SECURITY ENGINEERING
Development Security Operations Mindset
Computer Software Engineering (I3891CS) | Afonso Junior Diniz De Moura
1
OVERVIEW
Background on DevSecOps
The DevSecOps Mind Set
Shift Left Security
The Shared Responsibility Model
Automated Security Tooling
Static Application Security Testing (SAST)
Dynamic Application Security Testing (DAST)
Software Composition Analysis (SCA)
2
DEVELOPMENT SECURITY
OPERATIONS
(DEVSECOPS)
DevSecOps integrates
security practices into the
DevOps process from the
start. It combines
development (Dev), security
(Sec), and operations (Ops)
to build secure software
faster.
3
WHY USE DEVSECOPS?
❑ Manual testing creates a
bottleneck in software
development.
❑ Due to transition from
monolithic structures to
microservices, there are
more areas of entry for
security breaches.
❑ It is very expensive (time
& money) to modify and test
software in production.
4
DEVSECOPS COMPARED TO DEVOPS
DevSecOps builds on DevOps by embedding security practices throughout
the entire software development lifecycle, rather than treating security as
an afterthought.
5
THE DEVSECOPS MINDSET
Treats security as an integral part of development, not a separate phase in
development, encouraging collaboration across dev, sec, and ops teams.
This mindset revolves around shared responsibility, where everyone owns
security to break down departmental barriers and catch issues early. Key
elements include shift left for proactive vulnerability detection, automation
of security checks in CI/CD pipelines, and continuous improvement through
feedback loops
6
SHIFT LEFT SECURITY
Shift left security moves security practices earlier in the software development
lifecycle (SDLC), starting from planning and coding, to detect vulnerabilities before
they propagate to production.
Security
7
SHARED RESPONSIBILITY
MODEL
This model distributes security ownership across
DevSecOps teams:
❑ Developers handle code-level security
❑ Operations manage infrastructure security
❑ Security experts provide oversight
8
AUTOMATED SECURITY
TOOLING
❑ Software tools that automatically scan, test,
and secure applications throughout the
development lifecycle.
❑ Integrate into CI/CD pipelines for continuous
checks without manual intervention.
9
AUTOMATED SECURITY TOOLING
These tools enable DevSecOps by running vulnerability assessments,
compliance checks, and threat modelling in real-time, reducing human error
and speeding up secure releases.
They support "shift left" by embedding security early, often via APIs that
trigger on code commits or builds
STATIC APPLICATION
SECURITY TESTING
(SAST)
Analyzes source code or
before runtime for flaws
like SQL injection or
insecure coding patterns.
Developers use it during
coding to catch issues
pre-build
11
DYNAMIC APPLICATION
SECURITY TESTING
(DAST)
Simulates attacks on
running applications
(black-box testing) to
find runtime
vulnerabilities.
It tests live environments
post-build without
needing source code
12
SOFTWARE
COMPOSITION
ANALYSIS (SCA)
Scans open-source and
third-party dependencies
for known vulnerabilities,
outdated libraries, or
license risks.
13
COMPARISON BETWEEN SAST, DAST & SCA
Tools Approach When is it used Pros
SAST Code Review Pre- Early in Finds development
build development errors quickly
DAST Runtime Simulation After deployment Attack detection
without needing
code
SCA Dependency Continuous Management of
Scanning third- party risks
14
Dynatrace, "What is DevSecOps?", Dynatrace Blog. [Online]. Available:
[Link]
DevPro Journal, "The DevSecOps mindset: What it is and why you need it," DevPro Journal. [Online].
Available: [Link]
mindset-what-it-is-and-why-you-need-it/fortinet
574n13y, "Understanding DevSecOps Principles," [Link], Dec. 18, 2024. [Online]. Available:
[Link]
Check Point Software Technologies, "What is shift left security?", Check Point Cyber Hub. [Online].
Available: [Link]
REFERENCES GitGuardian, "DevSecOps and the AppSec shared responsibility model," GitGuardian Blog, Sep. 25,
2024. [Online]. Available: [Link]
responsibility-model/[Link]
Akamai, "What is static application security testing (SAST)?", Akamai Glossary. [Online]. Available:
[Link]
Akamai, "What is dynamic application security testing (DAST)?", Akamai Glossary. [Online].
Available: [Link]
dasttigera
PortSwigger, "DAST (dynamic application security testing)," Burp Suite. [Online]. Available:
[Link]
15