USE OF DEVSECOPS APPROACH FOR INFORMATION SECURITY THREATS ANALYSIS
Віталій Сусукайло · Cybersecurity Education Science Technique · 2021
This article presents a study of the use of the DevSecOps approach to analyze modern threats. Defines a methodology to implement and adapt the DevSecOps approach. DevSecOps is presented in this article as an approach to the culture of developing, automating and designing an information platform that integrates security as a shared responsibility throughout the software development lifecycle. The approach described in this article helps to solve the problem of implementing security controls in the software development process. This approach allows organizations to continually integrate security into SDLC so that DevOps teams can quickly and efficiently develop secure applications. The possibility of implementing security in the early stages of software development in the workflow is being investigated, as it will allow to identify and eliminate security vulnerabilities and vulnerabilities faster. This concept is part of the "left shift" that shifts security testing to developers, allowing them to fix security issues in their code almost in real time, rather than waiting until the end of the SDLC, where security has been embedded in traditional development environments.Describes DevSecOps approach as business processes, which minimize the risks associated with modern threats and zero-day vulnerabilities. SAST (Static Application Security Testing), DAST (Dynamic Application Security Testing), SCA (Software Composition Analysis) analysis was used to assess the possibilities of using these technologies to optimize the process of secure software development. The DevSecOps process is presented for organizations that can easily integrate security into their existing practices of continuous integration and continuous delivery (CI / CD). The DevSecOps process in this article covers the entire SDLC from planning and design to coding, testing, and release, with continuous real-time feedback, and defined DevSecOps process technical controls in accordance with ISO 27001/02 and NIST standards.