DevSecOps focuses on breaking down silos between development, security, and operations teams. It aims to optimize workflows through value stream mapping and integrating security checks into existing pipelines without initially enforcing them. This allows teams to shift security left in the development lifecycle through tools like static code analysis, dynamic testing, and infrastructure scanning that help automate assurance.

1. DevSecOps – People & Culture
• Break down the silo; no change here, just like the original DevOps movement
• Not aware of what is going on – likely you are not part of the “DevSecOps” team; leave your
ivory tower and build relationships
• Conduct a Value Stream Mapping exercise to optimize your delivery (rinse and repeat)
• Drill down and sketch out the details of each workflow before solutionising
• Try new checks/controls as part of the pipeline WITHOUT enforcement (initially)

2. IDE Static Code
Analysis
SCM
Dynamic
Analysis
Open Source
Software
Security
Security Testing
Framework
Binary
Repository
Define
Security Test
CasesThreat
Modeling
Security
Standards
Automation
Tools: Passing
Criteria
Risk
Management
Out of Band
Security
Testing
Security
Champions
DevSecOps
Engineer
Security Audit
Artifacts
CI Build Server
DevSecOps – Tooling & Assurance Examples (Shift Left)
curl
nmap
sslyze
sqlmap
Interactive
Testing
Reporting
Dashboard
Infrastructure
Assurance
Threat
Modeling

3. Dev Workstation Build Server
Centralize Report (Vulnerability Management) Server
SCM
Static Code Analysis
(SAST)
Dynamic Testing
(DAST)
Interactive Testing
(IAST)
Open Source Component Security
Manual Penetration Testing – Out of Band
Scope: Application and Network layer – White/Black box
Defect
Management
AUTOMATION
INTEGRATION POINTS
SECURITYASSURANCEMODEL
Legend
Black Box: Development Stack
Blue Box: Automation - Integration
Red Box: Security Tools and Controls
Infrastructure Scanning