DevSecOps Best practices

---

1 - OWASP Top 10

1.1 The 10 risks (2021)

Rank	Risk	Prevention
A01	Broken Access Control	RBAC, AuthZ checks
A02	Cryptographic Failures	TLS, Encryption
A03	Injection	Input validation, parameterized queries
A04	Insecure Design	Threat modeling
A05	Security Misconfiguration	Hardening, scanning
A06	Vulnerable Components	SCA, updates
A07	Identification Failures	MFA, secure auth
A08	Software Integrity Failures	Supply chain security
A09	Logging Failures	Audit logging
A10	SSRF	Input validation, allowlists

1.2 OWASP checklist

owasp_checklist:
  authentication:
    - [ ] MFA enabled
    - [ ] Strong password policy
    - [ ] Secure session management
    - [ ] Account lockout
    
  authorization:
    - [ ] RBAC implemented
    - [ ] Authorization checked server-side
    - [ ] Least privilege principle
    
  data_protection:
    - [ ] Data encrypted at rest
    - [ ] Data encrypted in transit
    - [ ] PII properly handled
    - [ ] Secure key management
    
  input_output:
    - [ ] Input validation
    - [ ] Output encoding
    - [ ] Parameterized queries
    - [ ] Content Security Policy
    
  logging:
    - [ ] Security events logged
    - [ ] No sensitive data in logs
    - [ ] Log integrity protected

---

2 - Security Champions Program

2.1 Structure

2.2 Responsibilities

Responsibility	Description
Training	Train the team on secure practices
Review	Security code review
Triage	Assess vulnerabilities
Advocate	Promote security
Escalation	Escalate issues
Tooling	Configure the tools

2.3 Training

training_curriculum:
  level_1_awareness:
    duration: 4 hours
    topics:
      - OWASP Top 10
      - Secure coding basics
      - Common vulnerabilities
    
  level_2_developer:
    duration: 2 days
    topics:
      - Advanced secure coding
      - SAST/DAST tools
      - Threat modeling
    
  level_3_champion:
    duration: 1 week
    topics:
      - Security architecture
      - Penetration testing basics
      - Incident response
      - Security tooling deep dive

---

3 - Security metrics

3.1 Essential KPIs

Metric	Description	Target
MTTD	Mean Time To Detect	< 24h
MTTR	Mean Time To Remediate	< 7 days (high)
Vulnerability Escape Rate	Vulns in prod / Total	< 5%
Security Debt	Vulns backlog	Decreasing
Coverage	% code scanned	> 90%
False Positive Rate	False positives / Total	< 10%
Security Training	% devs trained	> 90%

3.2 Dashboard

dashboard_sections:
  overview:
    - total_vulnerabilities: 185
    - critical: 0
    - high: 12
    - medium: 45
    - low: 128
    
  trends:
    - new_this_week: 8
    - fixed_this_week: 15
    - average_fix_time: 5.2 days
    
  sla_compliance:
    - critical_24h: 100%
    - high_7d: 95%
    - medium_30d: 88%
    
  coverage:
    - sast_coverage: 95%
    - dast_coverage: 80%
    - container_scan: 100%

---

4 - Secure SDLC

4.1 Security Gates

4.2 Gate Criteria

security_gates:
  development:
    sast:
      critical: 0
      high: 0
      block_on_fail: true
    secrets:
      any_found: block
      
  build:
    sca:
      critical: 0
      high: 5
    container:
      critical: 0
      high: 10
      
  deploy:
    dast:
      critical: 0
      high: 0
    compliance:
      cis_pass: required
      custom_policies: required

---

5 - Automation

5.1 Secure pipeline

# Complete DevSecOps Pipeline
stages:
  - pre-commit
  - build
  - test
  - security
  - deploy

pre-commit:
  stage: pre-commit
  script:
    - gitleaks detect --source .
    - semgrep --config auto --error

build:
  stage: build
  script:
    - npm ci --ignore-scripts
    - npm run build
    - docker build -t $IMAGE .

security-scan:
  stage: security
  parallel:
    matrix:
      - SCAN: [sast, sca, container, iac]
  script:
    - case $SCAN in
        sast) sonar-scanner ;;
        sca) snyk test --severity-threshold=high ;;
        container) trivy image --exit-code 1 --severity HIGH,CRITICAL $IMAGE ;;
        iac) checkov -d ./terraform/ ;;
      esac
  allow_failure: false

dast:
  stage: security
  script:
    - docker-compose up -d
    - zap-baseline.py -t http://app:8080
  needs: [build]

deploy:
  stage: deploy
  script:
    - kubectl apply -f k8s/
  needs: [security-scan, dast]
  only:
    - main

5.2 Auto-remediation

# Dependabot auto-merge for patches
name: Auto-merge Dependabot

on: pull_request

jobs:
  auto-merge:
    runs-on: ubuntu-latest
    if: github.actor == 'dependabot[bot]'
    steps:
      - name: Auto-approve
        uses: hmarr/auto-approve-action@v3
        if: contains(github.event.pull_request.title, 'patch')
        
      - name: Auto-merge
        uses: pascalgn/automerge-[email protected]
        if: contains(github.event.pull_request.title, 'patch')
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          MERGE_METHOD: squash

---

6 - Security culture

6.1 Principles

security_culture:
  principles:
    - Security is everyone's responsibility
    - Fail fast, fix fast
    - No blame, continuous improvement
    - Transparency about vulnerabilities
    
  practices:
    - Weekly security office hours
    - Bug bounty program
    - Security retrospectives
    - Recognition for security fixes

6.2 Gamification

Badge	Criterion
🛡️ Security Champion	Full certification
🔍 Bug Hunter	10 vulns found
⚡ Quick Fixer	Fix < 24h
📚 Knowledge Sharer	5 trainings delivered

---

7 - Production Checklist

## Pre-Production Security Checklist

### Code Security
- [ ] SAST scan passed (0 critical/high)
- [ ] No hardcoded secrets
- [ ] Input validation implemented
- [ ] Output encoding implemented

### Dependencies
- [ ] SCA scan passed
- [ ] No known critical vulnerabilities
- [ ] Dependencies up to date
- [ ] SBOM generated

### Infrastructure
- [ ] IaC scan passed
- [ ] Least privilege configured
- [ ] Network segmentation
- [ ] Encryption enabled

### Authentication
- [ ] MFA enabled
- [ ] Strong password policy
- [ ] Session management secure

### Monitoring
- [ ] Security logging enabled
- [ ] Alerts configured
- [ ] SIEM integrated

### Documentation
- [ ] Security architecture documented
- [ ] Runbooks available
- [ ] Incident response plan ready

---

Summary

In this chapter, we covered:

• The OWASP Top 10 and its preventions
• The Security Champions program
• Security metrics
• The Secure SDLC and gates
• Check automation
• Security culture

---

Next step

In the next chapter, we will put things into practice with Exercises and Projects.

→ Next chapter: Exercises and Projects

---

← Back to table of contents