DevSecOps Practices

Overview

DevSecOps, short for Development, Security, and Operations, is an approach to software development that integrates security practices into the entire software development lifecycle (SDLC). It emphasizes collaboration and shared responsibility between development teams, security teams, and operations teams to ensure the delivery of secure and reliable software.

Quick Links

Test-Driven Deployment Shift Left on Security Technical Continuous Delivery Technical Governance

Standard DevSecOps Practices:

DevSecOps encourages the early integration of security practices into the development process, starting from the requirements gathering phase. Developers can design and build more secure applications by considering security requirements and potential threats early on.

Automated security testing is integral to DevSecOps. It includes various types of security testing, such as vulnerability scanning, penetration testing, and code analysis. These tests are automated and integrated into the CI/CD pipeline, providing continuous and rapid feedback on security vulnerabilities.

Infrastructure as Code is the practice of defining and provisioning infrastructure resources using code. DevSecOps promotes using IaC tools and techniques, such as configuration management and orchestration tools, to ensure that security measures are implemented consistently across infrastructure deployments.

DevSecOps emphasizes continuous compliance monitoring to ensure software deployments meet security and regulatory requirements. This involves automated checks and audits to identify deviations from established security policies or compliance standards.

DevSecOps advocates for secure configuration management, where configurations for systems, platforms, and applications are securely managed, updated, and audited. This helps prevent common security misconfigurations that can lead to vulnerabilities.

DevSecOps promotes adopting secure coding practices, such as input validation, output encoding, and proper error handling, to mitigate common security vulnerabilities like SQL injection, cross-site scripting (XSS), and buffer overflows.

DevSecOps encourages cross-functional collaboration and communication among development, security, and operations teams. Security requirements, risks, and concerns are shared and addressed collectively to ensure a shared understanding and a proactive approach to security.

Threat modeling is a practice in DevSecOps that involves identifying potential threats and vulnerabilities in the software system early in development. Teams can proactively address security risks by analyzing the system architecture, data flows, and potential attack vectors.

DevSecOps promotes security training and awareness programs for developers and other team members. This helps create a security-conscious culture and equips team members with the knowledge and skills to effectively identify and address security issues.

DevSecOps incorporates incident response and remediation practices to handle security incidents promptly and effectively. Incident response plans, monitoring systems, and incident management processes are established to minimize the impact of security breaches and facilitate quick recovery.

By embracing DevSecOps practices, organizations can integrate security into their development processes, ensure security measures are implemented throughout the SDLC, and deliver software more resistant to security threats and vulnerabilities.

Adoption Expectations

System Components	MVP	MVP+
Document security practices	+	+
Establish regular security reviews and testing activities	+	+
Establish incidents tracking system	+	+
Include security scans as CI/CD quality gates	+	+
Restrict IaC modules to approved templates with built-it security settings	+	+
Introduce security policies on Landing Zone level	+	+
Adopt Security Monitoring tool	+	+
Establish security training for IT teams		+

Tools

Functionality	Tool Name
Infrastructure as Code (IaC) tool	Terraform, CloudFormation, Azure Resource Manager
CI/CD tools	Azure DevOps, Jenkins, GitHub Actions
Security scan tools	Veracode
Security monitoring	Azure Security Center

Roles

Name	Responsibilities
System (Security) Architect	Establish DevSecOps practices and tools, perform reviews
Security Engineer	Implement automated security testing
Security Test Engineer	Perform security testing