# DevSecOps

## DevOps

DevOps combines Software Development and IT Operations to shorten software release cycles through automation.

### **Key Components:**

* **CI/CD Pipelines:** Automate integrating and deploying code changes.
* **Environments/Infrastructure:** Maintain environments for development, testing, and production.
* **Tech Stacks:**
  * **Version Control:** Git, SVN
  * **CI/CD Tools:** Jenkins, GitLab, GitHub, Azure DevOps
  * **Infrastructure:** Docker, VMs, Vagrant, Terraform
  * **Cloud Providers:** Azure, AWS, GCP
  * **Configuration Management:** Ansible, Chef

## DevSecOps

DevSecOps integrates security testing at every stage of the software development process, fostering collaboration between developers, security specialists, and operations teams to build secure and efficient software.

### **Components:**

* **Development:** Planning, coding, building, and testing the application.
* **Security:** Introducing security earlier in the SDLC; ensuring code is free of vulnerabilities and performing thorough security testing.
* **Operations:** Releasing, monitoring, and fixing issues in the software.

### Importance of DevSecOps

* **Efficiently Address Security Issues:** Integrates security into each development phase, avoiding delays and reducing costs.
* **Cultural Transformation:** Makes security a shared responsibility among all team members.

### Benefits of DevSecOps

* **Catch Vulnerabilities Early:** Security checks at each stage help detect and fix issues sooner.
* **Reduce Time to Market:** Automated security tests minimize delays.
* **Ensure Regulatory Compliance:** Adopts professional security practices to meet industry standards.
* **Build a Security-Aware Culture:** Teams proactively address security throughout development.
* **Develop Secure Features:** Collaboration across teams ensures new features are secure.

### Implementation of DevSecOps

* **DevOps:** A practice combining development and operations through automation and collaboration.
* **CI/CD (Continuous Integration/Continuous Delivery):** Automated build-and-test steps to efficiently deliver small changes.
* **Security Integration:** Incorporates security assessments throughout CI/CD, making it a shared responsibility.

### DevSecOps in the SDLC

* Security testing traditionally occurs post-development. 
* DevSecOps integrates it throughout the SDLC: 
  * Planning > Analysis > Design > Coding > Testing > Maintenance.

### DevSecOps Framework

* **Pre-Commit Hooks:** Scripts that run before changes are committed, ensuring code quality and security by catching issues early.
* **Security Pipelines:** Dedicated pipelines for SAST, DAST, SCA.
* **Shift Left:** Incorporates security early in the SDLC to catch issues sooner.
* **Shift Right:** Continues security focus post-deployment to catch runtime issues.

### DevSecOps Tools

* **SAST**
  * **Opensource:** SonarQube, Bandit, FindSecBugs
  * **Commercial:** Checkmarx, Fortify, Veracode
* **DAST**
  * **Opensource**: OWASP ZAP, Nuclei, Arachni, Wapiti
  * **Commercial:** Burp Suite, Acunetix, Netsparker, Nessus
* **SCA**
  * **Opensource:** Snyk, Retire.js, OWASP Dependency-Check
  * **Commercial:** WhiteSource, Black Duck, Synk
* **Security in Infrastructure as Code**
  * **Opensource:** TFLint, Checkov, Prowler
  * **Commercial:** Bridgecrew, CloudSploit, Prisma Cloud
* **Secret Management**
  * **Opensource:** HashiCorp Vault, Mozilla SOPS, AWS Secrets Manager
  * **Commercial:** CyberArk Conjur, AWS Secrets Manager, Azure Key Vault.
* **CI/CD Integration:** Jenkins, GitLab CI, GitHub Actions
* **Monitoring:** Prometheus, Grafana, Splunk
* **Container Security:** Aqua Security, Twistlock, Clair

### DevSecOps Culture

* **Communication:** Leadership promotes security practices' importance.
* **People:** Collaboration between development, operations, and security teams.
* **Technology:** Automated security testing tools.
* **Process:** Continuous security testing and evaluation at every development stage.

### Challenges in Implementing DevSecOps

* **Cultural Shift:** Resistance to changing traditional roles and practices.
* **Tool Integration:** Difficulty integrating diverse tools into a continuous delivery process.

### Best Practices of DevSecOps

* **Shift Left:** Early-stage security vulnerability checks.
* **Shift Right:** Focus on post-deployment security.
* **Automated Security Tools:** Integrate into CI/CD to avoid delays.
* **Promote Security Awareness:** Make security a core value shared by all team members.

### DevSecOps in Agile Development

* **Agile Mindset:** Efficient application development with a focus on responding to changes.
* **Integration with Agile:** DevSecOps introduces security practices into agile’s iterative cycles.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://playbook.sidthoviti.com/devsecops.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.