4 min read
In this blog we’ll explain how to automate the change and release compliance in a Secure Software Development Lifecycle. Kosli is a new technology that enables teams in regulated industries, like fintech, to release compliant software on demand.
Software in regulated industries
The modern world runs on financial transactions, air traffic control, insulin pumps, and car braking systems. When technology becomes critical to our lives and our economies there is increased demand from customers and regulatory bodies to control associated risks.
To meet these requirements, organizations must define software development processes that ensure that safety and security risks are managed in a professional and repeatable manner.
Having defined and implemented a process, it is critical to document proof that the process is being followed. It is this evidence that auditors and bodies like the FCA use to ensure that your organization is compliant with the regulations.
The Bottleneck Problem
Regulated software development processes require many activities like version control practices, code review, security scanning, testing, and more. Typically, these activities are spread over several software systems.
This makes it hard to know if the compliance process is being followed and to know what to do if/when compliance steps are missed. Eventually, this creates a headache when it’s time for release and audit. Gathering the data to prove compliance is a manual, costly, time-consuming process. It’s also shown to be poor at mitigating risk and insider threat.
As software takes an increasingly central role in the success of all types of businesses, the demand to deliver more frequently increases the pressure on innovation cycle times.
For regulated industries like fintech, this creates a change management bottleneck at the end of the software delivery cycle. The challenge we face is overcoming the manual and bureaucratic processes that worked well in the past, but are no longer fit for purpose in today’s dynamic software development environments.
Breaking the DevOps Compliance Barrier
Research at DevOps Research Assessment (DORA) proves that today’s best performing technology organizations practice DevOps. However, meeting compliance requirements with DevOps demands a new approach. How do we release complaint software every day when our change management regime forces us to batch changes for release once every 3-6 months? How do we reconcile rapid software delivery with onerous change management processes?
Most regulations are written for general guidance and don’t specify an exact recipe to follow. To comply, organizations have traditionally implemented manual documentation and gate-checks, with every software release documenting the proof that the agreed processes have been followed.
Kosli provides a way of automating all the documentation and checkpoints necessary to comply with regulations.
How does Kosli work?
Kosli is a special type of database for recording your software process automatically. It provides an API for recording various compliance events such as build, code review, security scan, or release, directly from your DevOps pipelines. Implementing this central system of record provides insight across the organization, giving development, operations, security and risk a shared view of compliance.
An important consideration when choosing how to store this data is how it will be used. When the goal is to prove compliance with a software process, it is essential that the data is stored using a provable, secure, tamper-proof method.
| DevOps | Compliance | Journal |
|---|---|---|
| Automated | Provable | Audit Trail |
| API-Based | Secure | System of Records |
| Silo-Breaking | Process Aware | Append-Only |
Storing information in a way that allows for untraceable modification is pointless. This is why Kosli is based on an append-only datastore. It allows new versions of data to be added without losing the history. It is only with this non-modification guarantee that compliance can be proven.
Having a Kosli means you can begin the journey to Continuous Compliance by automating change and release controls.
Change Control
The first step in automating your software process compliance is to start recording the audit trail in your DevOps pipeline. The DevOps pipeline is the best place to do this because it is the heartbeat of software change.
By recording the relevant data in your DevOps pipeline you can query it for change control. How this is implemented depends on your process, but it could be a pre-merge control, or an artifact promotion control. However you approach this, the end result is the same: all changes in your software are automatically compliant with your process.
Now you have your software change process under control the next step is to manage the release process.
Release Control
Most software releases are made up of a collection of individual changes. The challenge this imposes on regulated software teams is proving that all of the changes included in a release have followed a specified process.
Kosli provides aggregate and composite views of change. This enables all stakeholders to share a common view of compliance across development, test, security, internal and external audit, automatically.
Continuous Compliance with Kosli
Delivering at pace within a safe, secure, and repeatable process puts demands on regulated industries. But, by implementing Kosli, teams in these regulated verticals can unlock much more of their DevOps potential 🙌
