In this article we introduce new technology that allows you to automate the change and release compliance in a Secure Software Development Lifecycle. It’s called Merkely, a DevOps Change Collaboration tool for teams in regulated industries.
Delivering software in regulated industries
First, let’s look at the problem we’re solving. The modern world depends on financial transactions, air traffic control, insulin pumps and car braking systems. When technology becomes critical to our lives and our economies there is increased demand from customers and regulatory bodies to control these risks.
In order to meet these requirements, organizations must define software development processes that ensure that safety and security risks are managed in a professional and repeatable manner.
Having defined and implemented a process, it is critical to document proof that the process is being followed. It is this evidence that auditors inspect to ensure that the organization is compliant with the regulations.
Software is eating the world
Regulated software development processes require many activities like version control practices, code review, security scanning and testing. Typically, these activities are spread over several software systems.
This makes it hard to know if the compliance process is being followed and to know what to do if/when compliance steps are skipped. Eventually, this creates a headache when it’s time for release and audit.
As software takes an increasingly central role in the success of all types of businesses, the demand to deliver more frequently increases the pressure on innovation cycle times.
For regulated industries, the challenge they face is overcoming the manual and bureaucratic processes that worked well in the past.
Accelerating with DevOps
Through a combination of culture, automation, lean, measurement, and sharing changes, DevOps enables today’s best performing technology organizations. However, meeting compliance requirements with DevOps demands a new approach.
Most regulations are written for general guidance and don’t specify an exact recipe to follow. In order to comply, organizations have traditionally implemented manual documentation and gate-checks, with every software release documenting the proof that the agreed processes have been followed.
Merkely provides a means of automating all of the documentation and checkpoints necessary to comply with regulations.
In short, Merkely records your software process automatically. It provides an API for recording various compliance events such as build, code review, security scan, and release directly from your DevOps pipelines. Implementing this central system of record provides insight across the organization, giving development, operations, security and risk a shared view of compliance.
An important consideration when choosing how to store this data is how it will be used. When the goal is to prove compliance with a software process, it is essential that the data is stored using a provable, secure, tamper-proof method.
Storing information in a way that allows for untraceable modification is pointless. This is why Merkely is based on an append-only datastore. It allows new versions of data to be added without losing the history. It is only with this non-modification guarantee that compliance can be proven.
The first step in automating your software process compliance is to start recording the audit trail in your DevOps pipeline. The DevOps pipeline is the best place to do this because it is the heartbeat of software change.
By recording the relevant change control data in your DevOps pipeline you can query it for change control. How this is implemented depends on your process, but it could be a pre-merge control, or an artifact promotion control. However you approach this, the end result is the same: all changes in your software are automatically compliant with your process.
Now you have your software change process under control the next step is to manage the release process.
Most software releases are made up of a collection of individual changes. The challenge this imposes on regulated software teams is proving that all of the changes included in a release have followed process.
Merkely provides aggregate and composite views of change. This enables all stakeholders to automatically share a common view of compliance across development, test, security, internal and external audit.
Continuous Compliance with Merkely
Delivering at pace within a safe, secure, and repeatable process puts extra demands on regulated industries. Merkely solves the compliance bottleneck by producing a cryptographically secure, version-aware record that fits into your existing ways of working. Ultimately, it means regulated teams can unlock much more of their DevOps potential by releasing continuously compliant software.
Curious? Try Merkely for free