Cloud 101CircleEventsBlog
Register for CSA's AI Summit at RSAC on May 6!

Research Topic

DevSecOps

Six Pillars of DevSecOps
Six Pillars of DevSecOps

Download

DevSecOps
With Digital Transformation firmly underway, software has rapidly risen as one of the top causes of business risk and exploitation. As a result of the rapid increase of the volume and pace of application development and delivery, the number and complexity of attacks on applications have also multiplied. The shortage of personnel with appropriate and adequate security skills and resources has become more acute than ever. 

In our current state of cyber security, there has been a large growth of application flaws that bypass the continuing addition of security frameworks to ensure overall health of a project life cycle. Reducing the complexity during development cycles as well as being given the resources to build a trusted environment are key to future success. This is where DevSecOps takes shape. 

What is DevSecOps?
Businesses are now requiring a stronger collaboration between the development, security and operational functions. This addition of security creates DevSecOps. In the past, the security needs were either skipped or only addressed after the deployment of applications, or worse after security vulnerabilities were exploited. Such an approach increased risks to the deployment and contributed towards a more hostile relationship between security and the development and operations teams. DevSecOps focuses on creating a transparent and holistic management approach. By addressing cultural changes within the work force and adhering to a new combination of tactics, security can become a functioning part across all life cycles and developments.

How is CSA addressing the challenges for DevSecOps?
With DevSecOps still in its infancy, there are still questions surrounding how it should be structured. CSA is working to provide best practices and guidance to help organizations effectively implement DevSecOps. To start learning about integrating security into DevOps download the Six Pillars of DevSecOps


DevSecOpsApplication Containers and Microservices

Cloud Security Research for DevSecOps

CSA Research crowd-sources the knowledge and expertise of security experts and helps address the challenges and needs they’ve experienced, or seen others experience, within the cybersecurity field. Each publication is vendor-neutral and follows the peer review process outlined in the CSA Research Lifecycle. We recommend getting started by reading the following documents.

The Six Pillars of DevSecOps: Collective Responsibility

The Six Pillars of DevSecOps: Collective Responsibility

This paper focuses on the area of DevSecOps that is arguably the foundation for all others – collective responsibility. Fostering a sense of collective security responsibility is not only an essential element of driving security into a DevOps environment, but it is also one of the most challenging. It requires cultivating a change to the organization’s mindset, its ideas and its customs and behaviors regarding software security. While much has been written on the need to nurture a security-supportive culture, it remains one of the most consistently cited challenges of DevSecOps execution. Culture is something most often described as a critical but intangible element of an organization. Unfortunately, this may lead to a rather ad hoc approach to fostering cultural change such as an occasional hackathon, bug bash, or annual training session. Introducing security at the beginning of a cycle with the proper knowledge and training can help avoid the need...

Information Security Management through Reflexive Security

Information Security Management through Reflexive Security

Organizations are under strong pressure to streamline information security management processes. The age-old problem of resource limitations is exacerbated -- the tradition of information security management systems (ISMS) is seemingly too rigid in structure, yet inadequate in responsiveness to new needs. DevOps is now broadly practiced but it has been generally separated from security practices. There is currently no standardized term in industry that caters to this aspect. This document defines “Reflexive Security” as a new security management approach that is built upon the interrelationships between security, development and operations necessary for protecting the security stance and the deliverables of an organization. The target audience of this document includes the C-suite (CISO, CIO, CTO, CRO, COO, CEO), and especially to the individuals involved in the following functional areas: automation, DevOps, quality assurance, InfoSec, governance, ...

Six Pillars of DevSecOps

Six Pillars of DevSecOps

How can you integrate continuous security principles, processes, and technology into DevOps culture, practices, and workflows? This document defines the six focus areas of DevSecOps critical to implementing and integrating DevSecOps into an organization. The DevSecOps pillars provided in this document are meant to provide a holistic framework that blends the traditionally siloed operations: development, infrastructure operations, and information security, into a cohesive group that facilitates creation of secure software. In this document you will be introduced to concepts you can apply to your own environments. There will be six separate playbooks to follow alongside the original six pillars document that will go in depth on the details of how to correctly implement a DevSecOps culture that will bring to light the importance of all teams focusing on security and making it a priority.

Webinars

Reducing the Attack Surface in the Cloud
Reducing the Attack Surface in the Cloud

October 14 | Online

Learn more

Impact of Digital Transformation on Security Strategy
Impact of Digital Transformation on Security Strategy

October 28 | Online

Learn more

Security-as-Code:  What's Real and What's Possible with Self-Service and Developer Speed Governance
Security-as-Code: What's Real and What's Possible with Self...

October 26 | TBD

Learn more

Key Considerations to Get Buy-in for a SaaS Data Security Program
Key Considerations to Get Buy-in for a SaaS Data Security Pr...

November 3 | Online

Learn more

Blog Posts

Innovating Without Stagnating: Strategies for Security Remediation in 2024
What are Non-Human Identities?
Implementing DevSecOps: Some Practical Considerations for CISOs