DevSecOps notes!
Tags: security
Published: 2021-09-28 12:31:20


## DevSecOps notes!

I spent the last three months reading the [Agile Application Security book,](https://www.oreilly.com/library/view/agile-application-security/9781491938836/) book, which helped to learn more about how to:

>- Add security practices to each stage of the existing _SDLC_.
>- Integrate security with planning, requirements, design, and at the code level.
>- Implement regulatory compliance in an agile or _DevOps_ environment.
>- Build an effective security program through a culture of empathy, openness, transparency, and collaboration.

The software development area is changing every day, and it keeps accelerating. Therefore, The security pioneers should also _change_ the way how to operate.

Integrating security in each stage of your existing development lifecycle requires a good plan and a well-documented study on your current environment setup.

Most organizations face a slowdown issue when it comes to executing security tasks in the _SDLC workflow_, and the main problem is the absence of _Automation_.

**_Automation_** will play a key role in enabling application security to sustain the speed of _DevOps_.

## What is DevSecOps?

Before I say anything, I'd like to mention that _DevSecOps_ is not a _one-person_ job; What you see on [LinkedIn](https://linkedin.com/) and other job listing websites is titles, nothing more than.

DevSecOps is a _culture_ or a process where the whole team (Development and IT operations) works _collaboratively_ to build, test, and release software in a more agile, _secure_, and iterative manner than the traditional software development process.

In a nutshell, _DevSecOps_ means integrating _security_ into every stage of the software development lifecycle. Some people refer to it as **_shift-left_**, which suggests moving critical testing practices earlier in the _SDLC_.

<br>
<br>
<br>
<br>

This is a mainly DevSecOps flow chart. On this basis, we can think that the most prominent feature of DevSecOps to SDL is **_Automation_**

![DevOps Approach](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jmdddilhru34oi25dx4a.png)

Before moving further with **_Automation_**, we should divide the testing part into two sections:

1- **_White-box_** is the practice of testing the code running behind the scene. This kind of testing is typically executed in Static Application Security Testing (SAST), including analyzers and linters in the IDE. Scanning the codebase we write is not enough; nowadays, 80-90% of a software project is third-party code in the form of libraries and packages. Thus we need Software Composition Analysis (SCA) to detect software licenses, deprecated dependencies, and known vulnerabilities.

2- **_Black-box_** is another way of testing the application while it's **_running_**; it's also known as Dynamic Analysis security testing (DAST). Black box analysis occurs in real-time, finding security issues that an attacker could exploit while the application is running in the production server.

The most common issue we face as security engineers is a large number of the **_false positive rate_**, which we'd like to reduce by using both _black-box_ and _white-box_ test techniques. 

<br>

## Integrate Security tools in your build pipeline

If you'd like to integrate SAST/SCA/DAST/ or RASP tools, all you need to do is to choose a suitable CI/CD tool such as [GitLab CI/CD](https://docs.gitlab.com/ee/ci/), [Jenkins](https://www.jenkins.io/) or anything else.

Integrating those security tools is not enough to ensure that we have everything in place. The most challenging job is to review the tool's results and automate that process as well.

---
>"It's much more useful to think of security as being a vector to follow rather than a point to be reached. Vectors have size and direction, and you should think about the direction you want to go in pursuit of security and how fast you'd like to chase it. However it's path you will continue to walk forever."

[@Bour Abdelhadi](https://www.linkedin.com/in/bohr/)