DevSecOps Stages
What is Sensitive Information Scan?
The Sensitive Information Scan (SAS) phase scans the code for sensitive information (e.g. hardcoded password, tokens, secret keys, etc) before pushing the code into code repositories. This makes sure that even if the code falls into wrong hands tomorrow, the sensitive information won’t get exposed.
The following components are there in this phase:
People involved: Developers
External sources
Why is it important in DevSecOps?
The Sensitive Information Scan makes sure that sensitive information is not entering the DevSecops pipeline and code repository, reducing the attack surface. And, as it is performed by tools, it can be automated to run every time the user tries to push the code into the version control system.
What will you learn in this section?
The user will learn to perform the following tasks
Tools Covered
What is Automated Code Review?
The Automated Code Review (ACR) phase scans the code for known mistakes, security issues and vulnerabilities. This is way efficient and easily scalable than Manual Code Review done for the same purpose. It is not to be confused with Peer Code review practice that is done to improve the code quality and find business/logical/flow mistakes.
The following components are there in this phase:
People involved: Developers
External sources
Why is it important in DevSecOps?
The Automated Code Review makes sure to weed out the security-related issues, mistakes of the developers on the code phase itself. The developers can remove these issues before even the project is built and test deployed. And, ACR will scale with the increase in release frequency.
What will you learn in this section?
The user will learn to perform the following tasks
Tools Covered
What is Software Composition Analysis?
Software Composition Analysis is performed to identify the dependency packages/libraries for the project and check those against known vulnerabilities.
The following components are there in this phase:
People involved: Developers
External sources
Why is it important in DevSecOps?
It is very common for the projects to use 3rd party open-source libraries to extend their capabilities. However, as a downside, if the library has any security issue or vulnerability, it can also affect the project. By running the checks every time the DevSecOps pipeline runs, the risk of using vulnerable/outdated components.
What will you learn in this section?
The user will learn to perform the following tasks
Tools Covered
What is Static Application Security Testing?
The Static Application Security Testing (SAST) is done to identify the possible vulnerabilities or security issues in non-running source code by using techniques likeTaint Analysis and Data Flow Analysis.
The following components are there in this phase:
People involved: Developers
External sources
Why is it important in DevSecOps?
The Static Application Security Testing phase can be used to identify security issues. For example, taint analysis can identify the variables that can handle the user input and check if vulnerability like buffer overflow can occur.
What will you learn in this section?
The user will learn to perform the following tasks
Tools Covered
What is Dynamic Application Security Testing?
The Dynamic Application Security Analysis (DAST) is performed to identify the possible run-time vulnerabilities or security issues. Unlike static analysis, dynamic analysis is performed on a running project.
The following components are there in this phase:
People involved: Developers and Testers
External sources
Why is it important in DevSecOps?
The Dynamic Application Security Testing can unravel the runtime-security issues before project/application deployment (or test deployment). DAST can be automated using tools and can be added to the DevSecOps pipeline for continuous security testing.
What will you learn in this section?
The user will learn to perform the following tasks
Tools Covered
What is Compliance as Code?
Compliance as Code (CAC) is an approach to automate the enforcement of (IT) compliance regulations by writing policies in a file. These policies can then be enforced or checked in an automated manner.
The following components are there in this phase:
People involved: Developers
External sources
Why is it important in DevSecOps?
The Compliance as Code phase makes the compliance a part of the DevSecOps pipeline and ensures that on every release, the test server adheres to the security policies defined for the project. This reduces the attack surface and obviously helps with becoming compliance-ready.
What will you learn in this section?
The user will learn to perform the following tasks
Tools Covered
What is Vulnerability Management?
Vulnerability Management (VM) is the process of identifying the inventory, using tools to perform security tests on the project to identify vulnerabilities, catalog the vulnerabilities, and then patching/fixing those. It is an ongoing process and can be thought of as a part of continuous security testing.
The following components are there in this phase:
People involved: Developers
External sources
Why is it important in DevSecOps?
Vulnerability Management tools fetch the reports generated by different tools to one dashboard and provide a holistic view of the threats/vulnerabilities. Such tools also provide integration with other components to notify the concerned people and follow up on the reported issues. This ensures that the vulnerabilities can be tracked and resolved efficiently.