CSA Releases “The Six Pillars of DevSecOps” Report

Paper identifies areas critical to successful DevSecOps integration within an organization

LAS VEGAS - AUGUST, 7, 2019 - BLACKHAT––The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications and best practices to help ensure a secure cloud computing environment, today announced the release of The Six Pillars of DevSecOps. The paper, created by CSA’s DevSecOps Working Group, aims to ensure that DevSecOps is part of a well-thought out design principle — rather than a bolted-on afterthought — to enhance an organization’s overall security posture.

“The security risks inherent in today’s intricate interactions between multiple technology layers, coupled with the globally interconnected and always-on nature of today’s applications, have been compounded by vulnerabilities lying dormant in systems, software, and hardware. The result is a field ripe for picking by malicious parties across the world,” said John Yeoh, VP of Research for the Cloud Security Alliance. “This report should serve as a springboard for organizations wanting to address the challenges of today’s interconnected, rapidly changing security environment with increasingly shortened infrastructure and product life cycles.”

The omnipresence of consumer electronics and computer power, alongside modern trends (i.e., DevOps, microservices, and open source) that accelerate deployment cycles continue to strain enterprises’ ability to detect and identify exploitable flaws in a timely manner. While this creates significant increases in overall security risk, organizations that build security into the software lifecycle have better outcomes. To facilitate this, CSA’s DevSecOps Working Group defined the following six areas of focus that are critical to integrating DevSecOps into an organization:

1. Collective responsibility: Everyone has their own security responsibility and must be aware of their own contribution to the organization’s security stance. Edge users and developers are not just "security-aware" but are the first line of defense.
2. Collaboration and integration: A security-aware and collaborative culture is necessary for the members of all functional teams to report potential anomalies.
3. Pragmatic implementation: Taking a framework-agnostic, digital security and privacy model that focuses on application development will allow organizations to approach security in DevOps pragmatically.
4. Bridging compliance and development: The key to addressing the gap between compliance and development is to translate applicable controls to appropriate software measures and identifying inflection points within the software lifecycle where these controls can be automated and measured.
5. Automation: Software quality can be enhanced by improving the thoroughness, timeliness and frequency of testing/feedback. Processes that can be automated should be, and those that can’t should be considered for elimination.
6. Measure, monitor, report and action: For DevSecOps to succeed, software development and post-delivery results must be continuously measured, monitored, reported and acted upon by the right people at the right time.

The CSA DevSecOps Working Group works to create a transparent and full-circle management lifecycle that leverages all the components of DevSecOps to ensure timely and full-functioning application deployment with proper security steps through every process.

Download the the full report https://cloudsecurityalliance.org/artifacts/six-pillars-of-devsecops.