Hands-On Security in DevOps

DevSecOps for security management

Q: Are there any suggested industry best practices for secure development and deployment in DevOps?

The OWASP SAMM (Software Assurance Maturity Model), Microsoft Security Development Lifecycle (SDL) and the SafeCode provide practical security practices for the DevOps or agile development.

• OWASP SAMM: https://github.com/OWASP/samm
• Microsoft SDL for Agile: https://www.microsoft.com/en-us/SDL/Discover/sdlagile.aspx
• SafeCode: https://safecode.org/publications/

Q: What are the security risks of a cloud service?

The CSA has defined the top threats to cloud computing on their website (https://cloudsecurityalliance.org/group/top-threats/), which are listed as follows:

• Data Breaches
• Insufficient identity, credential, ...