Skip to main content

9. DevSecOps - Security Embedded into DevOps

DevSecOps means integrating security into every stage of the DevOps pipeline. Instead of treating security as a separate step at the end, DevSecOps makes security a shared responsibility of everyone Developers, Operations, QA, and Security teams.

> DevSecOps = Development + Security + Operations working together.

15.1 Key security practices​

1. Automated security scanning​

Running security checks automatically during coding, building, and deploying.

  • Finds vulnerabilities early.

  • Saves time.

  • Reduces manual effort.

  • Prevents insecure code from reaching production.

Examples of scans: –

  • Code vulnerability scan

  • Container image scan

  • Dependency scan

> Automation makes security continuous, not a one-time event.

--

2. Static & Dynamic analysis​

Static Analysis (SAST): – Scans the source code before running the application.

**Dynamic Analysis (DAST): – **Tests the running application to find runtime issues like SQL injection, authentication bugs, etc.

> Why both are important: –

> > > >

> - Static analysis catches coding errors early

> > > > - Dynamic analysis finds real-world attack risks

>

> > > > Combined, they give strong coverage.

--

3. SBOM – Software Bill of Materials​

A detailed list of all components inside your software libraries, dependencies, open-source packages.

  • Helps track vulnerable libraries.

  • Essential for compliance.

  • Useful during zero-day attacks.

  • Gives full visibility of what you’re running.

> SBOM is becoming a global security requirement.

--

4. Secrets Management​

Secure handling of sensitive data like passwords, API keys, tokens, and certificates.

  • Prevents secrets from leaking in code.

  • Protects cloud accounts and databases.

  • Ensures safe access across environments.

Good practices: –

  • Do not store secrets in Git.

  • Use secret management tools.

  • Rotate secrets regularly.

> Secrets must be protected like gold.

--

5. Least Privilege Access​

Give only the minimum access needed to perform a task nothing more.

  • Reduces damage if an account is compromised.

  • Protects sensitive environments.

  • Prevents misuse of admin rights.

> Least privilege is the foundation of secure access management.

--

6. Continuous Threat Modelling​

Identify possible threats, attack paths, and vulnerabilities early in the design phase.

  • Teams think like attackers.

  • Problems are found early.

  • Improves security design.

  • Prevents future risks.

> Threat modelling is not a one-time activity it must be continuous.

--

7. Shift-Left Security Checks​

Perform security checks early at coding, planning, and building stages, not after development ends.

  • Fix issues when they are cheap to fix

  • Improves overall quality

  • Reduces last-minute delays

  • Avoids security becoming a blocker

> Shift-left = security starts on Day 1.

--

8. Runtime protection​

Security protections running in live production environments.

  • Detects real-time attacks.

  • Blocks suspicious activity.

  • Protects APIs, containers, and cloud workloads.

Examples: –

  • Runtime firewalls.

  • Intrusion detection.

  • Behaviour analysis.

  • Automated response.

> Runtime protection shields your application from real-world threats.

Key principles include:

  • Automate security everywhere

  • Scan code, dependencies, and containers

  • Protect secrets

  • Use least privilege

  • Do continuous threat modelling

  • Shift-left security

  • Add runtime protection

  • Make security a shared responsibility