DevSecOps: How to Seamlessly Integrate Security Into DevOps

Table of Contents

• Introduction
• Analysis
  • Security Controls Must Be Programmable and Automated Wherever Possible
  • Use IAM and Role-Based Access Control to Provide Separation of Duties
  • Implement a Simple Risk and Threat Model for All Applications
  • Scan Custom Code, Applications and APIs
  • Scan for OSS Issues in Development
  • Scan for Vulnerabilities and Correct Configuration in Development
  • Treat Scripts/Recipes/Templates/Layers as Sensitive Code
  • Measure System Integrity and Ensure Correct Configuration at Load
  • Use Whitelisting on Production Systems, Including Container-Based Implementations
  • Assume Compromise; Monitor Everything; Architect for Rapid Detection and Response
  • Lock Down Production Infrastructure and Services
  • If Containers Are Used, Acknowledge and Address the Security Limitations
  • Bottom Line
• Gartner Recommended Reading