Initially, development and operations were conducted separately by teams. There was no communication between both teams. A lack of alignment and trust would create conflicts. The result was a poor-quality application that disappoints customers. Eventually, Development and Operation teams started working together. Both set common goals, use common tools, and have common understandings. Teams focus on automating the process that helps to deliver faster and good quality software. That is DevOps which became popular in the market.

Developing an application with the latest features which meet real customers’ needs. But what if security issues like cyber-attack occur? It will harm customers badly. Even the company will be wasting too much time and money to find and fix the vulnerabilities exploited. That is the drawback of DevOps. Hence Security of the application is most important. It can be achieved by integrating and automating open-source vulnerability checks towards the application life cycle. This improves security faster and spreads responsibility across needs making the application easier and more reliable. Thus, DevSecOps put security at the center of DevOps.

What is DevSecOps?

DevSecOps is a management approach in application security (AppSec) that involves introducing security earlier in the software development life cycle (SDLC). It also expands the collaboration between development and operations teams to integrate security teams in the software delivery cycle. The goal of DevSecOps is to promote the fast development of a secure codebase.

How to create DevSecOps framework?

There are 4 Basic steps that can be followed in order to create DevSecOps Framework.

• Planning and Design
• Coding and Code Management
• Testing
• Deployment and operation

1. How Security is achieved in Planning and Design phase?
• In this phase Coding standards are created and peer reviews are conducted, A team designs a consistent set of coding standards using which code be prevented from vulnerabilities. In Peer review, It is verified that coding standards are met or not which helps to find common programming errors.
• Security plugins for Integrated Development Environments (IDE) are also used. It is used by developers for static code analysis before any code is committed in the repository.
• Conduct Threat Modeling-Here developers consider possible potential abuses of the application, different ways to prevent those abuses ,and how to prioritize them in application design goal.
2. How coding and code management is done in DevSecOp to ensure security?

There are 3 techniques to ensure security in code commit and management

• Manage securities in dependencies- While using external code like libraries, or reused modules, Developer should check its security and authenticity. Also ensure that its latest version is used for each project.
• Scan code and repositories –Repository scanning tools can be used to perform static analysis of code to commit before build execution, vulnerability testing. Repository scanning is useful for safety of repository which is accessed by larger team.
• Secure the development pipeline- organizations should implement and review security controls within their development pipelines.
• If security issue is raised, Pipeline prevents code commits to repository until that issue is resolved.
3. What are the common test considerations for a DEvSecOp?
• Testing should detect application flaws and security issues.
• common test considerations are as follows
• Integrate dynamic application security testing (DAST) –DAST and penetration testing are last step in development cycle. It helps to build test regimen within the pipeline. Full DAST and other dynamic vulnerability testing, such as security acceptance testing, can be time-consuming, but lighter test regimens are an option that can yield faster results while identifying issues missed in static testing.
• Secure the infrastructure – DevSecOps security considerations should go beyond the application itself to include the deployment environment, whether local or cloud infrastructure. Consider implementing policy-driven VMs, containers and Kubernetes clusters. Tools such as Microsoft Azure Policy and AWS Organizations enforce security-driven policies on cloud infrastructures.
4. How devSecOps are practiced in the deployment and operation phase?

Following are some ways used in the deployment and operation phase.

• Configuration management-DevSecOps framework should have Tools that monitor and enforce an infrastructure configuration. E.g., Microsoft Defender for Cloud and Microsoft Sentinel.
• Intrusion detection and behavioural analytics –Analytics tools, including intrusion detection and prevention systems, establish baselines in traffic patterns and performance and then look for anomalies indicative of suspicious or malicious activity in the workload or network. Such tools are well established and should be embraced by organizations adopting DevSecOps.
• Ongoing security testing –Testing process including DASt , pen testing, fuzz testing etc should be conducted periodically or whenever teams suspects code has new weakness.
• Alerting and reporting – Security tools and policies must be paired with comprehensive alerting and reporting.
• Post-mortems –When a security incident occurs, it is important to conduct blameless post-mortems. Teams should work to identify and remediate the issue and then use the experience to tune future development and operational efforts to prevent subsequent issues.