Some key takeaways from this talk are outlined below. The main focus area for researchers in DevSecOps is automation and tool usage. Older technologies, such as SAST & DAST tools have drawbacks that affect DevSecOps goals. Shift-left security and continuous security assessment are two key recommendations. These practices prioritise security in a continuous manner throughout the deployment cycle. Inability to automate traditionally manual security practices is a significant problem in this field. These practices are hard to be fully integrated with the continuous practices of DevOps. Even though cultural or human aspects are critical for DevSecOps success, these has not been much done in the state-of-the-art and the state-of-the-practice domains Adopting DevSecOps principles or practices in various complex, resource-constrained, and highly regulated infrastructures is a growing area of research. More empirically evaluated solutions are needed to ensure wider adoption of such tools or frameworks

1. DevSecOps: Continuous Engineering with
Security by Design: Challenges and Solutions
Ali Babar
CREST – Centre for Research on Engineering Software Technologies
NJSD, China, 10th December 2022

2. • Why Development and Operations (DevOps)?
• Embedding Security by Design in DevOps
• Building and Exploiting DevSecOps Body of Knowledge
• Reported Challenges of Integrating Security in DevOps
• Recommended Solutions to Address the Challenges
• Workflow Support for Integrating Security in DevOps
• SomeAreas of Future R&D Actions
Talk’s Roadmap
CREST| The University of Adelaide 3

3. From DevOps to DevSecOps
• DevOps: Breaking down ‘‘silos’’ of development (Dev)
and operations (Ops)
• DevOps’ rapid and frequent delivery of software
creates security challenges
• DevSecOps: Integrating security controls and
practices into DevOps
CREST| The University of Adelaide 4

4. Study # 1
DevSecOps = DevOps with security by design
Building support knowledge & infrastructure
Study #1: Rajapakse, R. N., Zahedi, M., Ali Babar, M., Shen, H., Challenges and solutions when adopting DevSecOps: A systematic review, Journal of Information and Software Technology, 141, 106700, 2022 .

5. • Systemizing the knowledge of the challenges faced by
practitioners when adopting DevSecOps and the reported
solutions by answering the following questions
• RQ1: What are the specific challenges of adopting DevSecOps?
• RQ2: What are the reported solutions to address the DevSecOps adoption
challenges?
• RQ3: What are the opportunities for the future R&D activities?
6
CREST| The University of Adelaide
Building DevSecOps Body of Knowledge

6. Key Findings

7. DevSecOps – Four Areas of Focus
Reproduced from: Rajapakse, R. N., Zahedi, M., Ali Babar, M., Shen, H., Challenges and solutions when adopting DevSecOps: A systematic review, Journal of Information and Software Technology, 141, 106700, 2022.
CREST| The University of Adelaide 8

8. SoK of DevSecOps: Identified Challenges
-Inability of established security tools to
support rapid deployment cycles
-Large number of security vulnerabilities
are affecting popular tools used in the
DevSecOps pipeline
-Many manual security practices are
difficult to be fully automated and
integrated into DevSecOps
-Developers face trade-offs between
speed and security in a DevOps setting
- The nature of certain challenging
infrastructures or restrictive policies (e.g.,
access control) conflict with DevSecOps
principles
- Inability of team members/ management
to engage in the required culture change
- Developers lacking security skills
DevSecOps
Challenges
CREST| The University of Adelaide 9

9. - Hybrid tools (e.g., Interactive Application
Security Testing)
- Moving to cloud/as-a-service solutions
- Security to be treated as a key concern
from the start of the process (shift-left),
and it should continue to be so, throughout
the cycle (continuous security)
- Strict access management, model-driven
engineering and setting up simulation
environments
- Security champions
- Controlled and standardized
communication strategies
Proposed
Solutions
SoK of DevSecOps: Identified Solutions
CREST| The University of Adelaide 10

10. Infras-
tructure
People
Practices
Challenges in DevSecOps Proposed solutions based on main themes
Documentation with security support
Adopting best practices for tool usage
Static analysis for Infrastructure as Code scripts
Systematic evaluation of product-specific vulnerabilities
Hybrid lifecycles with data-security focus
Creating simulation or replication environments for testing
Framework support for DevSecOps
Implementing security knowledge sharing methods and
training
Integrity protection frameworks
Facilitating inter-team communication and collaboration
with the appropriate controls or standards
Strict access management and policies
Adopting Infrastructure as Code
Model-driven engineering to support DevSecOps
Big data and behavioral analytics techniques
Shifting security to the left
Security patch management using DevOps practices
Implementing continuous security assessment practices
Practitioners converge towards tool standards
Using orchestration platforms
Reusable design fragments and security tactics
Tools for continuous vulnerability assessment
Interactive Application Security Testing (IAST) tools
Move to cloud based solutions (e.g static analysis as a
service)
Using a virtualization tool to encapsulate part of the system
Proposed future research directions
Consensus on shift left and continuous security
The need for security tools that target developers and not
security experts (i.e. developer-centered security)
Application security testing as a service
Continuous vulnerability discovery and
management practices
Empirically validated security metrics for DevSecOps
Infras-
tructure
People
Practices
Tools
Defining security roles in DevSecOps
The need for socio-technical studies addressing people related
challenges in DevSecOps
Empirically validated frameworks in different contextual
settings
Challenges related to tool selection in DevSecOps
Limitations of dynamic analysis tools restricting
its usage in DevSecOps
Vulnerabilities affecting CI systems
Limitations of Infrastructure or Configuration as Code tools
and scripts
Security limitations or vulnerabilities affecting
the container ecosystem
Security limitations or vulnerabilities affecting the CD pipeline
Inability to fully automate traditionally
manual security practices to integrate into DevSecOps
Inability to carry out rapid security requirements
assessment
Challenges related to security measurement practices
in rapid deployment environments
Inter-team collaboration issues
Challenges in organizational culture
Knowledge gap in security
Insider threats
Difficult to adopt DevSecOps in complex cloud
environments (e.g. multi cloud env.)
Difficult to adopt DevSecOps in resource constrained
environments (e.g. embedded systems, IoT)
Difficult to adopt DevSecOps in highly regulated
environments (e.g. air-gapped env., medical devices)
Using threat analysis practices
Adapting standards, policies, models, service agreements into
testable criteria
Automated vulnerability detection through requirement analysis
Devising security metrics or metric based approaches
Effective process documentation and logging strategies
Having security champions in the teams
Carrying out organizational HRM programs in parallel
The need for security tools that compliment the rapid
Tools deployment cycles in DevSecOps
Security issues resulting from tool complexity and
integration challenges
Limitations of static analysis tools affecting
rapid deployment cycles
Configuration management issues of tools
Challenges related to continuous security assessment
Incompatibility between security and DevOps practices
due to velocity of change, complexities and dependencies
DevSecOps: Mapping Challenges onto Solutions
Reproduced from: Rajapakse, R. N., Zahedi, M., Ali Babar, M., Shen, H., Challenges and solutions when adopting DevSecOps: A systematic review, Journal of Information and Software Technology, 141, 106700, 2022.
CREST| The University of Adelaide 11

11. What is the problem?
Security tools in DevOps
• Challenging to introduce and fully leverage security tools in the DevOps pipeline
• Application Security tools: test applications for security vulnerabilities
• Many drawbacks which affect DevOps goals
• Our aim: Empirically investigate how security tools can be integrated into a DevOps
workflow without affecting its rapid delivery goals
Dev Ops
CREST| The University of Adelaide 14

12. Key challenges of integrating security tools into DevOps
Technology Function-
ality
Output Integration
What Have We Learned?
CREST| The University of Adelaide 15

13. What Have We Learned?
Reproduced from: Rajapakse, R. N., Zahedi, M., Ali Babar, M., An Empirical Analysis of Practitioners’ Perspectives on Security Tool Integration into DevOps, the 15th ACM/IEEE International Symposium on Empirical
Software Engineering (ESEM) 2021.
CREST| The University of Adelaide 16

14. What Have We Learned?
Reproduced from: Rajapakse, R. N., Zahedi, M., Ali Babar, M., An Empirical Analysis of Practitioners’ Perspectives on Security Tool Integration into DevOps, the 15th ACM/IEEE International Symposium on Empirical
Software Engineering (ESEM) 2021.
CREST| The University of Adelaide 17

15. What Have We
Developed? Commit
Build
Developer codes
in the IDE
d) SCA
e) IAST
No
Yes
Triage results
in issues?
Raise ticket
based on severity
Yes
No
g) RASP
a) Real-time
SAST on the IDE:
Limited rules
h) WAF
Merge
approval
Pull request
Feature Branch
Master branch
Test - QA server
Deploy
Monitor-
Production
Yes
No
Issues
present?
Early vulnerability
fixes
Continuous
Integration
Continuous
Delivery
Continuous
Deployment
c) Deep SAST at
build time (on CI
server)
Issues
present?
(pipeline not stopped)
f) DAST
performed in
parallel
No
Yes
Issues present?
Continuous
Monitoring and
Detection
input
i)
SIEM
Alerts
from
all
vulnerability
detection
tools
Alerts
from
all
exploit/attack
detection
tools
Vulnerability
remediation
b) Incremental
SAST: Limited
rules
Yes
No
Early vulnerability
fixes
Issues
present?
Tool type
Developer
activity
I D E : Integrated d e v e l o p m e n t
e n v i r o n m e n t
S A S T : Static a p p lic ation
s ec urity testing
CI: C o n t i n u o u s integration
S C A : S o f t w a r e c o m p o s i t i o n
analys is
I A S T : Interactive applic ation
s ec urity testing
Q A : Quality a s s u r a n c e
D A S T : D y n a m i c applic ation
s ec urity testing
R A S P : R u n t i m e application
self-protection
W A F : W e b applic ation firewall
S I E M : Sec urity inform ation a n d
e v e n t m a n a g e m e n t
21
CREST| The University of Adelaide
Reproduced from: Rajapakse, R. N., Zahedi, M., Ali Babar, M., An EmpiricalAnalysis of Practitioners’Perspectives on SecurityTool Integration into DevOps, the 15thACM/IEEE International Symposium on Empirical
Software Engineering (ESEM) 2021.

16. The main focus area for researchers in DevSecOps is automation and tool usage. Older
technologies, such as SAST & DAST tools have drawbacks that affect DevSecOps goals.
Shift-left security and continuous security assessment are two key recommendations. These
practices prioritise security in a continuous manner throughout the deployment cycle.
Inability to automate traditionally manual security practices is a significant problem in this
field. These practices are hard to be fully integrated with the continuous practices of DevOps.
Even though cultural or human aspects are critical for DevSecOps success, these has not
been much done in the state-of-the-art and the state-of-the-practice domains
Adopting DevSecOps principles or practices in various complex, resource-constrained, and
highly regulated infrastructures is a growing area of research. More empirically evaluated
solutions are needed to ensure wider adoption of such tools or frameworks.
DevSecOps: Key Takeaways
CREST| The University of Adelaide 23

17. Acknowledgements
• This presentation is based on the research studies (biblio details below)
planned and carried out by the CREST researchers and collaborators:
• Roshan Raja (PhD student), M. Ali Babar, Mansooreh Zahedi and
Haifeng Shen
• Slides taken from the presentations prepared by Roshan Rajapakse
• Triet Le helped in adding some material and formatting the slides.
• The Cybersecurity CRC provided the funding
• The CREST team provided feedback/comments for improving the
research studies
Study #1: Rajapakse, R. N., Zahedi, M., Ali Babar, M., Shen, H., Challenges and solutions when adopting DevSecOps: A systematic review, Journal of Information and Software Technology, 141, 106700, 2022.
Study #2: Rajapakse, R. N., Zahedi, M., Ali Babar,M., An Empirical Analysis of Practitioners’ Perspectives on Security Tool Integration into DevOps, the 15th ACM/IEEE International Symposium on Empirical
Software Engineering (ESEM) 2021.
CREST| The University of Adelaide 24

18. CRICOS 00123M
Contact: Ali Babar
ali.babar@adelaide.edu.au