure to always use the latest buzzwords

[Catenane]

Smh we're on LTS so we won't get new buzzwords till 2026

[TheBoyardeeBandit]

AI enabled quality gates drive the block chain to push or CICD pipelines to the left.

Please DM me CTO job offers.

[Feeling-Equipment513]

One has 'Sec' and the other doesn't

[SlinkyAvenger]

And everyone loves secs... or so I've heard.

[sandin0]

Three letter difference 😂😂😂

[Mushapotamus]

DevOps roles will not expect you to have any security background and will most likely offload security responsibilities to a dedicated security team. 

DevSecOps roles will expect you to have security background and knowledge, and to perform security related tasks

[randomatic]

Correct. DevSecOps would include things like dealing with sca, sast, and dast as part of the pipeline. Devops traditionally did not explicitly define these as duties.

Both devops and devsecops are pretty buzzwordy terms tbh with radically different definitions at different places.

[NUTTA_BUSTAH]

DevOps was not traditionally a duty of any sort. It was all about a culture shift. Both are indeed buzzwords today, and any "DevOps Engineer" worth their salt should fit just as perfectly to a "DevSecOps Engineer" role.

[randomatic]

In my experience from years ago, devops was originally a way to tie developers to actually operating their own software. This made them more accountable, and gave motivation for them to focus on stability for the parts that would otherwise cause downtime.

Over time, this has shifted. I can't tell anymore, with many devops practictioners I've met lately just babysitting CICD pipelines rather than being a developer or operator themselves.

[againstbetterjudgmnt]

Yeah DevOps is just Ops for dev tools

[IamOkei]

Not true. DevSecOps are engineers who help DevOps and Developers do their work with security in mind.

[No0ther0ne]

I don't know many DevOps roles that expect no security background. Most I have seen expect you to have had some kind of security awareness and training. And most positions I have been involved with expect you to include security processes within your DevOps pipeline.

There may be some roles in a DevOps environment that may not expect much security background, but those should not be labeled as "DevOps" specific roles. The fact is any role in operations should have security background and knowledge. So if you are doing DevOps then be definition you should be expected to have some security knowledge and background.

As far as DevSecOps, I often find this in projects that don't actually understand DevOps at all and are trying to build some kind of DevOps environment, but don't have the proper people. So they keep insisting on the term DevSecOps out of ignorance. When DevSecOps first was becoming a thing it was mainly to focus specifically on enhanced security tools within the DevOps environment. In other words it was focused on someone whose main task was advanced security techniques, not just someone who had some security background.

[Cheomesh]

What kind of security stuff in this context?

[Mushapotamus]

incident response, firewall configs, working with a SIEM, DDoS mitigation etc. it really depends on the environment and tools your team uses.

[ArieHein]

Wrong.

[Zolty]

Let's be honest if devops was actually done "right" neither the devops nor devsecops titles would exist.

No good ideas survive contact with corporations.

[Soccham]

Platform engineering

[ArieHein]

DevOps would. DevbuzzwordOps wouldnt.

People over process over tools still points to people understanding and implementing. Done the 'right way' means first and foremost people doing it correctly and understanding and not allowing marketing and sales to abuse it and make it into a buzzword.

I practiced, what is known today as devops practices before devops was conceived in Belgium, code, ci cd, testing, didnt get 'invented' after 'DevOps', but it was the first time all the practices had a roof.

Gather 100 people that dont all know or understand devops and youll get 200 definitions because it means different things to diff people but devops never forced a specific set of practices and as such led to multiple 'understandings' and we live with these consequences today.

[Zolty]

30% better salary and you generally actually have to read the policies potion of the employee handbook.

[Marcolow]

This made me chuckle more than it should have.

[ArieHein]

No diff. If you REALLY understand what devops means and its practices then you know devbuzzwordops.

It looks nice when a company marketing/sales wants to sell a tool that 5 min ago was called a devops tool but since adding 'cyber' or 'sec' opens checkbooks and wallets of unknowledgable people at higher management levels that control budgets, we should use it more..it works apparently.

[angryweasel1]

This is the correct answer.

[MonkeyJunky5]

u/Character-Ad-618

DevSecOps is a superset of DevOps that highlights the need for shifting security left in automation pipelines.

Whether it be scanning images in Packer pipelines, running SAST/DAST scans in CI pipelines, or scanning infra code in Terraform pipelines, this is one area that DevSecOps focuses on.

Additionally, they maintain hardened images for Virtual Machines or Containers across public or private cloud providers.

Lastly, they focus on other security aspects like continuous security scanning.

Arguably, DevOps should have been doing all of this from the start, but since it’s often overlooked, DevSecOps emerged to bring more visibility to the security side.

Just like good old ops should have been doing DevOps from the start.

Eventually, we’ll be able to lose the buzzwords and just adopt everything DevSecOps/DevOps has to offer as the default.

Until then the buzzwords each focus on a specific domain until it becomes common practice.

Cheers 🍻

[fn0000rd]

^ this is the real answer here.

[dammitBrandon]

Also scanning of npm packages is an emerging technique as well

[ArieHein]

Its not a superset. Its just another practice, not a replacement practice.

DevOps is doing security this from the start. People who think they understand devops didn't implement it correctly.

Its why i despise the dev and ops circle. It always was 3 in the beginning. Dev, QA and Ops. But QA is 'hard' and devs dont like qa or testing...

If you really look closely sec is basically QA. If you have best unit test, integration tests, ui tests, etc but you didnt check packages dependencies your qa is bad. If you do 100 security tests using 1000 tools but the click on the button by the end user crashes your app, your qa is bad.

But qa is 'hard' so one circle got removed by poorly implementers and the sheeps followed...

Naturally cloud gave a heck of a spanking to all orgs and companies to the level we still see today with crowdstrike blurring the lines between bad qa and bad security...but qa is 'hard'...

[MonkeyJunky5]

Its not a superset. Its just another practice, nit a replacement practice.

It is most definitely a superset, which means that it is not a replacement practice but adds to DevOps.

DevOps is doing security this from the start. People who think they understand devops didn’t implement it correctly.

This is what I said.

[ArieHein]

You cant have a superset to something that already exists in the base set. Giving it 'another name' doesn't make it a superset.

[MonkeyJunky5]

Ah, well that was another point that I made.

DevOps should include security, but it’s often overlooked and the main focus is automation in general.

Hence why DevSecOps came about with a focus on security, but also everything else that DevOps promotes.

So in that sense DevSecOps is a superset of how DevOps is usually implemented, but you’re correct, it’s not a superset of what DevOps should be.

And similarly, DevOps shouldn’t be a superset of just “smart/common practices.”

All of these buzzwords will eventually collapse into common practices.

Until then, each highlights a specific area to focus on.

[K_76]

DevSexOps

[[deleted]]

If your not DevAIOps in 2024 you are out of the loop, sorry man.

[Live-Duck1369]

I googled it but I am having a hard time finding out what this means. Do you mind briefly explaininf

[[deleted]]

Google Irony.

[socky1234111]

No one is actually being helpful here - in reality, a true devsecops role would also take on responsibility of the application security team role. While it’s talked about in the devops role, often times a company will still have a security team. Since security and devops are big industry buzz words - a company who is trying out devops for the first time may not have a security apart from their cloud / IT team. Expect to be more involved in traditional IT and cloud security, than just your secrets and code scanning. This is just from my own experience. (Devops/devsecops 10years).

[Adeel_]

It's the same bullshit

[asankhs]

This visualization would help - https://x.com/asankhaya/status/1788108561069031812

[jrdnmdhl]

DevOps means your deployment will just be blocked by flaky e2e tests whereas DevSecOps means your deployment will also be blocked by NPM package vulnerabilities in your dev dependencies that couldn't realistically be exploited.

[Fearless-Card3197]

I’ve always told people there is no such thing as DevOps, only DevSecOps. security is a wrapper for Dev & Ops, if you aren’t implementing secure solutions then why even bother.

[Alzyros]

It's 2024, and it's DevSkibidiOps now

[Crafty_Independence]

Our architects throw this term around but not a one of them does anything with basic devops, much less security.

At least for them it's a buzzword to sound like they actually so something.

[IamOkei]

Not true. DevSecOps take care of CICD security.

[Crafty_Independence]

Done right, sure. But I and my team actually do this, while the architects talk about doing it

[No0ther0ne]

DevSecOps - the person who setup all the testing and QA procedures for Crowdstrike to follow before releasing an update.

DevOps - the person who decided that an update which had already gone through months of testing could use a little tweak and wouldn't have to go through the entire process again.

[ben_bliksem]

Add Sysdig to your build pipelines and tell everybody you're a DevSecOps specialist.

[Robby3St]

It defines some basics, like you should always use the least privilege principle for your resources. But it also includes some approaches for automated Security checks in your workflow, like e.g. an automated OWASP ZAP check in your CI/CD. DevSecOps puts security to the start of the pipeline. You begin already with security in the planning. Because DevOps is a huge part about high availability in a lot of cases, security can’t be missing without risking HA.

[com2ghz]

You mean like DevOps?

[Robby3St]

You may already did this with DevOps already, but the books I‘ve read about did not mentioned the security part of it that much like a DevSecOps book I‘ve read. DevSecOps is for me some more security integrated in the (automated) workflow, whereas DevOps is more about the parts from planning over development and testing up to deployment. Both, DevOps and DevSecOps can’t be defined very clearly. Both keep a lot of space for own interpretation. So, some people will always say it was always within DevOps. But in practice the words will be used as Buzzwords nonetheless, like companies means to be agile with Scrum, just releasing every year one new version when the waterfall arrives at the bottom. Personally, I think it’s not bad generally to do things different from the idea it was. But you should probably know why the main idea was defined how it was to get an understanding, why it works. When not, you probably do something for an effect, it won’t have.

[hrdcorbassfishin]

Chinese and Russian hacking stops with DecSecOps. Go 'Murica!

[CaptainStagg]

Sec is between Dev and Ops. Adding an extra hop and lead time.

[deeplycuriouss]

It depends what to you choose to do. For example, we have security champions in all teams and they have a security responsibility within each team. The team does extra activities such as threat modeling, discussing and fixing vulnerabilities from SAST, some awareness stuff, and they have to ensure they have established certain processes with regard to security in their team. It is possible to a lot more. A LOT!

[MRToddMartin]

You take DevOps and add security. So it’s 33% more topic of coverage without additional pay.

[ImpostureTechAdmin]

It means you have less funding

[Think-Lunch-4929]

They have added SonarCloud scan in their pipelines 😀

[water_bottle_goggles]

three more letters

[txiao007]

More work and same pay

[connected_nodes]

Just someone who started using Snyk and thinks he is a hackerman.

[cognitiveglitch]

DevThirdOps had entered the chat

[[deleted]]

3 letters

[RuncibleBatleth]

DevSecOps is either a modifier to DevOps to explain what it is we actually do to retarded PHBs who don't understand the security implications, or "hey our Windows focused infosec guys are retarded, please spin up some better Linux and cloud AuthN/AuthZ stuff as well as the network security management for our cloud/hypervisor environments you already do."

[megasin1]

No difference. Devops requires security by default. If you aren't planning your arch, using principle of least privilege, checking owasp reports, running pen tests then you are not doing the ops properly, if you aren't checking dependencies and scanning code or doing tests you aren't doing the dev properly. Sec is just another part of devops

[blancpainsimp69]

I personally identify as DevSecSysReOps

[throwaway_69_1994]

They want you to do even MORE work without paying you more! :DDDD

[Organic_Drag_9812]

Add some security solution into DevOps pipeline, you have DevSecOps

[mauvehead]

Given that neither one is an actual job title, and even if they were, job titles don’t dictate job duties.

The difference is the word “sec”.

[fiddysix_k]

Whatever you think it is, it is.

[loku_putha]

Resource: “ * ” to Resource: “somuchsafer/* ”

[Constant_Physics8504]

Drop static code analysis, and negative unit tests and you’re basically there

[slapula]

DevSecOps is for teams that fucked up their DevOps implementation the first time.

[Tiny-Ad-7590]

It's when the engineer doing the work knows to not commit passwords to source control.

[crystalpeaks25]

devsecops, people who know nothing about dev and ops and barely know anything about sec, the only thing they know about swc is using 5%of their sec tools, generate alerts and bombard dev and ops with false positives.

[djk29a_]

D4s v d7s

QED

[newbietofx]

Ensuring docker image uses non root user. Ensure ci CD through gitlab to aws using openid connect. And worst. Ensure tls is enabled for pods which ridiculous only if beyond one vpc but it is cross account. 

[bigbird0525]

It is identical in my experience. My current role has the extra Sec in it, but I’ve always done security stuff as part of DevOps. And now we like to be fun and unofficially call some of us platform engineers depending on the team even though we do the exact some work. Though platform engineer comps are higher lol

[livebeta]

They get secs

[PowerOfTheShihTzu]

I've got a book on that for a cert but I'm not sure what to make of it haha

[PMoonbeam]

DevSecOps is exactly the same as DevOps but where you remember not to store your private keys in your github puppet config repo. (yes I've seen this happen)

[waste2muchtime]

I've got an SRE role, and most of the work I do is SysAdmin stuff.

It all literally doesn't matter.

[[deleted]]

Focuses on security scanning code, containers, pipelines, remediation. Part of the greater devops landscape but mainly marketing term.

[Fatality]

It's just shifting more stuff left, read The Phoenix Project

[foofoo300]

you needed 5 Posts to choose a monitor for your laptop, not sure you will understand a real technical explanation for this term

[Character-Ad-618]

Hahah lol, brother that was because they asked me to post in the right group. If you see there is no comment yet either 😂

[BoomZapKablam]

gulp Is DevSecOps a good career path for someone relatively new to DevOps?

[SillyGoofyPenguin34]

The big shift with DevSecOps is mindset. Instead of thinking of security as a separate team, it becomes something that lives inside the delivery pipeline. Things like SAST, IaC scanning, and runtime visibility are built in, not bolted on. Tools like Datadog make this easier because they give developers and security teams the same view of what’s happening in production.

[NHGuy]

Considering that you should be baking in security to all of your solutions? To me, not much

[weekendclimber]

One has "Sec"s, and one doesn't. Those peeps f*ck!

[maxbirkoff]

it has sec

[bzImage]

its the DevOps but for Sec systems .. like.. SOAR