DevSecOps practices in CI/CD pipelines: From reactive practice to proactive handling

At the heart of this comprehensive study lies the central research question: "What are the key security-related obstacles that organizations encounter when integrating DevSecOps/Secure DevOps, and how can these security challenges be effectively resolved or mitigated?" The primary achievement of this work is the identification and categorization of these challenges into four interconnected domains: People, Tools, Values, and Governance & Processes. This identification has been done via literature reviews and by employing interviews with members of the development-, security-, and operations teams, within a specific Dutch governmental IT organization. The categorization of the identified challenges has been performed via a cyclical coding process known as the Grounded theory from Strauss and Glaser. By shedding light on these four critical areas, this study provides a roadmap for organizations to navigate the complexities of a DevSecOps implementation. In the realm of people,...Show moreAt the heart of this comprehensive study lies the central research question: "What are the key security-related obstacles that organizations encounter when integrating DevSecOps/Secure DevOps, and how can these security challenges be effectively resolved or mitigated?" The primary achievement of this work is the identification and categorization of these challenges into four interconnected domains: People, Tools, Values, and Governance & Processes. This identification has been done via literature reviews and by employing interviews with members of the development-, security-, and operations teams, within a specific Dutch governmental IT organization. The categorization of the identified challenges has been performed via a cyclical coding process known as the Grounded theory from Strauss and Glaser. By shedding light on these four critical areas, this study provides a roadmap for organizations to navigate the complexities of a DevSecOps implementation. In the realm of people, cultural transformation emerges as a critical need, demanding a profound shift in mindset and behavior. This transformation encompasses the cultivation of trust, the nurturing of transparency, and an unwavering commitment to continuous learning. However, it extends beyond abstract ideals to encompass tangible actions. Team skill development becomes paramount, equipping personnel with the expertise needed to bolster the security posture. Concurrently, the cultivation of security awareness takes center stage, ensuring that every team member understands their role in safeguarding the organization. Ownership and accountabilities are clearly defined, reinforcing the importance of fostering a culture deeply rooted in security. As we delve into the Tools domain, we find that the choices made here have far-reaching consequences for the DevSecOps journey. Thoughtful tool selection is not merely a matter of preference; it is a strategic imperative. Overreliance on tools can lead to vanity and missed vulnerabilities, making it essential to strike a balance between automation and human judgment. Simultaneously, proper access controls must be carefully enforced to prevent unauthorized access to sensitive resources. Addressing legacy systems and grappling with technical debt necessitates incremental improvements, gradually modernizing the technological landscape while preserving security integrity. Continuing with the next domain, Values serve as the compass guiding organizations through the complex DevSecOps terrain. Continuous monitoring is an unwavering commitment, offering real-time insights into the security posture and identifying potential threats promptly. Striking the delicate equilibrium between speed and security highlighting the importance of avoiding undue haste within the team that might compromise safety. Embracing a culture of continuous improvement propels organizations forward, encouraging iterative enhancements and the evolution of security practices. Within this framework, DevSecOps control takes root, fostering a disciplined and principled approach to security integration. In the Governance & Processes domain, the foundation for a secure and collaborative culture is laid by securing management buy-in. Leadership commitment paves the way for organizational alignment and support, making security a top priority. The intricacies of compliance and regulations are diligently addressed through the integration of compliance experts and automated compliance checks. This ensures that DevSecOps practices are not only effective but also adhere to legal and industry standards. In essence, the challenges within these domains are not isolated silos but are indistinguishably intertwined. Success in the DevSecOps journey hinges on fostering a culture of security (People), making strategic choices about tools (Tools), upholding core values (Values), and establishing governance and processes (Governance & Processes) that collectively form a resilient and robust framework for secure software development and delivery.Show less

Leiden University Student Repository

Documents

In Collections

DevSecOps practices in CI/CD pipelines: From reactive practice to proactive handling