97 Things Every Application Security Professional Should Know

Chapter 21. A Coordinated Approach to a Successful DevSecOps Program

Han Lievens

Introduced over 10 years ago, DevSecOps has been accepted as one of the most important security practices today. Yet very few companies have been able to truly infuse security into every phase of their CI/CD pipeline.

Most companies I’ve worked with do understand the importance of the six pillars of DevSecOps, as defined by the National Institute of Standards and Technology (NIST):

• Collective responsibility

• Collaboration and integration

• Pragmatic implementation

• Bridging compliance and development

• Automation

• Measure, monitor, report, and action

And yet most organizations are unable to fully instantiate these principles into practice. Is achieving these seemingly reasonable principles really hard or are these concepts too idealistic and impractical? There’s a lot of talk about changing mindsets and instilling the right culture. Does good DevSecOps truly require a company culture overhaul? And what or who would it take to get this done?

When we talk about infusing security into every step of the pipeline, the keys are visibility, correlated detections, and automated actions. The first prerequisite, of course, is collaboration between the development, security, and operations teams. Only when all teams are talking to each other will we achieve full visibility into processes, logs, and traces ...