DevSecOps represents an evolution of the DevOps philosophy by emphatically incorporating security practices into the rapid-release cycles that DevOps promotes. Rather than treating security as a final step in the development process, DevSecOps embeds it from the outset and at every stage, from initial design through integration, testing, deployment, and software delivery.
The rationale behind DevSecOps is that every person involved in the development lifecycle is responsible for the security of the end product. This requires a mindset shift where teams are cross-functional and collaborative, tools and processes are automated to screen for security issues in real-time, and security decisions are made at speed and scale to keep pace with dynamic development environments.
Practical aspects of DevSecOps include incorporating security review and testing tools into continuous integration/continuous deployment (CI/CD) pipelines, automated vulnerability scans, and frequent code reviews. Cultural aspects involve fostering an environment of continuous learning, sharing of knowledge and practices, and teamwork between development, operations, and security disciplines.
Key Characteristics:
- Ethos integrating security practices into DevOps
- Promotes shared security responsibilities across teams
- Utilises automation to enforce security at every phase of the software lifecycle
- Encourages collaboration and communication between development, operations, and security
Examples:
- Real-World Example: A financial services company integrates automated security testing into their CI/CD pipeline, ensuring that code is scanned for vulnerabilities every time a new version is checked in, well before it reaches production.
- Hypothetical Scenario: During the sprint planning in a tech startup, the team includes security user stories and tasks alongside functional requirements. Security experts work closely with developers to ensure these are built into the product from the first lines of code.
Related Terms:
- DevOps: A set of practices that combines software development (Dev) and IT operations (Ops) aimed at shortening the systems development life cycle and providing continuous delivery.
- CI/CD: Short for Continuous Integration/Continuous Deployment or Continuous Delivery; a method to frequently deliver apps to customers by introducing automation into the stages of app development.
- Automated Vulnerability Scanning: Tools and processes used in DevSecOps to automatically scan for security vulnerabilities as part of the continuous integration and deployment pipeline.
- Secure Coding: The practice of writing software in a way that guards against the introduction of security vulnerabilities, critical within DevSecOps to ensure secure software builds.
