# DevSecOps

## DevOps

DevOps combines Software Development and IT Operations to shorten software release cycles through automation.

### **Key Components:**

* **CI/CD Pipelines:** Automate integrating and deploying code changes.
* **Environments/Infrastructure:** Maintain environments for development, testing, and production.
* **Tech Stacks:**
  * **Version Control:** Git, SVN
  * **CI/CD Tools:** Jenkins, GitLab, GitHub, Azure DevOps
  * **Infrastructure:** Docker, VMs, Vagrant, Terraform
  * **Cloud Providers:** Azure, AWS, GCP
  * **Configuration Management:** Ansible, Chef

## DevSecOps

DevSecOps integrates security testing at every stage of the software development process, fostering collaboration between developers, security specialists, and operations teams to build secure and efficient software.

### **Components:**

* **Development:** Planning, coding, building, and testing the application.
* **Security:** Introducing security earlier in the SDLC; ensuring code is free of vulnerabilities and performing thorough security testing.
* **Operations:** Releasing, monitoring, and fixing issues in the software.

### Importance of DevSecOps

* **Efficiently Address Security Issues:** Integrates security into each development phase, avoiding delays and reducing costs.
* **Cultural Transformation:** Makes security a shared responsibility among all team members.

### Benefits of DevSecOps

* **Catch Vulnerabilities Early:** Security checks at each stage help detect and fix issues sooner.
* **Reduce Time to Market:** Automated security tests minimize delays.
* **Ensure Regulatory Compliance:** Adopts professional security practices to meet industry standards.
* **Build a Security-Aware Culture:** Teams proactively address security throughout development.
* **Develop Secure Features:** Collaboration across teams ensures new features are secure.

### Implementation of DevSecOps

* **DevOps:** A practice combining development and operations through automation and collaboration.
* **CI/CD (Continuous Integration/Continuous Delivery):** Automated build-and-test steps to efficiently deliver small changes.
* **Security Integration:** Incorporates security assessments throughout CI/CD, making it a shared responsibility.

### DevSecOps in the SDLC

* Security testing traditionally occurs post-development. 
* DevSecOps integrates it throughout the SDLC: 
  * Planning > Analysis > Design > Coding > Testing > Maintenance.

### DevSecOps Framework

* **Pre-Commit Hooks:** Scripts that run before changes are committed, ensuring code quality and security by catching issues early.
* **Security Pipelines:** Dedicated pipelines for SAST, DAST, SCA.
* **Shift Left:** Incorporates security early in the SDLC to catch issues sooner.
* **Shift Right:** Continues security focus post-deployment to catch runtime issues.

### DevSecOps Tools

* **SAST**
  * **Opensource:** SonarQube, Bandit, FindSecBugs
  * **Commercial:** Checkmarx, Fortify, Veracode
* **DAST**
  * **Opensource**: OWASP ZAP, Nuclei, Arachni, Wapiti
  * **Commercial:** Burp Suite, Acunetix, Netsparker, Nessus
* **SCA**
  * **Opensource:** Snyk, Retire.js, OWASP Dependency-Check
  * **Commercial:** WhiteSource, Black Duck, Synk
* **Security in Infrastructure as Code**
  * **Opensource:** TFLint, Checkov, Prowler
  * **Commercial:** Bridgecrew, CloudSploit, Prisma Cloud
* **Secret Management**
  * **Opensource:** HashiCorp Vault, Mozilla SOPS, AWS Secrets Manager
  * **Commercial:** CyberArk Conjur, AWS Secrets Manager, Azure Key Vault.
* **CI/CD Integration:** Jenkins, GitLab CI, GitHub Actions
* **Monitoring:** Prometheus, Grafana, Splunk
* **Container Security:** Aqua Security, Twistlock, Clair

### DevSecOps Culture

* **Communication:** Leadership promotes security practices' importance.
* **People:** Collaboration between development, operations, and security teams.
* **Technology:** Automated security testing tools.
* **Process:** Continuous security testing and evaluation at every development stage.

### Challenges in Implementing DevSecOps

* **Cultural Shift:** Resistance to changing traditional roles and practices.
* **Tool Integration:** Difficulty integrating diverse tools into a continuous delivery process.

### Best Practices of DevSecOps

* **Shift Left:** Early-stage security vulnerability checks.
* **Shift Right:** Focus on post-deployment security.
* **Automated Security Tools:** Integrate into CI/CD to avoid delays.
* **Promote Security Awareness:** Make security a core value shared by all team members.

### DevSecOps in Agile Development

* **Agile Mindset:** Efficient application development with a focus on responding to changes.
* **Integration with Agile:** DevSecOps introduces security practices into agile’s iterative cycles.