Applying DevOps principles to security and compliance

Concerns about security and compliance can be a reason for companies to be reluctant to accept a full DevOps mindset as it would hinder their ability to make releases very often. In the past, they used to have fewer releases that were all handed off for security or penetration testing before being deployed to production. This gave them the confidence that they were not shipping software that contained security vulnerabilities.

This practice of fewer releases and having a big final security test before the final release conflicts with a DevOps mindset, and this is where some companies struggle. They are looking for ways to ensure that they are delivering business value to their users with every release, but are not willing to compromise on security to do so. The question is whether this is a fair trade-off. Wouldn’t it be possible to have both speed and security? Might it not actually be the case that releasing faster and...