File:DevOps vs DevSecOps Mginise.jpg

Summary[edit]

Licensing[edit]

I, the copyright holder of this work, hereby publish it under the following license:

This file is licensed under the Creative Commons Attribution-Share Alike 4.0 International license.

You are free:

• to share – to copy, distribute and transmit the work
• to remix – to adapt the work

Under the following conditions:

• attribution – You must give appropriate credit, provide a link to the license, and indicate if changes were made. You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use.
• share alike – If you remix, transform, or build upon the material, you must distribute your contributions under the same or compatible license as the original.

https://creativecommons.org/licenses/by-sa/4.0CC BY-SA 4.0 Creative Commons Attribution-Share Alike 4.0 truetrue

By 2016 the concept of DevOps had been a mainstream concept for a few years now. Most practitioners of DevOps fully understand that the benefits of Development and Operations are marginal without firmly embracing Security throughout the process.

In the Federal Government space, Federal Agencies were just learning about the benefits of DevOps and had many questions about how to integrate security into the process from day one. At the Department of Homeland Security, Transportation Security Agency a cross functional group was working on incorporating the best-in-industry DevOps into the Agency. The first question from senior management was 'how do we incorporate security from day one', falling in line with the concepts of 'shift left' in the development life cycle.

This graphic intends to depict how DevSecOps, which technically DevOps, incorporates Security from Day 1.

Other Federal Agencies, such as the Department of Defense, have embraced DevSecOps. For example, Nicolas Chaillan, the Special Advisor for Cloud Security and DevSecOps have published multiple papers on DevSecOps. https://dodcio.defense.gov/Portals/0/Documents/DoD%20Enterprise%20DevSecOps%20Reference%20Design%20v1.0_Public%20Release.pdf?ver=2019-09-26-115824-583