Is security keeping pace with continuous delivery?

No

You asked a yes/no question, there's the answer.

Coming from a Mode 1 ITSM world, the idea of continuous delivery seems terrifying. I spent a lot of time in operations reconstructing past events for audits, and changes complicated that process. If there is no graceful way to reconstruct the state of the system in the past, then that aspect of compliance (security or otherwise), goes out the window.

When I worked for a large credit card issuer, a defect (code, disclosure, parameter, whatever) could be discovered months later (sometimes after someone complained to a regulatory agency) and my task was to answer how many cardholders were impacted when in what way, performing research across dozens of subsystems. How on earth could anyone do that in a continuous delivery environment?

Provocative question, but it's much more complex in reality

Obviously, if your security strategy is to do everything at the application level and just attach your production server straight to the internet, that's an enormous risk, whether doing continuous delivery or managed releases.

Anybody sane has a network infrastructure involving multiple firewalls whereby the actual production servers are not directly accessible from the internet. Unfortunately a lot of sizeable companies do not yet fall into the "anybody sane" category.

I've worked somewhere that had good experiences with continuous integration and testing of software, but they did nothing that could be described as continuous delivery. Releases of new software versions werw only deployed after stable builds passing all tests had been through a round of user acceptance testing so that they got tested by real people too.

Personally, I'd never deploy a new versoin of software without all this, unless there were urgent fatal bugs to be fixed, in which case a version of the last deployed release with just those bugs fixed is acceptable for a quick deployment.

I can just imagine the sleepless nights and stress that a "continuous delivery" strategy would result in : my feeling is that it would result in a "continuous staff turnover" situation too.

No

No it is not

Next question please

Pic

That rabbit looks really angry.