What is DevSecOps?

Is basically a security enabled DevOps. It is an early integration of security culture, tools and
practices into each phase of development and operations process

Implementing Shift Left approach

Plan  Code Build Deploy  Monitor and Operate

The whole emphasis is about how to bring security as part of Dev Sec Ops.

In short to say bring Dev Security and operations teams together and bringing the culture and
mindset for developers to have security first when they develop the code. To bring security to bring
from far right of the pipeline to let of the pipeline (Meaning to bring security to the initial stage of
SDLC).

The developer can fix the vulnerabilities much earlier with very minimal cost.

1. Install IDE security tools plugin (Greenlight in Veracode, Code sight)

2. Push the code to Source code repository (GitHub, TFS)
3. Build Trigger. We will create a job in Jenkins to pull the code from SCM and store it in local
server.
4. We will integrate the SCA tool (Fortify, Veracode) to Jenkins and initiate the static scans.
5. Check for vulnerabilities report and push the code to QA or Dev env.
6. After successful post build. Now integrate the DAST tool to scan the URL or API of the given
application.

Advantages of DevSecOps

 Spot Vulnerabilities and Bugs early.

 Leverage usage of Open Source components
 Save Costs on resource Management
 Making developers security aware

Pre build – We perform SAST

Post Build – We perform DAST

Important tool of DevSecOps is CICD (Continuous integration and Continuous Delivery) solution.
Plan and develop – capability that allows user stories, planning sprints and coding, source code
repository GitHub.

Build

Shift Left Approach

Plan  Code Build Deploy  Monitor and Operate

The whole emphasis is about how to bring security as part of Dev Sec Ops.

In short to say bring Dev Security and operations teams together and bringing the culture and
mindset for developers to have security first when they develop the code. To bring security to bring
from far right of the pipeline to let of the pipeline (Meaning to bring security to the initial stage of
SDLC).

The developer can fix the vulnerabilities much earlier with very minimal cost.

The main concept is to automate the whole pipeline with security integration.

Two main terms SAST & DAST