Module 18 of 20 — Professional Practice

DevSecOps & Secure SDLC

Modern software delivery requires embedding security throughout the development pipeline. DevSecOps combines DevOps velocity with security assurance. This module covers secure software development lifecycle practices and CI/CD security automation.

Security at Each SDLC Phase

Security activities map directly to development lifecycle stages. Early integration (shift-left) reduces cost and improves efficacy dramatically.

Requirements Gathering

Activities:
  • Define security requirements alongside functional requirements
  • Identify compliance obligations (GDPR, HIPAA, PCI)
  • Perform high-level threat modeling
  • Define security acceptance criteria
Deliverables:
  • Security requirements document
  • Initial threat model
  • Compliance checklist
  • Abuse cases

Architecture & Design

Activities:
  • Detailed threat modeling (STRIDE/PASTA)
  • Security architecture review
  • Data flow analysis and trust boundary identification
  • Select security patterns and controls
Deliverables:
  • Threat model report
  • Security architecture diagram
  • Risk register
  • Mitigation plan

Implementation / Coding

Activities:
  • Secure coding standards enforcement
  • Static Application Security Testing (SAST)
  • Pre-commit security hooks (secrets scanning)
  • Peer code reviews with security focus
Deliverables:

    Testing

    Activities:
    • Dynamic Application Security Testing (DAST)
    • Software Composition Analysis (SCA)
    • Dependency vulnerability scanning
    • Interactive Application Security Testing (IAST)
    • Penetration testing (before release)
    Deliverables:

      Deployment & Release

      Activities:
      • Infrastructure as Code (IaC) scanning
      • Container image signing and verification
      • Runtime Application Self-Protection (RASP)
      • Secret management and key rotation
      • Compliance gate verification
      Deliverables:

        Maintenance & Operations

        Activities:
        • Continuous monitoring and logging
        • Patch management and vulnerability remediation
        • Security incident response readiness
        • Periodic security audits and assessments
        Deliverables:

          Shift-Left Security Practices

          Shift-left integrates security earlier in development to catch issues before they reach production.

          Security Requirements in User Stories

          Include acceptance criteria for authentication, authorization, input validation, encryption, logging.

          Tip

          Impact: Catch missing security controls at earliest stage—cost to fix is 6–15× lower than post-deployment.

          Threat Modeling Early

          Conduct threat modeling during design phase, before any code is written.

          Tip

          Impact: Architectural fixes cost 30–100× less than re-architecting after deployment.

          Automated Security Gates

          SAST/DAST/SCA in CI/CD pipeline—fail build on critical vulnerabilities.

          Tip

          Impact: Prevents vulnerable code from reaching production; shifts detection from weeks to minutes.

          Developer Security Training

          Regular secure coding workshops, OWASP Top 10 training, code review mentoring.

          Tip

          Impact: Prevents vulnerabilities at source—developer education reduces defect density by 40–60%.

          CI/CD Pipeline Security Controls

          Every pipeline stage introduces security gates. Automation ensures consistency.

          Source Stage

          Branch protection (no force push)Code ownership and review requirementsSecret scanning (pre-commit hooks)Signed commits verification

          Build Stage

          SAST scanningDependency vulnerability check (SCA)Software Bill of Materials (SBOM) generationContainer image scanning

          Test Stage

          DAST scanningIntegration security testsInfrastructure compliance checks (terraform validate)Secrets detection

          Deploy Stage

          Image signing (cosign)Policy checks (OPA/Kyverno)Canary rollout with monitoringRuntime security enforcement

          Run Stage

          Runtime behavior monitoring (Falco)WAF rule enforcementAnomaly detectionAudit logging to SIEM

          Container & Kubernetes Security

          Containerized workloads require hardening at multiple layers—image, runtime, and orchestration.

          Base Image

          Vulnerable OS packages, unnecessary utilities, root user.

          Remediation:Use minimal images (Alpine, distroless), non-root user, regular updates.

          Dependencies

          Vulnerable libraries (Log4Shell), outdated packages.

          Remediation:SCA scanning (Trivy, Snyk), automated dependency updates, SBOM inventory.

          Runtime

          Privilege escalation, container escape, resource exhaustion.

          Remediation:Seccomp/AppArmor profiles, read-only filesystems, resource limits, user namespaces.

          Orchestration

          Kubernetes misconfigurations (privileged pods, hostPath mounts).

          Remediation:K8s security scanners (kubesec), PodSecurity Standards, network policies, RBAC.

          Key Takeaways

          • Shift-left security reduces cost by 10–30× compared to post-deployment fixes.
          • Automated security gates in CI/CD prevent vulnerable code from reaching production.
          • Container security spans base images, dependencies, runtime, and orchestration.
          • Security as code enables versioning, review, and automated enforcement.
          Module 18 of 20
          Laws & EthicsNext: Threat Intelligence