DevSecOps - Revision history

Tom: /* References */

2025-05-19T18:12:04Z

‎References

Tom: /* Continuous Integration/Continuous Delivery */

2023-07-05T00:20:51Z

‎Continuous Integration/Continuous Delivery

Tom: /* Continuous Integration/Continuous Delivery */

2023-07-05T00:19:26Z

‎Continuous Integration/Continuous Delivery

Tom: /* Solutions */

2023-07-05T00:18:22Z

‎Solutions

Tom: /* Full Title or Meme */

2023-07-04T20:55:45Z

‎Full Title or Meme

Tom: /* Context */

2023-06-28T00:13:53Z

‎Context

Tom: /* Solutions */

2022-07-22T00:52:41Z

‎Solutions

Tom: /* Solutions */

2022-07-22T00:47:56Z

‎Solutions

Tom at 00:44, 22 July 2022

2022-07-22T00:44:25Z

Tom: /* Solutions */

2022-04-29T00:02:41Z

‎Solutions

← Older revision		Revision as of 18:12, 19 May 2025
Line 29:		Line 29:
	==References==		==References==

		+	[[Category: Programming]]
	[[Category: Best Practice]]		[[Category: Best Practice]]

@@ Line 17: / Line 17: @@
 Agency (CISA) are releasing this cybersecurity information sheet (CSI) to provide
 recommendations and best practices for improving defenses in cloud implementations
-of development, security, and operations (DevSecOps). This CSI explains how to
+of development, security, and operations [[DevSecOps]]. This CSI explains how to
 integrate security best practices into typical software development and operations
 (DevOps) Continuous Integration/Continuous Delivery (CI/CD) environments, without
@@ Line 24: / Line 24: @@
 cloud deployments. As evidenced by increasing compromises over time, software
 supply chains and CI/CD environments are attractive targets for malicious cyber actors
-(MCAs). Figure 1 provides a high-level representation of threats to various parts of the
+(MCAs).<ref>NSA and CISA, ''Defending Continuous Integration/Continuous
 Delivery (CI/CD) Environments'' (2021-06-28) https://media.defense.gov/2023/Jun/28/2003249466/-1/-1/0/CSI_DEFENDING_CI_CD_ENVIRONMENTS.PDF</ref>

@@ Line 25: / Line 25: @@
 supply chains and CI/CD environments are attractive targets for malicious cyber actors
 (MCAs). Figure 1 provides a high-level representation of threats to various parts of the
-CI/CD pipeline<ref>Defending Continuous Integration/Continuous
+CI/CD pipeline<ref>NSA and CISA, ''Defending Continuous Integration/Continuous
-Delivery (CI/CD) Environments (2021-06-28) https://media.defense.gov/2023/Jun/28/2003249466/-1/-1/0/CSI_DEFENDING_CI_CD_ENVIRONMENTS.PDF</ref>
+Delivery (CI/CD) Environments'' (2021-06-28) https://media.defense.gov/2023/Jun/28/2003249466/-1/-1/0/CSI_DEFENDING_CI_CD_ENVIRONMENTS.PDF</ref>
 ==References==
 [[Category: Best Practice]]

@@ Line 12: / Line 12: @@
 * [https://software.af.mil/dsop/ DoD Enterprise DevSecOps Initiative (DSOP)]<blockquote>The DSOP is joint effort of the DOD’s Chief Information Officer, Office of the Undersecretary of Defense for Acquisition and Sustainment. The services focus on bringing automated software tools, services and standards to DOD programs so that warfighters can create, deploy, and operate software applications in a secure, flexible, and interoperable manner.</blockquote>
 * [https://www.nccoe.nist.gov/sites/default/files/2022-07/dev-sec-ops-project-description-draft.pdf SOFTWARE SUPPLY CHAIN AND DEVOPS SECURITY PRACTICES Implementing a Risk-Based Approach to DevSecOps] NIST/NCCoE draft 2022-07 <blockquote>DevOps brings together software development and operations to shorten development cycles, allow organizations to be agile, and maintain the pace of innovation while taking advantage of cloud-native technology and practices. Industry and government have fully embraced and are rapidly implementing these practices to develop and deploy software in operational environments, often without a full understanding and consideration of security. Also, most software today relies on one or more third-party components, yet organizations often have little or no visibility into and understanding of how these components are developed, integrated, and deployed, as well as the practices used to ensure the components’ security. To help improve the security of DevOps practices, the NCCoE is planning a DevSecOps project that will focus initially on developing and documenting an applied risk-based approach and recommendations for secure DevOps and software supply chain practices consistent with the Secure Software Development Framework (SSDF), Cybersecurity Supply Chain Risk Management (C-SCRM), and other NIST, government, and industry guidance. This project will apply these DevSecOps practices in proof-of-concept use case scenarios that will each be specific to a technology, programming language, and industry sector. Both commercial and open-source technology will be used to demonstrate the use cases. This project will result in a freely available NIST Cybersecurity Practice Guide.</blockquote>
 ==References==
 [[Category: Best Practice]]

@@ Line 1: / Line 1: @@
 ==Full Title or Meme==
-Development, Security, Operations is like DevOps, except that a security layer if placed between Development and Operations.
+Development, Security, Operations is like DevOps, except that a security layer is placed between Development and Operations.
 ==Context==

@@ Line 3: / Line 3: @@
 ==Context==
-This particular morph of DevOps seems to have originated in the US DoD to solve problems like Solar Winds where Developers can place code directly into operations without a security check first.
+This particular morph of DevOps seems to have originated in the US DoD to solve problems like SolarWinds where Developers can place code directly into operations without a security check first.
 * The DoD [https://repo1.dso.mil/users/sign_in Repo One] was created to enable any development org to create app that could run on [https://p1.dso.mil/#/ Platform One]
 ===Supply Chain===
 There is increasing recognition that DevSecOps should also encompass software supply chain security. Most software today relies on one or more third-party components<ref>J. Boyens et al., Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, National Institute of Standards and Technology (NIST) Special Publication (SP) 800-161 Revision 1, Gaithersburg, Md., May 2022, 326 pp.  https://doi.org/10.6028/NIST.SP.800-161r1</ref>
 ==Solutions==
 * [https://software.af.mil/dsop/ DoD Enterprise DevSecOps Initiative (DSOP)]<blockquote>The DSOP is joint effort of the DOD’s Chief Information Officer, Office of the Undersecretary of Defense for Acquisition and Sustainment. The services focus on bringing automated software tools, services and standards to DOD programs so that warfighters can create, deploy, and operate software applications in a secure, flexible, and interoperable manner.</blockquote>