# What Are DevOps and DevSecOps? A Guide to CI/CD, Docker, Kubernetes and Secure Software Development **URL:** https://securesys.com.tr/en/learning/software-development-devsecops/what-are-devops-and-devsecops-cicd-and-security-guide ![What Are DevOps and DevSecOps? A Guide to CI/CD, Docker, Kubernetes and Secure Software Development](/images/bilgi-merkezi/covers/cover-yazilim-11.webp) ### What Are DevOps and DevSecOps? **DevOps is a working approach that supports collaboration, automation and continuous improvement between software development (Development) and IT operations (Operations).** **DevSecOps, in turn, is an approach that aims to integrate security activities into the whole of the software development and operations processes.** In traditional software development processes, software teams develop the application while operations teams may be responsible for running it. Security assessments, on the other hand, may sometimes be carried out only after the software has been completed. This can lead to security issues being detected late, to rework, and to delivery delays. The DevOps approach supports development and operations processes working together more coherently. DevSecOps adds security requirements, automated checks, security testing and risk management to this structure in an integrated way. For example, when a developer creates a new API in a CRM application, the code change can be passed through automated tests. In the same process, source code analysis, dependency scanning and secret detection can be carried out. Once the appropriate checks have been completed, the software can be deployed to the test or live environment. **Short answer:** DevOps is an approach that integrates software development and operations processes through collaboration and automation. DevSecOps aims to make security an inseparable part of these processes. Technologies such as CI/CD, Docker, Kubernetes, SAST, DAST and SCA can support the implementation of these approaches. ### \1. What Is DevOps Used For? DevOps aims to improve coordination across the development, testing, deployment and operation of software. #### Main objectives - Building collaboration between development and operations teams - Automating repetitive tasks - Improving software delivery processes - Standardising testing and deployment activities - Increasing the observability of systems - Speeding up feedback loops - Supporting service continuity #### Example If changes to an organisation's web application used to be transferred to the server manually, automated deployment processes can standardise these operations. ### \2. What Is DevSecOps Used For? DevSecOps ensures that security is addressed systematically across the software development life cycle. #### Main objectives Identifying security requirements early. Automating code security checks. Assessing the risks of third-party components. Protecting CI/CD processes. Improving the security of deployment environments. Managing security findings. #### Example When a software developer adds a new open-source library to the application, an SCA tool can assess the known vulnerabilities of that component. ### \3. The Difference Between DevOps and DevSecOps | Criterion | DevOps | DevSecOps | | --- | --- | --- | | Main focus | Collaboration between development and operations | Integration of security into the entire process | | Automation | Build, test, deployment | Security checks in addition to these | | Code security | May be applied | One of the core activities | | Security responsibility | Depends on the organisation | Shared responsibility is emphasised | | Risk management | Operational risks | Includes software and supply chain risks as well | #### Key point DevSecOps is not a separate technology that replaces DevOps. It is the integration of security-focused practices into DevOps processes. ### \4. Is DevOps a Piece of Software or a Methodology? DevOps is not a single software product. It is an approach that encompasses culture, processes, automation and technical practices. #### Tools that can be used within DevOps Git. GitLab. GitHub Actions. Jenkins. Azure DevOps. Docker. Kubernetes. Terraform. Ansible. Prometheus. #### Key point Having these tools installed does not, on its own, mean that DevOps has been implemented successfully. ### \5. Is DevSecOps a Security Product? DevSecOps is not a security product that is bought on its own. It is implemented through different security technologies and processes. #### Example components SAST. DAST. SCA. Secret scanning. Container scanning. IaC scanning. SBOM. Security policies. #### Key point In a DevSecOps implementation, the findings obtained from the tools must be assessed, prioritised and remediated. ### \6. The Relationship Between SDLC and DevSecOps **SDLC (Software Development Life Cycle) is the software development life cycle.** DevSecOps supports applying security activities throughout the SDLC. #### Example stages Planning. Analysis. Design. Development. Testing. Deployment. Operation. #### Security activities Requirements analysis. Threat modelling. Secure coding. Code analysis. Security testing. Monitoring. ### \7. What Is Secure SDLC? Secure SDLC is a development approach in which security requirements are integrated into the software life cycle. #### Core activities Security requirements. Threat modelling. Secure design. Code review. Security testing. Secure deployment. #### Example In a CRM application, ensuring that users can view only the customer records they are authorised to see should be addressed at the design stage. ### \8. What Is Shift Left Security? Shift Left Security refers to moving security checks to the early stages of the software development process. #### Example practices Security requirements. Threat modelling. Code analysis. Dependency scanning. Developer security training. #### Advantage It supports identifying security issues earlier. #### Key point Early security checks do not remove the need to monitor the security of the live environment. ### \9. What Is Shift Right Security? Shift Right Security focuses on monitoring security and operational behaviour after the software has been deployed. #### Example practices Runtime monitoring. Security logs. Anomaly detection. Incident response. Security telemetry. #### Key point Shift Left and Shift Right are complementary approaches. ### \10. What Is CI? **CI (Continuous Integration) is an approach in which developers regularly integrate their code changes into a shared codebase and those changes are verified through automated checks.** #### CI activities Code merging. Building. Unit tests. Code quality. Security scans. #### Example When a developer pushes new code, automated tests can be started. ### \11. What Is CD? The abbreviation CD can be used for two different concepts. #### Continuous Delivery It aims to keep the software in a state that is ready to be deployed to the production environment. #### Continuous Deployment It refers to changes that pass the appropriate checks being deployed to the production environment automatically. #### Key point Continuous Delivery and Continuous Deployment are not the same concept. ### \12. What Is a CI/CD Pipeline? A CI/CD pipeline is an automation flow that takes code changes through the build, test, security check and deployment stages. #### Example flow Code change. Build. Unit test. SAST. SCA. Packaging. Container scan. Deployment to the test environment. DAST. Approval. Go-live. #### Key point It is not mandatory for every project to apply all stages in the same order. ### \13. CI/CD Pipeline Security CI/CD systems may be associated with source code, access credentials and deployment permissions. #### Main risks Unauthorised code changes. Leakage of secrets. Insecure dependencies. Pipeline configuration errors. Misuse of deployment permissions. #### Security controls Least privilege. Code review. Secrets management. Signing. Audit logs. ### \14. What Is Git? Git is a distributed version control system. #### Areas of use Tracking code changes. Branch management. Code merging. Retrospective review. #### Key point Git provides versioning of source code; on its own, it is not a secure backup strategy. ### \15. What Are GitHub, GitLab and Azure DevOps? These platforms offer different services for software development processes. #### GitHub Source code hosting, work tracking and automation. #### GitLab Source code management and DevSecOps life cycle features. #### Azure DevOps Work tracking, source code, pipelines and test management. #### Key point The features of the platforms may vary depending on the licence, version and deployment model. ### \16. What Is Jenkins? Jenkins is open-source software used as an automation server. #### Areas of use Building. Testing. CI/CD. Deployment automation. #### Key point The plugins, access permissions and updates of Jenkins servers must be managed from a security perspective. ### \17. What Is Docker? **Docker is a platform that offers technologies for packaging and running applications as containers.** Containers support packaging the components an application needs in order to run in a consistent way. #### Advantages Portability. Repeatable deployment. Environment consistency. Flexibility in resource usage. #### Example The backend component of a CRM application can be packaged as a container. ### \18. What Is a Container? A container is a technological approach that brings together the components an application needs in order to run within an isolated runtime environment. #### Container components Application. Dependencies. Runtime. Configuration. #### Key point Containers generally share the kernel of the host system. For this reason, they do not have the same isolation model as virtual machines. ### \19. The Difference Between Docker and a Virtual Machine | Criterion | Container | Virtual Machine | | --- | --- | --- | | Operating system | Generally shares the host system kernel | Has its own guest operating system | | Startup | Generally fast | May have more start-up overhead | | Resource usage | May be lighter | May require more resources | | Isolation | Container mechanisms | Hypervisor-based | | Usage | Application packaging and deployment | System virtualisation | #### Key point The level of isolation and security depends on the configuration and the technology used. ### \20. What Is a Docker Image? A Docker image is the packaged file system and configuration content used to create a container. #### Contents Application files. Dependencies. Runtime. Start-up instructions. #### Key point Care must be taken to ensure that no passwords, API keys or other secrets are present inside the image. ### \21. What Is a Dockerfile? A Dockerfile is the file that contains the instructions for building a container image. #### Example instructions FROM. WORKDIR. COPY. RUN. USER. CMD. #### Security recommendations Using trusted base images. Avoiding unnecessary packages. Non-root user. Up-to-date dependencies. Not adding secrets to the image. ### \22. What Is a Container Registry? A container registry is the system in which container images are stored and distributed. #### Examples Docker Hub. GitHub Container Registry. GitLab Container Registry. Amazon ECR. Azure Container Registry. #### Security controls Access permissions. Image scanning. Signing. Version management. ### \23. What Is Container Security? Container security covers the management of risks in the container image, runtime, network and orchestration layers. #### Main risks Insecure images. Known vulnerabilities. Excessive privileges. Leakage of secrets. Insecure network configuration. #### Key point Using containers does not automatically make an application secure. ### \24. What Is Kubernetes? **Kubernetes is an open-source orchestration platform that supports automating the deployment, scaling and management of container-based applications.** #### Key features Container orchestration. Service discovery. Scaling. Workload management. Deployment management. #### Example Multiple container instances of a web application can be managed on Kubernetes. ### \25. What Is a Kubernetes Cluster? A Kubernetes cluster consists of the nodes managed by Kubernetes and its control components. #### Main components Control Plane. Worker Nodes. Pods. Services. #### Key point Kubernetes architecture and security may vary depending on the deployment model. ### \26. What Is a Kubernetes Pod? A Pod is the smallest deployable unit of execution in Kubernetes. A Pod can contain one or more containers. #### Example An application container can run in the same Pod as certain helper containers. ### \27. What Is a Kubernetes Deployment? A Deployment is the Kubernetes resource used to manage the desired state of application Pods. #### Areas of use Replica management. Rolling update. Rollback. #### Key point A Deployment is not suitable for every workload; different resources may be used for stateful applications. ### \28. What Is a Kubernetes Service? A Service is an abstraction layer used to provide network access to specific groups of Pods within Kubernetes. #### Example The Pods of a backend application can be made accessible through a Service. ### \29. What Is Kubernetes Ingress? Ingress is the API resource that associates HTTP and HTTPS traffic with services in a Kubernetes environment. #### Key point For Ingress resources to work, a suitable Ingress Controller is required. The Kubernetes ecosystem also includes alternative and evolving traffic management approaches such as the Gateway API. ### \30. Kubernetes Security Kubernetes environments contain multiple layers of security. #### Core controls RBAC. Network Policies. Pod Security Standards. Secrets management. Image security. Audit logging. Updates. #### Key point Kubernetes security cannot be achieved through container scanning alone. ### \31. What Is Kubernetes RBAC? **RBAC (Role-Based Access Control) is role-based access control.** It can be used on Kubernetes to restrict the access of users and service accounts to specific resources. #### Example A developer can be allowed to perform only certain operations on the test namespace. ### \32. What Is a Kubernetes Network Policy? A Network Policy makes it possible to control network traffic between Pods on a network infrastructure that supports it. #### Example The aim may be to allow access to the database only from the authorised backend application. #### Key point For Network Policy rules to be enforced, the network plugin in use must support the relevant features. ### \33. What Is Infrastructure as Code? **Infrastructure as Code (IaC) is the management of infrastructure resources through code or declarative configurations.** #### Areas of use Server provisioning. Network configuration. Cloud resources. Container infrastructure. #### Advantages Repeatability. Version control. Automation. Review. ### \34. What Is Terraform? Terraform is a tool that makes it possible to define and manage infrastructure resources through code. #### Areas of use Cloud infrastructure. Virtual machines. Network resources. Storage. #### Key point Terraform state files may contain sensitive information; access to them and their storage must be secured. ### \35. What Is Ansible? Ansible is a tool used for system configuration and automation activities. #### Areas of use Server configuration. Package management. Application deployment. Repetitive tasks. #### Key point The permissions and secrets of automation accounts must be managed securely. ### \36. What Is GitOps? GitOps is an operations approach based on managing the desired state of systems through Git. #### Core principles Declarative configuration. Version control. Automated reconciliation. Change traceability. #### Example Kubernetes application configurations can be managed in a Git repository. ### \37. What Is Argo CD? Argo CD is a GitOps-based continuous delivery tool used for Kubernetes. #### Areas of use Application deployment. Comparing state with Git. Configuration synchronisation. #### Key point Argo CD access permissions and the management interface must be protected from a security perspective. ### \38. What Are DevSecOps Security Tools? Different tool categories can be used in DevSecOps processes. #### Main categories SAST. DAST. SCA. Secret scanning. IaC scanning. Container scanning. SBOM. Runtime security. #### Key point Tool selection should be based on software technologies, risks, licensing and existing development processes. ### \39. What Is SAST? **SAST (Static Application Security Testing) is the analysis of application source code or related software components for security using static methods.** #### Examples of risks that can be detected Insecure data handling. Injection risks. Use of insecure functions. Hard-coded secrets. #### Key point SAST results may contain false-positive findings and may require expert assessment. ### \40. What Is DAST? **DAST (Dynamic Application Security Testing) is the assessment of a running application for security using dynamic methods.** #### Test areas Web applications. APIs. Session management. Input validation. Security configurations. #### Key point DAST does not analyse the entire source code and cannot detect every security issue. ### \41. The Difference Between SAST and DAST | Criterion | SAST | DAST | | --- | --- | --- | | Analysis approach | Static | Dynamic | | Source code access | Used in most approaches | Generally not required | | Running application | Not always required | Required | | When it is used | Development process | Test and runtime environments | | Scope | Risks originating in code | Behaviour of the running application | #### Key point SAST and DAST complement each other. ### \42. What Is SCA? **SCA (Software Composition Analysis) is the analysis of the third-party and open-source components used in software.** #### Assessment areas Dependencies. Known vulnerabilities. Licences. Component versions. #### Example A known security vulnerability may be found in an open-source library used in an application. ### \43. What Is an SBOM? **An SBOM (Software Bill of Materials) is a structured inventory of the components that make up a piece of software.** #### Information it may contain Component name. Version. Supplier. Dependency relationships. Licence information. #### Common formats SPDX. CycloneDX. #### Key point Producing an SBOM does not, on its own, mean that security vulnerabilities have been remediated. ### \44. Software Supply Chain Security Software supply chain security covers the security of the components and infrastructure used in software development and deployment processes. #### Risk areas Third-party dependencies. Package repositories. Build systems. CI/CD accounts. Container images. Deployment artefacts. #### Key point It is not enough for the application source code alone to be secure. ### \45. What Is SLSA? **SLSA (Supply-chain Levels for Software Artifacts) is a framework aimed at strengthening the production and supply chain integrity of software artefacts.** #### Focus areas Build integrity. Source trustworthiness. Provenance. Supply chain controls. #### Key point SLSA does not, on its own, cover every dimension of software security. ### \46. What Is Secret Scanning? Secret scanning aims to detect secrets that have been shared by accident in source code and related environments. #### Example secrets API keys. Access tokens. Passwords. Private keys. #### Key point If a secret has been leaked, removing it from the code alone may not be enough; the credential concerned may need to be revoked or renewed. ### \47. What Is Secrets Management? Secrets management covers the secure storage and management of the secrets used by applications and infrastructure. #### Core controls Access permissions. Encryption. Rotation. Audit logs. Central management. #### Example Instead of keeping the database password inside the source code, an appropriate secrets management system can be used. ### \48. What Is IaC Security Scanning? IaC scanning makes it possible to assess the security risks in infrastructure configurations. #### Example risks Publicly accessible storage. Excessive network access. Insecure identity permissions. Lack of encryption. #### Key point Static configuration analysis should be supported by checks in the live environment. ### \49. What Is Container Image Scanning? Container image scanning is the analysis of the components inside an image and the related security risks. #### Areas that can be examined Operating system packages. Application dependencies. Known vulnerabilities. Security configurations. #### Key point Image scanning does not, on its own, prevent runtime attacks. ### \50. What Is Runtime Security? Runtime security is an approach for monitoring and protecting running applications and workloads from a security perspective. #### Areas of use Suspicious processes. Unexpected network connections. Unauthorised file access. Abnormal container behaviour. #### Key point Runtime security complements preventive development controls. ### \51. API Security and DevSecOps APIs enable data exchange between enterprise applications. #### Main risks Unauthorised access. Object-level authorisation flaws. Authentication problems. Resource consumption. Insecure configurations. #### Security controls API tests. Authentication. Authorisation. Rate limiting. Logging. #### Key point API security cannot be achieved merely by using an API Gateway. ### \52. OWASP Top 10 and DevSecOps The OWASP Top 10 is an awareness resource covering the major categories of security risk in web applications. #### Purpose of use Creating security requirements. Supporting developer training. Assessing test coverage. #### Key point The scope of the OWASP Top 10 is not a substitute for a full security verification standard. ### \53. What Is OWASP ASVS? **The OWASP Application Security Verification Standard (ASVS) is a standardised framework that provides requirements for verifying the security controls of web applications.** #### Areas of use Security requirements. Application design. Security testing. Supplier assessment. ### \54. What Is NIST SSDF? **The NIST Secure Software Development Framework (SSDF) is a framework that defines secure software development practices.** #### Core practice groups Prepare the Organization. Protect the Software. Produce Well-Secured Software. Respond to Vulnerabilities. #### Key point NIST SSDF does not mandate any specific CI/CD tool or software development methodology. ### \55. What Is OWASP SAMM? **The OWASP Software Assurance Maturity Model (SAMM) is a maturity model that helps organisations assess and improve their software security practices.** #### Areas of use Current state assessment. Security maturity. Improvement plan. Process measurement. ### \56. What Is a DevSecOps Security Gate? A Security Gate is the control of whether software may move on to the next stage, based on defined security conditions. #### Example conditions Critical security findings. Dependency risks. Secret leaks. Container security. Policy violations. #### Key point Security gates should be configured according to the risk level and corporate policy. ### \57. What Is Vulnerability Management? Vulnerability management is the process of identifying, assessing, prioritising and remediating security vulnerabilities. #### Core activities Detection. Verification. Risk assessment. Prioritisation. Remediation. Retesting. #### Key point Not every vulnerability should be prioritised on the basis of its CVSS score alone. ### \58. What Are CVSS, EPSS and KEV? #### CVSS A scoring system used to assess the technical severity of a vulnerability. #### EPSS Provides a prediction of the likelihood that a given vulnerability will be exploited in the near term. #### KEV A catalogue, maintained by CISA, of vulnerabilities that are known to have been exploited. #### Key point By using these sources together, a more comprehensive risk prioritisation can be carried out. ### \59. DevSecOps and SOC Integration While DevSecOps focuses on development and deployment processes, the SOC plays a role in monitoring and responding to security events. #### Integration examples Central monitoring of security logs. Assessing application security events. Passing incident findings on to the development team. Raising security improvement requests. #### Key point The duties and responsibilities between SOC and DevSecOps processes must be clearly defined. ### \60. What Is Observability? Observability is an approach that supports understanding the internal state of a system from the data obtained externally. #### Core data types Metrics. Logs. Traces. #### Areas of use Performance analysis. Fault detection. Service relationships. Incident investigation. ### \61. What Is Prometheus? Prometheus is an open-source system used for metrics collection and monitoring. #### Areas of use System metrics. Application metrics. Alerting rules. #### Key point Prometheus is not a platform that, on its own, meets all log and distributed tracing needs. ### \62. What Is Grafana? Grafana is a platform used to visualise metrics and other observability data. #### Areas of use Dashboards. Alerts. Metric visualisation. Operational reporting. ### \63. What Is OpenTelemetry? OpenTelemetry is an open-source observability ecosystem that provides tools and standards for generating, collecting and transmitting telemetry data. #### Core data types Traces. Metrics. Logs. #### Key point OpenTelemetry is not, on its own, a monitoring platform in which all data is stored. ### \64. DORA Metrics and DevOps Performance DORA provides research and measurement approaches for assessing software delivery and operations performance. #### Common measurements Deployment frequency. Lead time for changes. Deployment-related failures. Service recovery time. #### Key point The DORA measurement model evolves over time. Organisations should state clearly which metric definitions and which version they use. ### \65. How Is DevSecOps Maturity Measured? #### Assessment areas Security policies. Code security. Automation. Dependency management. CI/CD security. Container security. Security incidents. Continuous improvement. #### Key point Maturity assessment should not be based solely on the number of security tools in use. ### \66. How Is an Enterprise DevSecOps Architecture Built? #### Stage 1: Current state analysis Development and deployment processes are examined. #### Stage 2: Risk assessment Application and supply chain risks are identified. #### Stage 3: Security requirements Development standards are established. #### Stage 4: Tool integration SAST, SCA, secret scanning and other controls are planned. #### Stage 5: CI/CD security Pipeline access and deployment controls are configured. #### Stage 6: Monitoring Security and operational telemetry is assessed. #### Stage 7: Improvement Processes are improved using findings and performance measurements. ### \67. A Sample Workflow in a DevSecOps Project Let us assume that an organisation is developing a web-based CRM application. #### Step 1 The developer pushes the code change to the Git repository. #### Step 2 The code review process is started. #### Step 3 The CI pipeline runs the automated tests. #### Step 4 SAST and SCA checks are performed. #### Step 5 Secret scanning is carried out. #### Step 6 The container image is built and scanned. #### Step 7 The application is deployed to the test environment. #### Step 8 DAST and related integration tests are performed. #### Step 9 The defined security and quality conditions are assessed. #### Step 10 After the appropriate approval process, the application goes live. #### Step 11 Application logs and security events are monitored. #### Key point This example is a general workflow. Every organisation's technologies and risks may differ. ### \68. Common Mistakes in DevSecOps Implementations #### Only buying tools The lack of processes and accountability may persist. #### Not interpreting security scans False positives or insignificant findings can increase the workload. #### Not restricting pipeline permissions The deployment infrastructure can create risk. #### Keeping secrets in code It can lead to credential leakage. #### Leaving security testing until the end It can increase the cost of remediation. #### Not monitoring the live environment Runtime threats may be noticed late. ### \69. What Does DevSecOps Consulting Cover? DevSecOps consulting may include different activities depending on the organisation's needs. #### Example services Current state analysis. Maturity assessment. Security architecture. CI/CD security. SAST integration. DAST integration. SCA integration. Container security. Kubernetes security. Training. #### Key point The scope of the service should be determined according to the existing infrastructure, the number of applications, the technologies and the objectives. ### \70. SECURESYS DevOps and DevSecOps Services SECURESYS provides technical services and consulting aimed at integrating security controls into organisations' software development and operations processes. #### DevSecOps Current State Analysis Development, testing, deployment and security processes are assessed. #### Secure Software Development Consulting Support is provided in establishing security requirements and development standards. #### Source Code Analysis Security risks in the software source code are assessed. #### Web and API Security Testing Security tests of applications are carried out. #### CI/CD Security Integration Support is provided in integrating automated security checks into pipeline processes. #### Open-Source and Dependency Security Risks associated with third-party software components are assessed. #### Container and Kubernetes Security The security configurations of container and orchestration environments can be reviewed. #### Security Monitoring and SOC Integration Monitoring application security events and relating them to the relevant processes can be supported. #### DevSecOps Training The competencies of software teams in secure development and security automation can be supported. **In the SECURESYS approach, DevSecOps aims to stop security from being a separate check at the end of the software development process and to integrate it into the design, development, testing, deployment and operation stages.** #### Frequently Asked Questions (FAQ) #### \1. What is DevOps? It is an approach that supports collaboration, automation and continuous improvement in software development and operations processes. #### \2. What is DevSecOps? It is an approach that aims to integrate security into software development and operations processes. #### \3. What is the difference between DevOps and DevSecOps? DevSecOps emphasises the systematic application of security controls within DevOps processes. #### \4. What is CI/CD? It refers to practices aimed at automating code integration, testing, and software delivery and deployment processes. #### \5. What is Docker? It is a platform that offers technologies for packaging and running applications as containers. #### \6. What is Kubernetes? It is an open-source platform that provides orchestration for container-based applications. #### \7. What is GitOps? It is an approach based on managing the desired state of systems through Git. #### \8. What is Infrastructure as Code? It is the management of infrastructure resources through code or declarative configurations. #### \9. What is SAST? It is the static security analysis of source code or related software components. #### \10. What is DAST? It is the dynamic security analysis of a running application. #### \11. What is SCA? It is the analysis of third-party and open-source software components. #### \12. What is an SBOM? It is a structured inventory of the components that make up a piece of software. #### \13. What is secret scanning? It is a control that aims to detect secrets in source code and related environments. #### \14. What is container security? It is an approach covering the security of container images, the runtime and the related infrastructure. #### \15. What is Kubernetes security? It is the management of Kubernetes access, network, workload and configuration security. #### \16. What is Shift Left Security? It is the movement of security checks to the early stages of the development process. #### \17. What is Shift Right Security? It is an approach focused on monitoring security and operational behaviour in the live environment. #### \18. What is NIST SSDF? It is the NIST framework that defines secure software development practices. #### \19. Which tools are used for DevSecOps? SAST, DAST, SCA, secret scanning, container scanning and CI/CD tools can be used. #### \20. Why is DevSecOps consulting important? It can help an organisation assess, automate and improve its secure software development processes. ### Conclusion: Why Are DevOps and DevSecOps Important for Organisations? DevOps supports collaboration and automation between software development and operations teams. DevSecOps aims to integrate security activities into the software development life cycle. CI/CD processes provide automation of code integration, testing and deployment activities. Docker and Kubernetes support the packaging and management of container-based applications. Infrastructure as Code and GitOps provide automation and traceability in infrastructure management. Security controls such as SAST, DAST and SCA help identify different risks. SBOM and software supply chain security increase visibility into the components used and the development processes. Frameworks such as NIST SSDF and OWASP SAMM support the assessment of secure development practices. **The core aim of a successful DevSecOps approach is not merely to deploy software faster; it is to make security, quality, traceability and sustainability an inseparable part of the software development and operation processes.** ### Sources and References **NIST Secure Software Development Framework:** https://csrc.nist.gov/projects/ssdf **OWASP Software Assurance Maturity Model:** https://owaspsamm.org **OWASP Application Security Verification Standard:** https://owasp.org/www-project-application-security-verification-standard/ **OWASP Top 10:** https://owasp.org/www-project-top-ten/ **OWASP API Security:** https://owasp.org/www-project-api-security/ **Docker Documentation:** https://docs.docker.com **Kubernetes Documentation:** https://kubernetes.io/docs/ **OpenGitOps:** https://opengitops.dev **Terraform Documentation:** https://developer.hashicorp.com/terraform/docs **Ansible Documentation:** https://docs.ansible.com **OpenTelemetry:** https://opentelemetry.io **DORA:** https://dora.dev **SLSA:** https://slsa.dev **SPDX:** https://spdx.dev **CycloneDX:** https://cyclonedx.org **CISA Known Exploited Vulnerabilities:** https://www.cisa.gov/known-exploited-vulnerabilities-catalog