Where to Integrate Security Practices on DevOps Platform

Abstract

“Software security” often evokes negative feelings amongst software developers because this term is associated with additional programming effort, uncertainty and road blocker activity on rapid development and release cycles. The Secure DevOps movement attempts to combat the toxic environment surrounding software security by shifting the paradigm from following rules and guidelines to creatively determining solutions for tough security problems (Taschner, 2015). Secure software should be focused on a proactive approach that limits the attack surface and produces reliable software. Secure DevOps developers want their software to bend but not break, which means the software absorbs attacks and continues to function. The burgeoning concepts of DevOps include a number of concepts that can be applied to increase the security of developed applications. Applying these and other DevOps principles can have a big impact on creating an environment that is resilient and secure. Specifically, this paper clearly explains how to address security concerns in the early stages of the development lifecycle and leverage that knowledge throughout the SDLC.

A Survey of DevOps Concepts and Challenges

“…Impact: explores how DevOps effects other aspects of software development such as architecture [42], security [49], quality assurance [40], or the impact of DevOps on software development in specific scenarios, such as the development of software for research [12].…”

Prioritization Based Taxonomy of DevOps Security Challenges Using PROMETHEE

“…Challenge of unrestricted collaboration [20], [23], [58], [79] CH12 Using unsuitable performance metrics for security evaluation [2], [69], [78], [79] CH13 Abundance of information is a serious threat to secure data [60], [62], [80] CH14 Use of immature automated deployment tools [61], [81], [82] CH15 Inadequate channel to monitor the collaboration of teams [52], [53], [71], [79]…”

“…Therefore, there should be proper automation testing tools to monitor the security risks of DevOps. As we are dealing with heterogeneous nature in an organization all sites must coordinate to resolve any ambiguity on time [52,61]. CH16 "lack of secure coding standards" is considered as the challenging factor in terms of DevOps security.…”

“…Proper trainings and meeting sessions should be conducted to improve the expertise of teams. The capabilities to support and encourage team members by leadership to control the abundance of information causing problems to secure data[60,62,80] will process DevOps smoothly.The other frequently occurred challenge in an organization to secure DevOps activities is immature automated deployment tools[61,81,82], due to lack of testing knowledge. The DevOps team must corporate with security team to measure such challenging factors.…”

Software Security Activities that Support Incident Management in Secure DevOps

“…• Use of immature automated deployment tools (2) • Use of unsuitable metrics (2) • Insufficient monitoring of collaboration (1) Mohan and ben Othmane [17] attempted to perform a mapping study on security in DevOps, but found very few primary studies; mostly trade conference presentations and blogs (similar to the artifacts above). Yasar and Kontostathis [25] propose focusing on security requirements, threat modeling, environment configuration, static analysis, code review, penetration testing, environment testing, and finally a manual security review. They claim that quick incident response is an implicit benefit of such an approach, but do not offer any empirical evidence to support the claim.…”