Level 5 DevSecOps Reference Architecture

Last Modified: January 16, 2020

Last Modified By: DJ Schleen

Legend
Threat Detected
Neutralize
Security

Product Architect
Manual Developer

SRE
Automated

Executives Internal Threat

Business Actor

Green Deploy Environment

Supply Chain

Secret Store Secret Store Secret

Secret Management Injection Secret Secret Secret
Injection Injection Injection

Observation
Deployment
Iterate
Notifications Development IntegrationContent Trust Delivery AppStore / Play
Out of Band Production 

Continuous Education Production

Commit TestFlight
Database (DaC) OSSM SCA MTD
DAST Play Beta Threat
Binary Mobile Testing Actor
Scramble
Iterate
Work Item Backlog OSSM
Build SBoM Sign Production DAST
Tracking Commit Production
Message Test Case OSSM SCA PR Package Sign Deploy (Live)
Coding (Live)
--------- Line indicates Blue/Green Lifecycle

Alert Idea Work Item Threat Design Architecture OSSM Sign SAST Integration Sign CVA Sign Customers
Commit Sign Repository
DAST Sign Policy Sign
Promotion Production Chaos
Model Infrastructure OSSM SCA Test Automated Check
as Code Experiments
(Iac) Tests Signatures
Trigger

repository
OSSM SAST Configuration Dark/Canary Business
Open Source Commit Out of Band Database "Staging"
Application OSSM SCA Injection Deployment Acceptance

lifecycle
Repository Migration Testing
Green
(Live)
Deployment Data Stakeholder
Flow Interest
Based on
Third Party OSSM Speed
(Vendors)
Secret Flow Customer / Business
Visible Deployment Customers

Docker OSSM
Registry

lifecycle
firewall

Ethical Hacking Continued Ethical

Hacking and Penetration
Testing

Red, Blue, and

Purple Teams

Continuous
Observation

Threat Detected
Automated Notifications Data Science Bring the Chaos

Data Check
Third Party Security Compliance Governance Science Sign
Risk
Security
Data Security Investigation Operations
Aggregation Models and Forensics Center
(SOC)
Continuous
Education

Stage Duration Stage Lag

DRAG

Stage Detail