Characteristics of devsecops

1. Introduction to DevSecOps

2. DevSecOps, which stands for development, security, and operations, is a
framework that integrates security into all phases of the software
development lifecycle. Organizations adopt this approach to reduce the
risk of releasing code with security vulnerabilities. Through
collaboration, automation, and clear processes, teams share
responsibility for security, rather than leaving it to the end when issues
can be much more difficult and costly to address.
What is DevSecOps?

3. There are many methods that attackers use to gain access to an
organization’s data and assets, but a common tactic is to exploit
software vulnerabilities. These types of breaches are costly, time
consuming, and depending on the severity, damaging to a company’s
reputation. The DevSecOps framework reduces the risk of deploying
software with misconfigurations and other vulnerabilities that bad
actors can take advantage of.
Why DevSecOps?

4. Key Components of DevSecOps
A successful DevSecOps process includes the
following components:
Continuous integration
Continuous delivey
Continuous security
Communication and collaboration

5. With continuous integration developers commit their
code to a central repository multiple times a day.
Then the code is automatically integrated and tested.
This approach enables teams to catch integration issues and bugs
early in the process rather than waiting
until the end when there could be
several issues that need to be resolved.
Continuous integration

6. Continuous delivery builds upon continuous integration to automate the process of
moving code from the build environment to a staging environment. Once in staging, in
addition to unit testing, the software is automatically tested to ensure the user
interface is working, the code is successfully integrated, that APIs are reliable, and that
the software can handle the expected traffic volumes. The goal of this approach is to
consistently deliver production-ready code that provides value to customers.
Continuous delivery

7. Building security into the entire software development lifecycle is a key
component of DevSecOps. This includes threat modeling early in the
process and automated security testing throughout the entire lifecycle,
starting with developers’ own environments. By thoroughly testing the
software for security issues early and frequently, organizations can
efficiently deliver software with minimal issues.
Continues security

8. DevSecOps is highly dependent on individuals and teams working
closely together. Continuous integration requires people to collaborate
to address conflicts in code, and teams need to effectively communicate
to unify around the same goals.
Communication and collaboration

9. Adding security to your DevOps process requires careful planning. Start
slowly with processes that introduce the least friction for the team and
offer the biggest security payoff. Here are a few ways to add security to
a typical DevOps sprint.
How to implement DevSecOps

10. development sprints not only helps reduce vulnerabilities later down the line, but it
also saves time because it’s easier to address issues before code has been built and
integrated. During planning and development, use threat modeling to identify and
mitigate potential threats to the application. This will help you build security into the
application right from the start
Planning and development

11. Running automated security scripts on the test environment helps uncover potential issues that
weren’t previously detected. Some of the security tests you can run during this phase include
dynamic application security testing, infrastructure scanning, container scanning, cloud
configuration validation, and security acceptance testing.
Building and testing

12. Once the application is deployed to production,
some organizations engage in penetration testing to try to find
weaknesses in the live environment
In penetration testing, people adopt the mindset of an attacker
and search for ways to breach the application.
Production

13. Even the best DevSecOps process won’t catch everything,
so it’s critical to continuously monitor applications for vulnerabilities
and threats. Analytics data can help you evaluate if your security
posture is improving and highlight areas for optimization.
Operation

14. DevSecOps is as much about culture change as process and
tools. Here are some best practices to help make adopting
this framework as smooth as possible.
DevSecOps Best Practices

15. Shift the culture
Recognize that people may have a difficult time changing the
way they work, and conflicts may arise. To help them adapt,
clearly communicate the organization’s goals and
expectations, provide lots of opportunities for open dialog,
and anticipate that you’ll need to be flexible until teams find
the tools, process, and cadence that work best for them
DevSecOps Best Practices

16. Start small
Security automation tools offer many options for checking
code for issues, but turning them all on, especially early in
your adoption of DevSecOps, may overwhelm your team. Be
judicious about which tools you implement and how many
issues you scan for.
DevSecOps Best Practices

17. Manage dependencies
Most developers use third-party packages and libraries to
efficiently build applications. The problem is that some of
these solutions have security flaws, and developers aren’t
always diligent about keeping them up to date. To reduce your
risk, make sure the components you use are vetted for
security risks and develop a standardized process for updating
them.
DevSecOps Best Practices