Modeling continuous security: A conceptual model for automated DevSecOps using open-source software over cloud (ADOC)

Devsecops Methodology for Ng-Iot Ecosystem Development Lifecycle – Assist-Iot Perspective

“…In contrast, DevSecOps is a conscious effort to swift the security considerations towards the development pipeline, to address adequately and timely any security considerations. Specifically, in [30] DevSecOps is defined as DevOps embedded with security controls, aiming to provide continuous security assurance in all stages of the workflow. Hence, a set of additional secure rules to aid organizations to implant security deep in their DevOps development and operations processes is composing the DevSecOps [34].…”

“…The DevOps practices are organized as follows: Continuous Planning, Continuous Integration, Continuous Delivery, Continuous Deployment, Continuous Operation and Continuous Feedback ( [4,30]):…”

“…DevSecOps principles are broadly covered in [5], and also agreed in [30], and can be captured using the following key-phrases: "Shift-security left", "Security by Design", Culture, Automation, Metrics, Security as Code, Infrastructure as Code, Compliance as Code, and Adaptative security. In that sense, DevSecOps application in NG-IoT architectures has the potential to contribute in reducing and mitigating threats during software delivery in IoT deployments, while helping guarantee secure operation by applying its most relevant principles such as: shift-security left, and security-by-design.…”

“…The short concept-to-market and development-to-production times, altogether with strong software dependencies between different components of the architecture, force NG-IoT teams to work in distributed environments. The ASSIST-IoT project proposes a DevSecOps methodology for NG-IoT, which is based on two fundamental pillars [30]:…”

DevOPS Now and Then

“…DevSecOps or SecDevOps are the terms associated with Secured DevOps. The continuous security model was proposed in (Rakesh Kumar and Rinkaj Goyal 2020), which used opensource software over the cloud to provide security throughout the product development. The security practices used in DevOps (Rahman et al, 2016) are 1)Automation Activities includes automated testing, monitoring, code review, software-defined firewall and software licensing 2)Collaboration means increasing collaboration between development and security teams 3) Nonautomated security activities are Security requirements analysis, performing security configurations, performing security policies, design review, input validation, risk analysis, etc.…”