Businesses are now requiring a stronger collaboration between the development, security and operational functions. This addition of security creates DevSecOps. In the past, the security needs were either skipped or only addressed after the deployment of applications, or worse after security vulnerabilities were exploited. Such an approach increased risks to the deployment and contributed towards a more hostile relationship between security and the development and operations teams. DevSecOps focuses on creating a transparent and holistic management approach. By addressing cultural changes within the work force and adhering to a new combination of tactics, security can become a functioning part across all life cycles and developments.
With DevSecOps still in its infancy, there are still questions surrounding how it should be structured. CSA is working to provide best practices and guidance to help organizations effectively implement DevSecOps. To start learning about integrating security into DevOps download the Six Pillars of DevSecOps.
Cloud Security Research for DevSecOps
CSA Research crowd-sources the knowledge and expertise of security experts and helps address the challenges and needs they’ve experienced, or seen others experience, within the cybersecurity field. Each publication is vendor-neutral and follows the peer review process outlined in the CSA Research Lifecycle. We recommend getting started by reading the following documents.
Information Security Management through Reflexive Security
Organizations are under strong pressure to streamline information security management processes. The age-old problem of resource limitations is exacerbated -- the tradition of information security management systems (ISMS) is seemingly too rigid in structure, yet inadequate in responsiveness to new needs. DevOps is now broadly practiced but it has been generally separated from security practices. There is currently no standardized term in industry that cater to this aspect. This document defines “Reflexive Security” as a new security management approach that is built upon the interrelationships between security, development and operations necessary for protecting the security stance and the deliverables of an organization. The target audience of this document includes the C-suite (CISO, CIO, CTO, CRO, COO, CEO), and especially to the individuals involved in the following functional areas: automation, DevOps, quality assurance, InfoSec, governance, r...
Six Pillars of DevSecOps
How can you integrate continuous security principles, processes, and technology into DevOps culture, practices, and workflows? This document defines the six focus areas of DevSecOps critical to implementing and integrating DevSecOps into an organization.The DevSecOps pillars provided in this document are meant to provide a holistic framework that blends the traditionally siloed operations: development, infrastructure operations, and information security, into a cohesive group that facilitates creation of secure software. In this document you will be introduced to concepts you can apply to your own environments. There will be six separate playbooks to follow alongside the original six pillars document that will go in depth on the details of how to correctly implement a DevSecOps culture that will bring to light the importance of all teams focusing on security and making it a priority.
The Six Pillars of DevSecOps: Collective Responsibility
This paper focuses on the area of DevSecOps that is arguably the foundation for all others – collective responsibility. Fostering a sense of collective security responsibility is not only an essential element of driving security into a DevOps environment, but it is also one of the most challenging. It requires cultivating a change to the organization’s mindset, its ideas and its customs and behaviors regarding software security. While much has been written on the need to nurture a security-supportive culture, it remains one of the most consistently cited challenges of DevSecOps execution. Culture is something most often described as a critical but intangible element of an organization. Unfortunately, this may lead to a rather ad hoc approach to fostering cultural change such as an occasional hackathon, bug bash, or annual training session. Introducing security at the beginning of a cycle with the proper knowledge and training can help avoid the need...
|Level up: The importance of security certification for startups when dealing with global enterprises||ITProPortal||February 12, 2021|
|Infosec Teams Expand Use of Security Tools to Address Cloud Complexity, Survey Finds||InfoQ||April 20, 2021|
|Only 30% of Orgs Fully Implement DevSecOps||DevOps.com||December 22, 2021|