Lately, I’ve seen more breaches happening from internal errors than from big hacks or network breaches — and unless we step back and figure out how to effectively embed security and compliance and scale them automatically, this trend will continue.
There are compound factors at play — infrastructure and DevOps teams are stretched thin from a skills shortage. Business priorities demand speed and agility, but with competing priorities and fragmented teams, gaps and redundancies are created, resulting in complexity that makes it nearly impossible to scale.
Furthermore, adopting new technologies without the expertise to manage them inevitably leads to human errors – many of which are often not uncovered until something bad happens.
Finding a balance between speed and risk
I doubt few want to return to a central services type of oversight — in fact, that model would not support the speed and agility companies need to react and move forward. But the concept of having standards is a discussion that needs to happen in every company. Without it, the risk compounds every single day.
DevOps teams and engineers have more freedom to create and choose their own tools than ever before, and that’s a good thing. They need the flexibility to innovate. But security and compliance are also necessary as they safeguard not only the company’s IP, but also customers and ultimately, revenue.
However, the hard truth is that developers don’t want to think about security and compliance. They don’t want anything that will slow down the process of getting applications out the door. So how does a business ensure that infrastructure is secure and compliant? Automation can give developers the freedom from having to worry about security and compliance, and enable them to work even faster. That’s a win-win for the company.
How automation solves for security and compliance
There are two ways companies can use automation to scale security and compliance. The first is to use vendors that will automate processes for you and then ensure your teams use those approved vendors for their work.
In larger organizations, creating a platform team is the solution de rigueur. A platform team is dedicated to serving internal customers across the business and is responsible for establishing and managing a catalog of approved tools and processes that developers and teams can choose from as self-service options. The goal is to balance standardization with flexibility, while baking in security and compliance via automation.
Platform teams work across functions and ensure everyone has a seat at the table. They listen, identify the problems their customers want to solve, and create options for how to solve those problems. Because they ensure that security and compliance are part of their approved solutions, developers and engineers no longer have to think about when they’re working. They can move quickly without trading risk for speed.
But automation isn’t a blanket solution
Automation has become the new “digital transformation” — businesses see it as a sweeping solution and an imperative to keep pace with competitors. Too often, teams are given license to leverage automation but end up creating pockets of automation ad hoc across the enterprise, leading to tool proliferation and redundant or divergent processes – ultimately obstructing scalability.
Successful automation begins by getting to know the internal customer, identifying a specific problem they are trying to solve, understanding how automating that solution will impact other workflows and processes in the company (including the customer experience), and then automating a solution for that problem. Automation should not be done in silos or without a broader understanding of how it impacts the ecosystem or customer and employee experience.
What successful automation looks like
Nearly every company’s tech stack includes automation. Companies wanting to advance their automation strategies can begin by identifying where and how it’s happening now, and open up communication with these teams. Next, they can establish joint accountability among infrastructure, compliance/security, and business teams. Decisions on investments and tools need to be made as a group, with everyone having a voice and being heard. Alignment on technology and process is essential to establishing standards and prioritizing automation.
Once this is established, automation teams should start by deeply understanding who the internal customer is, identifying the specific problem that needs to be solved, and then automating to achieve that. This way, automation will create real results that serve the business and have a positive impact on customer and employee experience.
Continuous compliance gets baked in
There is a careful balance between flexibility and standardization — and speed and risk. Companies can create continuous compliance when they standardize and automate it — so developers and engineers no longer need to think about it. Platform teams can implement compliance by design — and create peace of mind for security and leadership, while giving developers flexible parameters for how they work. By reimagining automation and its role in scaling security and compliance, companies can mitigate risk when modernizing their tech stack and build into the future confidently.
