Cloud 101

Research Topic


Latest ResearchWorking Group
Six Pillars of DevSecOps
Six Pillars of DevSecOps


With Digital Transformation firmly underway, software has rapidly risen as one of the top causes of business risk and exploitation. As a result of the rapid increase of the volume and pace of application development and delivery, the number and complexity of attacks on applications have also multiplied. The shortage of personnel with appropriate and adequate security skills and resources has become more acute than ever. 

In our current state of cyber security, there has been a large growth of application flaws that bypass the continuing addition of security frameworks to ensure overall health of a project life cycle. Reducing the complexity during development cycles as well as being given the resources to build a trusted environment are key to future success. This is where DevSecOps takes shape. 

What is DevSecOps?
Businesses are now requiring a stronger collaboration between the development, security and operational functions. This addition of security creates DevSecOps. In the past, the security needs were either skipped or only addressed after the deployment of applications, or worse after security vulnerabilities were exploited. Such an approach increased risks to the deployment and contributed towards a more hostile relationship between security and the development and operations teams. DevSecOps focuses on creating a transparent and holistic management approach. By addressing cultural changes within the work force and adhering to a new combination of tactics, security can become a functioning part across all life cycles and developments.

How is CSA addressing the challenges for DevSecOps?
With DevSecOps still in its infancy, there are still questions surrounding how it should be structured. CSA is working to provide best practices and guidance to help organizations effectively implement DevSecOps. To start learning about integrating security into DevOps download the Six Pillars of DevSecOps

DevSecOpsApplication Containers and Microservices

Discuss this topic in Circle

Have an interesting article or video on this topic that you want to share? Anyone can join the discussion community for this topic to share ideas or ask questions.

View discussion community

Participate in DevSecOps Research

This group defines best practices and provides guidance and playbooks to help teams implement security into their DevOps process.

View the working group

View all

Cloud Security Research for DevSecOps

CSA Research crowd-sources the knowledge and expertise of security experts and helps address the challenges and needs they’ve experienced, or seen others experience, within the cybersecurity field. Each publication is vendor-neutral and follows the peer review process outlined in the CSA Research Lifecycle. We recommend getting started by reading the following documents.

Information Security Management through Reflexive Security

Information Security Management through Reflexive Security

Organizations are under strong pressure to streamline information security management processes. The age-old problem of resource limitations is exacerbated -- the tradition of information security management systems (ISMS) is seemingly too rigid in structure, yet inadequate in responsiveness to new needs. DevOps is now broadly practiced but it has been generally separated from security practices. There is currently no standardized term in industry that caters to this aspect. This document defines “Reflexive Security” as a new security management approach that is built upon the interrelationships between security, development and operations necessary for protecting the security stance and the deliverables of an organization. The target audience of this document includes the C-suite (CISO, CIO, CTO, CRO, COO, CEO), and especially to the individuals involved in the following functional areas: automation, DevOps, quality assurance, InfoSec, governance, ...

Six Pillars of DevSecOps

Six Pillars of DevSecOps

How can you integrate continuous security principles, processes, and technology into DevOps culture, practices, and workflows? This document defines the six focus areas of DevSecOps critical to implementing and integrating DevSecOps into an organization. The DevSecOps pillars provided in this document are meant to provide a holistic framework that blends the traditionally siloed operations: development, infrastructure operations, and information security, into a cohesive group that facilitates creation of secure software. In this document you will be introduced to concepts you can apply to your own environments. There will be six separate playbooks to follow alongside the original six pillars document that will go in depth on the details of how to correctly implement a DevSecOps culture that will bring to light the importance of all teams focusing on security and making it a priority.

The Six Pillars of DevSecOps: Collective Responsibility

The Six Pillars of DevSecOps: Collective Responsibility

This paper focuses on the area of DevSecOps that is arguably the foundation for all others – collective responsibility. Fostering a sense of collective security responsibility is not only an essential element of driving security into a DevOps environment, but it is also one of the most challenging. It requires cultivating a change to the organization’s mindset, its ideas and its customs and behaviors regarding software security. While much has been written on the need to nurture a security-supportive culture, it remains one of the most consistently cited challenges of DevSecOps execution. Culture is something most often described as a critical but intangible element of an organization. Unfortunately, this may lead to a rather ad hoc approach to fostering cultural change such as an occasional hackathon, bug bash, or annual training session. Introducing security at the beginning of a cycle with the proper knowledge and training can help avoid the need...


Hands-on in Supply Chain Security with SLSA, CIS Benchmark and other tools
Hands-on in Supply Chain Security with SLSA, CIS Benchmark a...

October 27 | Online

Learn more

How Does Your Cloud Security Compare, and Where Do You Go From Here?
How Does Your Cloud Security Compare, and Where Do You Go Fr...

October 25 | Online

Learn more

Automatically Prioritize Vulnerabilities Using Runtime Intelligence
Automatically Prioritize Vulnerabilities Using Runtime Intel...

July 19 | online

Learn more

Combating Ransomware 2.0: Beyond Backups
Combating Ransomware 2.0: Beyond Backups

June 28 | online

Learn more

Blog Posts

Altruism in Information Security? (Part 1 of 3)
2022 Threat Report: Cloud-Native Threats are Increasing and Maturing
A Practical Guide to Container Networking