DevSecOps
What is DevSecOps?
The practice of integrating security practices within the DevOps process. DevSecOps ensures that security is a shared responsibility throughout the entire software development and deployment lifecycle.
Terms that appear alongside devsecops
Each of these is named in at least one of the same controls as devsecops. The number is how many controls name both.
- governance 7 shared controls
- compliance 6 shared controls
- vulnerability 5 shared controls
- audit 5 shared controls
- owasp 4 shared controls
- secure coding 4 shared controls
- risk assessment 4 shared controls
- penetration testing 4 shared controls
Frameworks that govern devsecops
What the standards actually require on devsecops
Requirements naming devsecops across 6 standards, quoted from the control text.
Where DevSecOps integrates security objectives and controls into DevOps, management automates, monitors and applies security at every phase with automated unit testing, code analysis and image scanning, gives cybersecurity and design the same priority as in tr...
ffiec-it-examination-handbook::DAM-V.C.2 · V.C.2 DevSecOps (Development, Acquisition, and Maintenance) →DevSecOps automates and integrates IT operations, quality assurance and security in software development through continuous integration and delivery.
monetary-authority-of-singapore-technology-risk-management-guidelines::6.3 · 6.3 DevSecOps Management →HKMA TM-G-1 IT Strategy + Policies + Risk + Development + Change. (1) IT STRATEGY AND PLANNING (TM-G-1.3.1) - documented + Board-approved IT strategy aligned with business strategy + risk appetite + technology innovation + customer experience + investment plan...
HKMA-TMG1-Strategy-Policies-RiskAssessment-Dev-Change · TM-G-1 IT Strategy + Policies + Risk Assessment + Project Management + System Development + Change Management →X.805 Clause 8 defines 5 Threat Categories that the X.805 Security Architecture is designed to mitigate + provides a Threat-Dimension Countermeasure Matrix linking each threat to specific Dimensions.
X805-Threats-Destruction-Corruption-Removal-Disclosure-Interruption-72Cell-Matrix-Application · ITU-T X.805 5 Threat Categories - Destruction + Corruption + Removal + Disclosure + Interruption + Threat-Dimension Countermeasure Matrix + 72-Cell Matrix Application + STRIDE + MITRE ATT and CK + Network Modular Risk Assessment →The report clearly sets out the activities conducted in each stage of the assessment (plan and prepare, define the assessment boundary, assess the controls, produce the report).
australia-irap-information-security-registered-assessors-program::IRAP-AR-0013 · IRAP-AR-0013 Record the activities of each assessment stage →Apply secure software development and integration practices (DevSecOps) for applications.
DODZT-3.2 · Secure Software Development and Integration →Questions people ask about devsecops
What is DevSecOps?
Why is DevSecOps important for compliance?
Which compliance frameworks address DevSecOps?
Where can I learn more about DevSecOps?
See how DevSecOps applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.