Understanding the DevSecOps ecosystem
In the previous chapter, we discussed security principles and how this impacts the DevOps way of working. We concluded that security must be at the heart of every step in the development and deployment cycle, from the moment where code is pulled from a repository to the actual code commit and push to production. In this chapter, we will look at the foundation of DevSecOps, DevOps that has security embedded.
DevSecOps consists of three layers:
- Culture: This is not a technical layer, but it's often forgotten that DevOps is much more than just applying tools and creating CI/CD pipelines. Obviously, the same applies to DevSecOps. Within DevSecOps, every team member feels responsible for security and acts accordingly, taking ownership of it. This doesn't mean that security specialists have become obsolete, though. It's a good practice to have a security engineer or professional in the team, sometimes referred to as the security...
