DevSecOps in the DoD

​

The concept of a service mesh architecture is an inherently new one, at least in practice in a scaled production environment. The tools and technologies used to build service mesh architectures today are quickly evolving and there is still much disagreement in industry as to what are best practices vs anti-patterns in designing a service mesh architecture.  SOLUTE is currently developing a service mesh for PMW 150.  The service mesh provides dynamic service discovery which simplifies connectivity between individual services, mutual TLS encryption, an easier means for deploying and updating services, and an API gateway that serves as a front-facing entry point for external requests.

SOLUTE’s development process heavily relies on DevSecOps methodologies supported by CI/CD infrastructure. SOLUTE generally implements Immutable Infrastructure, Infrastructure as Code, and Configuration as Code concept all deployed to public / private / hybrid clouds (both hosted in the cloud or on-premise / afloat). Together these concepts allow us to handle development, testing, verification, certification, security engineering, and system updates / upgrades using the same processes. Since both the deployment and configuration of the infrastructure itself is automated along with the deployment of the software, changes to the software system and candidate update / upgrades to the system itself can be tested using the same pipeline.

SOLUTE is a recognized leader in IaaS and PaaS design.  This design focuses on resources that emphasize abstraction and deliver scalability.  SOLUTE has successfully designed and delivered several prototype IaaS / PaaS solutions to the Navy and has researched and designed several afloat tactical compute architectures capable of supporting IaaS / PaaS solutions.  SOLUTE automated the deployment of the ACS Platform as a Service (PaaS) solution by including manual deployment steps in the automated execution process for common core services, data ingest, data representation, data storage, data indexing, and data access to support applications leading to the deployment of data analytics capable of performing in Denied-Disconnected, Intermittent, Low (D-DIL) bandwidth environments across distributed Naval Forces afloat and ashore. 

 

SOLUTE’s approach to successful integration of cyber security concerns through the development process is to integrate cyber-related tools into the entire delivery process. SOLUTE enhances cyber resiliency through modern architecture, microservices, and DevSecOps automation. Security culture and security automation must be combined to attain a “Continuous ATO." SOLUTE has automated end-to-end STIGs, Static Code Analysis, and Vulnerability Assessment integrating security throughout the whole software development lifecycle. The process is agile, security focused, automated, and allows for rapid feedback from the end user community.

SOLUTE has performed significant refactoring on projects with 25+ years of legacy code developed in a large monolithic architecture. SOLUTE specializes in modernization, and as a result a large portion of the software projects that SOLUTE has performed on have been legacy in need of large-scale refactoring. Even in newly developed systems, operational requirements and technology change fast compared to the lifecycle of DoD system, requiring refactoring to keep the system relevant.

SOLUTE’s new capability development and refactoring efforts are heavily focused on building modular, reusable, containerized components. There is a current trend towards microservices (which SOLUTE is on the forefront of), but even when a microservice architecture is not required or warranted, the objective of developing reusable components as building blocks is still relevant. New capabilities are developed with this objective in mind. Service decomposition is a major focus when refactoring. DoD applications are historically large and monolithic. Services that could be otherwise common and reusable are mixed in with use case specific features, making re-use difficult. SOLUTE’s refactoring methodology identifies and remediates this situation by breaking up large services into cohesive reusable modules.

SOLUTE is a full-fledged software development shop with over a decade of experience in agile software methodologies. SOLUTE’s formal development processes include Kanban, SCRUM, and the Scaled Agile Framework (SAFe). SOLUTE’s software development processes are CMMI Level-3 appraised and ISO 9001 certified demonstrating our commitment to the discipline and quality required in mission critical systems development.