DEVELOPMENT DevSecOps Security Controls
SPRINT
1
Secure by Design
Secure code
2 8
training Gather threat and abuse
case models and
Engineers gain
security requirements.
knowledge and
awareness of
Adopt reusable
Secure-by-default
AppSec principles design patterns.
and responsibilities.
Pre-commit
3 configuration for
secret scanning
SPRINT
Secure access
to app. code &
image repository
Implement least
privilege RBAC and n/w
isolation to code and
private container
repository.
Infrastructure as code
version controlled.
Secure access to
4 CI service
Prevent unauthorised
GATES manipulation of the
pipeline itself with RBAC
Automated and separation of
duties.
Sign-off
SPRINT
www.accelera.com.au/DevSecOps
OPERATIONS
SPRINT
Security Tests Infrastructure &
Application
14
DAST: Perform App
specific automated 13 Protection Data Protection
CI Server Apply infrastructure
security testing and Protect and monitor
hardening, data
7 deploys to test dynamic container
analysis.
the app and cluster
using RASP/WAF
encryption endpoint
Automated protection, DLP and IPS.
Validate controls are and container
deployment via sand-boxing
Infrastructure as Code mitigating the abuse
case threat vectors.
Composition Security review
Privileged access,
6 Analysis 9 human logic test
12 secrets Vulnerability
Analyse Third
Conduct Penetration
testing where it management & 15 scanning
Party/Open Source network isolation
makes sense. (Might Ensure continuous
libraries. Reuse secure
not be needed for Implement tight assessment & automated
code only and comply
every sprint). network & access CIS benchmarking of build
with OSS licensing.
policy, by locking down and deployed images and
clusters/pods/VMs. environments.
Use secrets
management and Continuous monitoring
automated certificate
& Incident Response
Image Assurance
handling. 16
Analyse intrusion / breach alerts
10 and threat intelligence. Log
Code Analysis
Validate image integrity
signatures, and that Deploy to attacks, behaviours and threats,
assurance policies are 11 Production to respond, learn from, and apply
5 SAST: Analyse code for met to proceed to prod. Automated
to next sprint.
vulnerabilities. IDE and
deployment by
build server integrated
Infrastructure as Code. IaC
Rinse & Repeat
with remediation
compliance and security Improve and enforce
advice.
testing. governance.
17
SECURITY v1.0 - Sep 2020
©Copyright 2020 - Accelera Group Pty Ltd