DevSecOps best practices – processes
We previously mentioned a CI/CD pipeline as a common way to develop and deploy modern applications.
Now, let us deep dive into each step in the CI/CD pipeline and see how we can implement security into the process.
Before we deep dive into DevSecOps and how to embed security controls as part of a CI/CD pipeline, let us review a sample CI/CD workflow:
Figure 16.2 – A sample DevSecOps pipeline
Let’s understand what’s happening in this workflow:
- A developer writes code in their IDE.
- The developer commits the code changes to a Git repository.
- A build server initiates a build process.
- The build server initiates various security tests (from detecting secrets in configuration, code vulnerabilities, vulnerable packages, and misconfiguration in infrastructure as code (IaC)).
- Once all security tests pass, the build server creates a container image and uploads it to an...
