Download Publication
Who it's for:
- CISO/CIO/COO
- Security Engineers
- Product Managers
- Solution and Application Architects
- DevOps/DevSecOps Practitioners
- Software Quality Assurance Managers
- GRC Analysts
The Six Pillars of DevSecOps - Collaboration and Integration
Release Date: 02/20/2024
Working Group: DevSecOps
“Security can only be achieved through collaboration, not confrontation” is one of the defining principles of DevSecOps. Essentially, security is a team sport that requires various organizational roles to work together, including business leaders, domain experts, security personnel, architects, software developers, pentesters, SOC analysts, and product managers. This collaboration ensures that the threat landscape is well understood and that the organizational practices for IT activities, including the software development lifecycle, follow proper security hygiene.
This document highlights this fundamental DevSecOps principle. It provides practical insights that help organizations build a unified environment where security is not an isolated function, but an essential part of software development. This includes how to promote regular, open, and proactive communication between all parties, ensuring that all stakeholders are involved, informed, and working towards a shared vision.
Key Takeaways:
- Guiding principles for successful DevSecOps communication
- How to implement a continuous role-based security training program at an organization
- How various organizational roles collaborate in an end-to-end DevSecOps delivery pipeline
- The communication and collaboration required amongst various organizational roles to integrate a new acquisition into existing DevSecOps processes
- How DevSecOps collaboration principles apply to other technology practices and trends such as Zero Trust, AIOps, and MLSecOps
This publication is part of an entire series on the Six Pillars of DevSecOps. You can find all the papers in the series that have been released so far here.
Download this Resource
Share
Related resources
Related Resources
Acknowledgements
Aristide Bouix
Aristide Bouix
Amit Butail
Vice President Technology Risk and Control Evaluation
Amit Butail
Vice President Technology Risk and Control Evaluation
Amit is a cybersecurity and risk management leader with over 20 years of progressive experience.
Amit is actively involved as a Volunteer in the Cyber Security and CRISC of ISACA working group. He has been a working as a contributing author and helped for the research publication on DevSecOps Pillar 2 - Collaboration, Key Management Lifecycle Best Practices , CCM v4 - PCI DSS v4 mapping project of CSA. Volunteering as a Subject Matter...
Michael Roza
Risk, Audit, Control and Compliance Professional at EVC
Michael Roza
Risk, Audit, Control and Compliance Professional at EVC
Since 2012, Michael Roza has been a pivotal member of the Cloud Security Alliance (CSA) family. He has contributed to over 125 projects, as a Lead Author or Author/Contributor and many more as a Reviewer/Editor.
Michael's extensive contributions encompass critical areas including Artificial Intelligence, Zero Trust/Software Defined Perimeter, Internet of Things, Top Threats, Cloud Control Matrix, DevSecOps, and Key Management. H...
Alexandria Leary
Principal Cloud Security Consultant at ScaleSec
Alexandria Leary
Principal Cloud Security Consultant at ScaleSec
Ivan De Los Santos
Ivan De Los Santos
Darien Hirotsu
Darien Hirotsu
Nitin Kulkarni
Nitin Kulkarni
Josh Buker
Research Analyst, CSA
Josh Buker
Research Analyst, CSA
Abdul Sattar
Abdul Sattar
Are you a research volunteer? Request to have your profile displayed on the website here.
Interested in helping develop research with CSA?
Related Certificates & Training
CSA's Cloud Infrastructure Security training provides a high-level introduction to the most critical cloud security topics through virtual self-paced courses. Each Cloud Infrastructure Security training focuses on a specific area of cloud computing, and is design to be succinct, taking one-hour to complete.
Learn more
Learn more