DevSecOps – What is it?

Now more than ever people, companies and governments are creating huge amounts of data every day. This rapid expansion of data collection and usage has resulted in more companies investing more time and research in learning how to keep it safe. 

Data breaches have now become a re-occurring theme in the news as major companies such as Yahoo and eBay have shown us what the consequences could be when you haven’t got your system configured correctly.

In order to combat this, companies invest in what is known as DevSecOps. This is the intersection between DevOps and Security where security protocols are developed and fed into the design process of the system.

What does this have to do with Salesforce?

In the Salesforce space, security is managed through profile setting, access permissions and sharing rules. The security procedures don’t stop there, systems are also at risk of overwrites and deletion, as a result, measures are put in place to prevent this from happening.

One of the most essential security procedures is to establish a Sing Source of Truth. By utilising a control system like Git, you can isolate any changes that are made to the program, which reduces any chance of mistakenly overwriting the current version. The benefit of this is that Admins and Developers can work the same code to make true changes based on the same source. 

This leads onto the next step – creating an audit trail. Once a change has been made it’s important to make a log of it so see who made the change and whether it was the right one to make. By using a Git Repo as the Single Source of Truth you’re able to capture all of the changes to your settings and code so you can keep track of the system changes as they happen.

Quality control is also important. Just imagine investing loads of time and money into a system just for it to be destroyed as soon as you add an extra feature? This is where tools such as Selenium, Prover and Fusion can help with verifying that features work as expected. The benefits of Quality Gates go beyond just this, they can also be used to align multiple developer’s coding styles into a universal method. Tools such as Static Code Analysis can, therefore, be used to minimise coding variation and highlight bad developer practices. 

To ensure that your system is secure, it’s important you take proactive measures by creating backups of your data and profile configurations – it might just save you a lot of time and money in the future. There are two types of data that you should be backing up. Firstly, your Metadata should be regularly backed up using Git as a Single Source of Truth. By marrying the changes to the User Stories, it will provide the stored data you need for a Rollback and Restore. The other data type refers to the large-scale datasets with huge amounts of data inside them. These are more difficult to do on a regular basis due to its size, but this data is critical to your business and so a tool that allows you to do continuous incremental backups is needed from the beginning.

Securing your system is an ongoing battle. It may never be 100% perfect, but that’s okay because this is a learning process that takes place over the long term. But what’s important is that you get started sooner rather than later, as the more data you gather whilst remaining unprotected the worse the impact will be if it does go wrong.

Looking for expert help?

If you need assistance on configuring your Salesforce system or have any questions relating to Salesforce – make sure to get in touch today! At Zon Projects, we’re your friendly Salesforce specialists and we’d love to help.

 

How Can We Help You

We would be happy to have an informal chat with you about your requirements and to offer advice or see if we can be of assistance to you. Please complete our simple form and we will contact you as soon as possible.

R

Help & Advice

R

Project recovery

R

Support & Training

R

Integration to a 3rd party system

Get in touch

12 + 15 =