What is the goal of DevSecOps, and what are its typical pitfalls?
Speed up secure development by automating security testing and configuration in the CI/CD pipeline. The pitfalls are allowing merges to production despite coding errors, and deploying directly to production.
DevSecOps builds security into DevOps. The checks a security team would run by hand (SAST, DAST, SCA, vulnerability scans, hardening) run on every change. The Developer is responsible.
- Plan the pipeline, including the hardening specification.
- Prepare the testing tools.
- Set up the pipeline, with approval steps, infrastructure as code, and connections to configuration management and monitoring.
- Test the pipeline.
- Train developers and the DevOps team.
A core deliverable is separation of dev, staging and prod with approval steps between them. Both pitfalls skip those gates. Merging with known coding errors turns automation into a fast way of shipping vulnerabilities. Deploying straight to prod skips staging and approval altogether.
Go deeper:
NIST SP 800-204D — Software supply chain security in DevSecOps CI/CD pipelines — how to secure the pipeline itself- DevOps (Wikipedia) — DevOps and the DevSecOps extension