DevSecOps

The name combines development, security, and operations. DevOps set out to remove the silos between development and operations groups, and the term DevSecOps was later coined to emphasize the role of the security team in the whole process. It aims at collaboration, trust, shared responsibility, transparency, and automation among the people who deliver software.

DevSecOps moves from one large release of an entire application to continuous integration, continuous delivery, and continuous deployment (CI/CD). CI/CD pipelines are workflows that take a developer's source code through stages such as building, testing, packaging, delivery, and deployment, aided by automated tools. The shift also changes how an IT department is organized: one approach groups software developers, security specialists, and IT operations experts into a team for each part of the application.

Security checks run throughout the pipeline. During build and deployment, security testing tools such as SAST, DAST, and software composition analysis (SCA) test the software, and during runtime, continuous behavior detection and prevention tools provide assurance. The goal is to detect security issues, whether design flaws or application vulnerabilities, as early and as cheaply as possible and to keep detecting them continuously, which is often called shift-left security.

The CI/CD tools that provide this automation often expand the attack surface themselves, so the build, deployment, and automation software needs its own security controls.