Getting DevSecOps-savvy
Security starts with access to the repositories, the source of code where the DevOps cycle begins. As we've learned so far, we want to automate as much as we can in development, testing, and deployment. Next, by adopting DevOps, businesses want to speed up the development and deployment of new applications and features. Speed and agility might lead to security risks, because code is not sufficiently tested or, worse, it's pushed to production without applying the proper security policies to gain time. Let's illustrate that with a real-life example.
Developers fork code from the repository and start working on that code. At a certain stage, it needs to be pushed to designated infrastructure to run that code. In development, the code runs fine, since it's not interfacing yet with production systems. As soon as the code is ready to release in production, it will need to establish those connections. Commonly, in enterprises, specific routing...
