DevSecOps
Secureinteli Technologies
DevSecOps
DevSecOps, short for Development, Security, and Operations, is a set of
practices and principles that aim to integrate security into every stage of the
software development lifecycle. It builds upon the principles of DevOps,
which emphasizes collaboration and communication between development
(Dev) and IT operations (Ops) teams to automate and streamline the
software delivery process. DevSecOps extends this collaboration to include
security (Sec) teams, ensuring that security is not a separate or isolated
phase but an integral part of the development and deployment process.
9/13/2023 Securing the Digital Enterprise 2
DevSecOps Lifecycle
9/13/2023 Securing the Digital Enterprise 3
Key Principles of DevSecOps
Shift-Left Security:
DevSecOps encourages organizations to "shift-left" security by incorporating it early in the
development process, from the initial design and coding stages.
Automation:
Automation is a fundamental aspect of DevSecOps. Security testing, vulnerability scanning, and
compliance checks are automated to provide rapid feedback to developers and ensure consistency
in security practices.
Continuous Integration and Continuous Deployment (CI/CD):
DevSecOps integrates security checks and tests into the CI/CD pipeline, enabling the automated
testing of code changes for security vulnerabilities as part of the deployment process.
Security as Code:
Treating security configurations, policies, and practices as code allows for versioning, tracking
changes, and automating security policy enforcement.
Container Security:
With the increasing use of containerization and orchestration, DevSecOps includes measures to
secure containers and the container orchestration platforms.
9/13/2023 Securing the Digital Enterprise 4
Key Principles of DevSecOps
Infrastructure as Code (IaC) Security:
Security considerations are applied to infrastructure provisioning and management through IaC tools like
Terraform or Ansible, ensuring that infrastructure is built securely.
Threat Modeling:
DevSecOps encourages the use of threat modeling techniques to identify potential security threats and
vulnerabilities in the application design phase.
Security Testing:
Various security testing techniques, including SAST, DAST, and IAST, are integrated into the development
pipeline.
Compliance and Governance:
DevSecOps ensures that regulatory and compliance requirements are met throughout the development
process, with automated checks and reporting to demonstrate compliance.
Collaboration and Training:
Collaboration between development, operations, and security teams is crucial. Cross-functional teams are
encouraged to work together, and developers are provided with security training to raise awareness of
security best practices.
Feedback Loop:
DevSecOps promotes a continuous feedback loop, where security issues are reported, prioritized, and
addressed promptly. This helps in iterative improvement of security practices.
Securing the Digital Enterprise 5
9/13/2023
DevOps vs DevSecOps
9/13/2023 Securing the Digital Enterprise 6
DevSecOps Functional Domains
9/13/2023 Securing the Digital Enterprise 7
DevSecOps Controls
9/13/2023 Securing the Digital Enterprise 8
DevSecOps Services
9/13/2023 Securing Digital Enterprise 9
DevSecOps Tools
9/13/2023 Securing Digital Enterprise 10