The various trends around software development: small team sizes, faster velocity and the styles of building software are here to stay and organizations will need a new way in which to train their developers. 

This is according to Pete Chestna, CISO of North America at Checkmarx, in the SD Times Live! on-demand webinar “Cloud Engineering – Generation DevSecOps.”

First people need to have a standardized definition of what DevOps means. For most people it’s around deploying, operating, and monitoring. It’s people that create the tooling and scaffolding that allow you to release your applications. When thought of in this way, they serve as kind of an extra IT team and their job is to make the developer’s job easier, but that is not the best way to get the benefits out of DevOps, according to Chestna. 

“The reason for that is when you have to clean up after yourself, when you have to respond to incidents and be woken up in the middle of the night because you’re on pager duty that day and you see that your work isn’t as good as you think it might be and that there are opportunities to improve, without that pain you don’t change the way you code,” Chestna said. 

The move towards DevOps has also reshaped developers’ hiring profile. Now it’s no longer just about being a full-stack engineer, someone that could write JavaScript and database queries, but it became about multi-discipline. 

Also, over time as teams started shrinking to six to twelve people to move faster, they had to become cross-functional teams which resulted in what is now known as the continuous knowledge gap. This is when one learns something new and is exposed to so many things on top of that yet to be learned. 

As companies moved towards microservices, they had to find models to strangle the code and move pieces out one piece at a time, all while supporting the old application. “It’s like you’re building a plane while you’re flying a plane,” Chestna said. 

This is why teams need to adopt cloud-native software development in which an individual builds the feature, functionally tests the feature and validates the security of the feature. 

Then, the CI/CD pipeline approves the release of the feature and installs software in production. The software terraforms the operating environment and installs and configures OS supporting software. 

“We need to learn this over time and learn how to automate these things. And as we fix problems, we need to add to those tests because it’s obviously something that we missed in our initial implementation,” Chestna said. “It also requires that discipline. It’s easy to think about, hey, I’m just going to get this done and I’ll think about it later, but later never comes and then you get bitten by it with an outage.”

For more information, watch the SD Times Live! on-demand webinar “Cloud Engineering – Generation DevSecOps.”