Introduction to DevSecOps
1 - What is DevSecOps?
DevSecOps = Development + Security + Operations
The integration of security into every stage of the software development lifecycle.
2 - DevOps vs DevSecOps
2.1 The evolution
Traditional approach - Security at the end of the cycle:
DevOps approach - Security often forgotten:
DevSecOps approach - Integrated security:
2.2 Comparison
| Aspect | DevOps | DevSecOps |
|---|---|---|
| Focus | Speed & Collaboration | Integrated security |
| Security | At the end of the cycle | At every stage |
| Responsibility | Security team | Everyone |
| Tests | Functional | Functional + Security |
| Compliance | Manual | Automated |
3 - Why DevSecOps?
3.1 The cost of vulnerabilities
Earlier = Cheaper
3.2 Statistics
| Fact | Statistic |
|---|---|
| Vulnerabilities in prod | 70% avoidable with Shift Left |
| Average cost of a breach | $4.35 million (2022) |
| Average detection time | 287 days |
| Open source vulnerabilities | 84% of codebases affected |
4 - The pillars of DevSecOps
4.1 Security by Design
principles:
- Defense in Depth
- Least Privilege
- Fail Secure
- Zero Trust
- Separation of Concerns
4.2 Automation First
4.3 Continuous Security
| Phase | Activities |
|---|---|
| Plan | Threat modeling, Security requirements |
| Code | SAST, Secrets scanning, Code review |
| Build | SCA, Container scanning |
| Test | DAST, Penetration testing |
| Deploy | Config scanning, Compliance |
| Operate | Runtime protection, Monitoring |
| Monitor | SIEM, Incident response |
5 - Roles and responsibilities
5.1 Security Champions
Role of the Security Champion:
- Security point of contact
- Team training
- Security code review
- Escalation of issues
5.2 RACI matrix
| Activity | Dev | Security | Ops | Champion |
|---|---|---|---|---|
| Security code review | R | C | I | A |
| SAST configuration | I | R | C | A |
| Incident response | I | R | C | I |
| Security training | I | R | I | A |
R=Responsible, A=Accountable, C=Consulted, I=Informed
6 - DevSecOps tools
6.1 Overview
| Category | Tools |
|---|---|
| SAST | SonarQube, Semgrep, CodeQL |
| DAST | OWASP ZAP, Burp Suite |
| SCA | Snyk, Dependabot, OWASP Dependency-Check |
| Container | Trivy, Anchore, Clair |
| IaC | Checkov, tfsec, Terrascan |
| Secrets | GitLeaks, TruffleHog, detect-secrets |
| Runtime | Falco, Sysdig, Aqua |
| Secrets Mgmt | Vault, AWS Secrets Manager |
6.2 Sample pipeline
# .github/workflows/devsecops.yml
name: DevSecOps Pipeline
on: [push, pull_request]
jobs:
security-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
# Secrets scanning
- name: GitLeaks
uses: gitleaks/gitleaks-action@v2
# SAST
- name: SonarQube
uses: sonarsource/sonarqube-scan-action@master
# SCA
- name: Snyk
uses: snyk/actions/node@master
with:
args: --severity-threshold=high
# Container scanning
- name: Trivy
uses: aquasecurity/trivy-action@master
with:
scan-type: 'fs'
severity: 'CRITICAL,HIGH'
7 - DevSecOps metrics
7.1 Essential KPIs
| Metric | Description | Target |
|---|---|---|
| MTTD | Mean Time To Detect | < 24h |
| MTTR | Mean Time To Remediate | < 7 days |
| Vulnerability Escape Rate | Vulns in prod | < 5% |
| Security Debt | Unfixed vulns | Decreasing |
| Coverage | Code scanned | > 90% |
7.2 Dashboard
dashboard_metrics:
- vulnerabilities_by_severity:
critical: 0
high: 12
medium: 45
low: 128
- trends:
new_vulns_this_week: 8
fixed_this_week: 15
backlog: 185
- sla_compliance:
critical_within_24h: 100%
high_within_7d: 95%
Summary
In this chapter, we discovered:
- The definition of DevSecOps
- The differences with DevOps
- The fundamental pillars
- The roles and responsibilities
- The essential tools
- The metrics to track
Next step
In the next chapter, we will look at Shift Left Security.
→ Next chapter: Shift Left Security