Research Topic
DevSecOps
Six Pillars of DevSecOps
Discuss this topic in Circle
View discussion community
Participate
| Press Mention | Source | Date |
|---|---|---|
| New Guidelines From Cloud Security Alliance and SAFECode Help DevSecOps Teams Translate Security and Compliance Requirements Into the Development Cycle | StreetInsider | February 11, 2022 |
| Cloud Security Alliance publishes guidelines to bridge compliance and DevOps | Computer Weekly | February 16, 2022 |
| The 6 Pillars of DevSecOps: Pillar One-Collective Responsibility | DevOps | April 06, 2022 |
| The VC View: The DevSecOps Evolution and Getting "Shift Left" Right | Security Week | May 02, 2022 |
| How DevSecOps Empowers Citizen Developers | Dark Reading | August 26, 2022 |
Cloud Security Research for DevSecOps
CSA Research crowd-sources the knowledge and expertise of security experts and helps address the challenges and needs they’ve experienced, or seen others experience, within the cybersecurity field. Each publication is vendor-neutral and follows the peer review process outlined in the CSA Research Lifecycle. We recommend getting started by reading the following documents.
The Six Pillars of DevSecOps: Collective Responsibility
This paper focuses on the area of DevSecOps that is arguably the foundation for all others – collective responsibility. Fostering a sense of collective security responsibility is not only an essential element of driving security into a DevOps environment, but it is also one of the most challenging. It requires cultivating a change to the organization’s mindset, its ideas and its customs and behaviors regarding software security. While much has been written on the need to nurture a security-supportive culture, it remains one of the most consistently cited challenges of DevSecOps execution. Culture is something most often described as a critical but intangible element of an organization. Unfortunately, this may lead to a rather ad hoc approach to fostering cultural change such as an occasional hackathon, bug bash, or annual training session. Introducing security at the beginning of a cycle with the proper knowledge and training can help avoid the need...
Information Security Management through Reflexive Security
Organizations are under strong pressure to streamline information security management processes. The age-old problem of resource limitations is exacerbated -- the tradition of information security management systems (ISMS) is seemingly too rigid in structure, yet inadequate in responsiveness to new needs. DevOps is now broadly practiced but it has been generally separated from security practices. There is currently no standardized term in industry that caters to this aspect. This document defines “Reflexive Security” as a new security management approach that is built upon the interrelationships between security, development and operations necessary for protecting the security stance and the deliverables of an organization. The target audience of this document includes the C-suite (CISO, CIO, CTO, CRO, COO, CEO), and especially to the individuals involved in the following functional areas: automation, DevOps, quality assurance, InfoSec, governance, ...
Six Pillars of DevSecOps
How can you integrate continuous security principles, processes, and technology into DevOps culture, practices, and workflows? This document defines the six focus areas of DevSecOps critical to implementing and integrating DevSecOps into an organization. The DevSecOps pillars provided in this document are meant to provide a holistic framework that blends the traditionally siloed operations: development, infrastructure operations, and information security, into a cohesive group that facilitates creation of secure software. In this document you will be introduced to concepts you can apply to your own environments. There will be six separate playbooks to follow alongside the original six pillars document that will go in depth on the details of how to correctly implement a DevSecOps culture that will bring to light the importance of all teams focusing on security and making it a priority.
Webinars
