Composing the DevSecOps pipeline
Let's look at a common DevOps pipeline first. The basic pipeline is shown in the following diagram:
Figure 12.1 – DevOps pipeline
The basic steps in the pipeline are as follows:
- Pull code from the repository
- Build
- Test
- Deploy
In DevSecOps, we are embedding security into the pipeline, making security standards and policies an integrated part of it. Security is a layer that is applied to every step in the pipeline, but it does include several steps. This is shown in the following diagram:
Figure 12.2 – DevSecOps pipeline
These steps are as follows:
- Dependency check: First, any vulnerability that exposes the code to the risk of an exploit should be removed. This includes code that relies on other pieces of code to run. There are differences in code dependencies: developers can have controlled and uncontrolled dependencies. As a common practice, we don...
