Abstract.
Involving security in DevOps has been a challenge because traditional security methods have been unable to keep up with DevOps’agility and speed. DevSecOps is the movement that works on develop-ing and integrating modernized security methods that can keep up with DevOps.This study is meant to give an overview of what DevSecOpsis, what implementing DevSecOps means, the benefits gained from De-vSecOps and the challenges an organization faces when doing so. To that end, we conducted a multi vocal literature review, where we reviewed aselectionofgreyliterature.Wefoundthatimplementingsecuritythatcan keep up with DevOps is a challenge, but it can gain great benefits if done correctly.
Keywords:DevSecOps,DevOps,Security, Multivocal Literature Re-view
Introduction
In recent years a large part of software development companies have changedfocus from developing software as a product (SaaP), where companies developedthe software and delivered a finished product to a customer that then installedandranitlocally,todevelopsoftwareasaservice(SaaS),wheresoftwareiscen-trallyhostedonacloudinfrastructureandaccessedthroughforexampleaweb-browser[1],orotherchannelsthatdeliversitdirectlytoacustomer’smachineor device [2]. The use of it is then offered through licensing and subscriptions.With SaaS, the customers do not control the underlying cloud infrastructure orthe application’s functionality [1], as that is done by the provider. This givesthe provider the opportunity to continuously improve and deliver their soft-ware without having to redistribute it to all their clients as they simply updatethe software on their own cloud infrastructure. This modern software engineer-ingprocessofdevelopingwhilecontinuouslyintegratinganddeliveringsoftwareis complex. Continuous integration (CI) means to automatically integrate newcode from several developers into the same version of the software and at thesametime,checkforerrors[3].ContinuousDelivery(CD)meanstodeploynewsoftware to production, with the differing factor from traditional software de-ployment being the frequency of deployment, which can happen multiple timeseveryday[3].”Continuousdeliveryenablesbusinessestoreducecycletimesoastogetfasterfeedbackfromusers,reducetheriskandcostofdeployments,get
bettervisibilityintothedeliveryprocessitself,andmanagetherisksofsoftwaredelivery more effectively.” [4]. These processes require a large number of toolsandinformationsystems[5].Theseprocesses,toolsandsystemsareoftenman-agedbyindependentoperationsteams[6].ManychallengeswhenimplementingCI/CD resulted from lack of collaboration and communication between the op-erators and developers [2][3][6][7]. Attempts at overcoming these challenges haveresultedinaconcept,termedDevOps[2].
DevOps is described as the ”conceptual and operational merging of devel-opment and operations’ needs, teams, and technologies” [6]. This merging ismeanttoaligntheprioritiesofthedevelopmentteamsandoperationsteamssothey work together towards a common goal of successful project execution [6] bycooperatingonsoftwaredevelopmentanddeployingthatsoftwareintoproduc-tion [2]. This can be done by involving operations in all development stages, bydevelopers and operators collaborating to solve problems, make processes andproducts that can be automated, and agree on and develop metrics that everyonecan make use of [8]. This reflects the four main principles of DevOps: culture,automation,measurementandsharing(CAMS)[4][2].
As DevOps has become more popular, many organizations are adopting thepractices associated with it. However, a survey by the HPE Security Fortifyteam[9]from2016showsthatwhilemanybelievethatsecurityshouldbeapartofDevOps,securityisnotsomethingmanyDevOpsprogramshaveincludedaspartoftheirprocess.Gartnerestimatesin[10]thatlessthan20%of”enterprisesecurity architects have engaged with their DevOps initiatives to actively andsystematicallyincorporateinformationsecurityintotheirDevOpsinitiatives”.
[10] points to management, developers, and operators viewing security as aninhibitortotheagilityandspeedrequiredinDevOpspractices,likeCIandCD,asonereasonforthis.
The need for security in DevOps is met by DevSecOps. This concept is anattemptatcreatingandincludingmodernsecuritypracticesthatcanbein-corporated in the fast and agile world of DevOps. It promotes an extension toDevOps’ goal of promoting collaboration between developers and operators byinvolvingsecurityexpertsfromthestartaswell[11].
Since DevSecOps is a new trend, it is important to obtain an overview ofthe practices and experiences accumulated on the subject. There is not a lot ofresearch on DevSecOps, but a search of available literature shows: [12] is a studythat through Internet artefacts and a survey looks at practitioners experienceswith DevSecOps and the practices they perform, [11] is a systematic mapping(SM)studyonwhatisbeingresearchedinthefieldanditshowedresearchwas being conducted on the aspects of ”a definition, security best practices,compliance, process automation, tools for DevSecOps, software configuration,team collaboration, availability of activity data and information secrecy”. Asearch for systematic reviews or mappings on continuous processes (CI/CD)used in DevOps, resulted in a several results. Examples are: [13] examines theimpact agile release engineering (ARE) and the continuous processes involvedhadonsoftwareengineering.[14]mapsliteraturerelatedtoCDandprovidesan
analysis of the benefits and challenges related to CD. [15] uses a literature reviewtoshowdifferencesinhowCIisdonefordifferentcases.NoneoftheliteraturewefoundgivesacollectedoverviewofDevSecOpsandwhatitis.
To the best of authors’ knowledge, there is not a systematic literature reviewon DevSecOps or a large body of scientific work related to DevSecOps. Thisabsence of works devoted to the topic lead us to the need to work on the topicusingatoollikemultivocalliteraturereview,intendedtobridgethegapbetweenprofessionalandscientificliterature.Bythismean,authorsexaminetheconceptof DevSecOps, how it has evolved since it was first introduced, and the challengesandbenefitsDevSecOpsbringstoanorganization.
The rest of this paper is structured as a systematic literature review. Insection2themethodologyfortheresearchispresented.Insection3wepresentthe results from our study. In section 4 we conclude on our paper, summarizetheresultsandsuggestfuturework.
ResearchMethodology
Inthissection,anoverviewofourresearchmethodologyispresentedfollowedbyanoverviewofthesystematicapproachusedtogatherrelevantliterature.
MultivocalLiteratureReview
After an initial search on literature to learn more on the topic of DevSecOps,we could not find a substantial body of academic research on the topic. Wetherefore decided to conduct a multivocal literature review (MLR). Multivocalliteratureisdefinedasallaccessibleliteratureonatopic[16].Thisincludes,butis not limited to: blogs, white papers, articles and academic literature. By usingthis variety of literature the results will give a more nuanced look at the topic,since it includes the voices and opinions of academics, practitioners, independentresearchers,developmentfirmsandotherswithexperience[16].
PreviouslypublishedMLRsincludebutisnotlimitedto:[17]isanMLRon automated software testing and the proposed guidelines from practitionersand researchers for when and what to automate. [18] is an MLR providing anoverviewofDevOps.[19]isanMLRonsoftwaretestmaturityassessmentsandtestprocessimprovement.
To the best of our knowledge, this is the first MLR on the topic although itisnotthefirstforDevOps.
[20] points to the importance of MLRs in software engineering (SE) fieldsby stating that SE practitioners produces multivocal literature on a great scale,butthatitisnotpublishedinacademicforums.Theymentionhowever,thatnot including that literature in systematic reviews means researchers miss outonimportantcurrentstate-of-the-artpracticeinSE.
ResearchQuestions
ThisMLRisconductedtoobtainanunderstandingofwhatDevSecOpsis,howithasevolvedandthechallengesandbenefitsofadoptingsuchanapproach.Tospecifythegoalofthispaper,fourresearchquestionswereformulated:ResearchQuestion1:HowdoestheliteraturedefineDevSecOps?
ResearchQuestion2: Whatare the characteristics ofDevSecOps?ResearchQuestion3:WhatarethemainexpectedbenefitsandchallengesofadoptingDevSecOps?
ResearchQuestion4:Sinceitwasfirstmentioned,howhasDevSecOpsevolved?
Studyprotocol
Thestudyprotocoldescribesthesystematicwaywefoundtheliteratureusedin our study. This section lists the databases used in the search, what searchstrategy was used to find related literature, the inclusion and exclusion criteriausedtofindthemostrelevantliterature,andtheprocessinwhichwecataloguedtheliterature.
DatabasesFor this MLR we used Google’s search engines to find relevantliterature:
GoogleSearch(http://www.google.com/)tolocategreyliterature(whitepapers,blogs,articlesetc.)
GoogleScholar(http://scholar.google.com/)tospecificallylocateavailableacademicliterature.
Google’s search engines was chosen over more precise search engines (like SpringerLink, ACM Digital Library, IEEE Explore etc.) because DevSecOps is a very newtopic and very little academic research is available. We therefore knew before-hand that this literature review would rely mostly on the grey literature it wouldfind,whichGoogle’ssearchengineswouldbeabletolocate.
Search Terms DevSecOps is a new term based on adding the term ”SECurity”to DevOps which stands for ”DEVeloper” and ”OPeration”. There is not a con-sensusinthefieldontheorderingofthewords,sothesearchtermsmustcoverall possible permutations. The search string must also be made to find relevantliteratureaccordingtotheRQs.Thesearchstringusedisthereforeasfollows:
("DevSecOps"OR"SecDevOps"OR"DevOpsSec")AND
("definition"OR"characteristics"OR"challenges" OR "benefits"OR"evolution").
Study Selection Once initial search results were retrieved, a procedure toexcludeirrelevantpaperswereconductedusingthefollowinginclusionandex-clusioncriteria:
Inclusioncriteria:
LiteraturethatexplicitlydiscussDevSecOps.
LiteraturethatexplicitlydiscussDevOpsandSecurity,particularlythechallengesandbenefits.
LiteraturediscussingthepresentchallengestoDevSecOps.LiteraturediscussingthebenefitsofDevSecOps.
LiteraturethatdiscussthedefinitionofDevSecOps.Literaturepublishedafter2014.
Includeonlythe5firstpagesonGoogleSearch.
Exclusioncriteria:
Literaturethatisinaccessible.
Results Google Search deems tosimilar to other results.
Vendorstooladvertisements.
Search Procedure The process is as follows: First we perform an advancedsearch in Google Search and Google Scholar. To let Google’s search engine putprimary focus on the different RQs, the term will be split into 5 parts, eachfocusing on all permutations of DevSecOps and one of the words related to theRQs. The 5 search strings can be seen in 1. For each search we then read theliterature systematically applying the remaining inclusion and exclusion criteria,selectingonlyrelevantliteraturefortheprimarystudy.Theprocessisvisualizedinfigure1:
Fig.1.Anoverviewofthesearchprocesstofindrelevantliteratureforthisstudy.
Results
Inthefollowingsectionweshowtheresultsfromexecutingoursearchfollowedbyourreviewoftheliteratureinconjunctionwithourresearchquestions.
SearchExecution
Thesearchwasperformedonduringthefirstquarterof2017.Theinitialsearchgave 284 results. After applying the inclusion and exclusion criteria 52 resultswereleft.Table1summarizesthesearch:
SearchEngineInitialResultsTitle,abstract,keywordsandMetatextFulltext
GoogleScholar
34
4
2
GoogleSearch
250
62
50
Table1.Summaryofsearchresultsforprimarystudy
RQ1-howitisdefined
In the literature we reviewed there seemed to be a consensus on what DevSec-Ops is seen as. DevSecOps is seen as a necessary expansion to DevOps, wherethepurposeistointegratesecuritycontrolsandprocessesintotheDevOpssoft-ware development cycle [21] and that it is done by promoting the collaborationbetweensecurityteams,developmentteamsandoperationsteams[11].
RQ2-DevSecOpscharacteristics
When reviewing the literature, the features that stood out as characterizing De-vSecOpsweretheprinciplesseenasthebasisandreasoningforDevSecOpsandthe practices used when implementing security into their software developmentprocesses.
Principles: The principles that characterize DevSecOps are based on DevOpsand the CAMS principles [4][22], culture, automation, measurement, and shar-ing,butwiththeadditionofaddingsecurityfromthestart:
Culture:ADevOpsculturepromotescollaborationbetween developmentteamsandoperationteams[4],wheretheyallacceptthattheyareresponsiblefor delivering software to an end-user[2]. DevSecOps means to include collab-orationwiththesecurityteamaswellaspromoteaculturewhereoperationsand development also work on integrating security in their work [11] [23]. Thatmeans involving the security team from the planning stages, and making sureeveryoneagreesthatsecurityiseveryone’sresponsibilities[24][25].Togetevery-one to think security, practitioners points to creating a common mindset withregardstosuccessbydevelopingasetametricsthateverybodyagreesonand
can use [25], promote customer focus by creating an alignment of business andsecurity strategies to ensure just right and enough security that everyone in anorganizationcansupportandimplement[26][27].
Automation:In DevOps the automation of build, deployment, and testing isimportant to achieve rapid development, deployment [4][22], and feedback fromend-users[2]. DevSecOps promotes a focus on automating security as well, to beabletokeepupwiththespeedandscaleachievedbyDevOps.Theaimshouldbe100% automation of securitycontrols,wherethe controls can be deployedand managed without manual interference [28]. It is important to implementautomatic security in a way that does not hinder DevOps’ agility in any way,whichcancausefriction[29][27][10].
Measurement:In DevOps measurements include monitoring business metricssuch as revenue and key performance indicators, like the effect new releases haveon the stability of a system, in order to know the current state and finding outhowtoimproveit[4][2].DevSecOpspromotestheuseanddevelopmentofmet-rics that track threats and vulnerabilities throughout the software developmentprocess [10]. Automatic security controls throughout the software developmentprocess means metrics are available to track threats and vulnerabilities in real-time and that allows the organization to verify how good an application is ondemand[22].
Sharing:InDevOpsdevelopersandoperatorsshareknowledge,developmenttools, and techniques to manage the process [4] [2]. DevSecOps promotes theinclusionofthesecurityteaminthesharingpromotedinaDevOpsenvironment.By letting security teams know about the challenges faced by operators anddevelopers,andviceversa,thesecurityprocessestheydevelopwillbeimproved[22].
Shift securityto theleft:Inthetraditionalsoftwaredevelopmentprocess,se-curity is a step close to the end of the process. DevSecOps promotes a shift totheleftforsecurity,whereitistobeincludedineverypartofthesoftwaredevel-opmentprocess[23].Thismeansthatsecurityteamsareinvolvedfromtheveryfirst planning step and is part of planning every iteration of the developmentcycle [29][30]. It also means security is there to help developers and operatorsonsecurityconsiderations[28][31][24].
Practices:SeveralpracticesforDevSecOpswerepointedtointheliterature:
Threat modeling and risk assessments: Practicing secure DevOps means thatorganizations have to develop expertise and processes to best discover, protectagainst, and find solutions to threats and risks [32], preferably ahead of time[25].Performingriskassessmentsfromthefirstplanningstageandcontinuouslybeforeeveryiterationisimportantasawaytoprioritizerisks,examinecontrolsalready in place and decide which are needed going forward [33] [21]. Threatmodelingisanothermethodwhereyouattackyoursystemonpaperearlyinthe development cycle to identify how an attack can occur and where it is mostlikelytohappen[34].
Continuous testing: Automatic security controls at every part of the soft-ware development process is important for security assurance and allows teststocontinuouslyscancodeforchanges[34][32],continuouslydetectanomalies,andautomaticrollbackofcodewhenneeded[21][24].
Monitoring and logging: When automating security controls throughout thesoftwaredevelopingprocessitisimportantforthoseinvolvedtobeabletogen-erate evidence on demand that controls are working and that they are effective[35]. To that end, it is important to monitor every part of the inventory and tologeveryresource[25][33][21].
Securityascode:Thismeanstodefinesecuritypolicies,forexampleintegra-tiontesting,andnetworkconfigurationandaccess,andwritescriptedtemplatesor configuration files that can be implemented into the development process fromthe start of the project. These codified security policies can then be activatedautomatically according to schedules or be activated by user (simple push of abutton),andbestoredinacentralrepositoryforreuseonnewprojects[36].
Red-Teamandsecuritydrills:Tostayaheadofpossibleattackers,practition-ers of DevSecOps create a Red-Team that runs security drill on the deployed soft-ware. They have the task of finding and exploiting vulnerabilities in the system[25][34].Thisnotonlyhelpstofindsecurityflaws,butimprovesmeasurements,and helps the organization find solutions [26]. The point of the Red-Team is tohave people that never claim something can’tpossibly happen.
RQ3-Benefits
The following section provides an overview, according to the literature, of thebenefitsgainedfromDevSecOpsanditspractices:
Shiftingsecuritytotheleft:Byinvolvingsecurityexpertsfromthestartofthe development process it is easier to plan and execute integration of securitycontrolsthroughoutthedevelopmentprocesswithoutcausingdelaysorcreatingissuesby implementing securitycontrols after systemsare running [29].
Automating security: This allows security controls to be fast, scalable andeffectivethusmakingitpossibletokeepahighpacefordetectingerrors,alertingabouttheerrors,fixingtheerrors,findingcountermeasuresforfutureerrorsand forensics to identify why an error occurred [37]. This not only helps tolower risk and time spent on errors, but also makes it easier to understand riskand create policies and procedures [38]. The automation allows processes to beconsistent and repeatable, with predictable outcomes for similar tests, it allowslogging and documentation to be automatic [39] and letting security tests berun at the push of a button frees up developers time to write code instead ofrunningtests[40].Thisalsoreducestheriskforhumanerror[39].Theabilitytostoresecuritypolicytemplatesthatiscreatedduringadevelopmentprocessina central repository means that security teams don’t need to manually configureeverynewenvironmentwhenstartinganewprojectwhichfreessecurityexpertsfrommanual,repetitiveandunproductivework[36].
Value: [41] [38] points to how security missteps can be very expensive and thatitischeapertoimplementsecurityfromthestartthantowaitforsomethingto happen. [38] points to a survey that mentions how high-performance orga-nizations spend 22 % less time on unplanned work and rework. The ability tomonitor and measure for security flaws early in the process ensures that bugsthat prevent a delay in the deployment are caught and quantified [38]. Thisdecreasesthecostofmakingmistakes,findingthem,andfixingthem[36].
RQ3-Challenges
The following section provides an overview of the challenges an organizationfaces from DevSecOps. The challenges are connected to the speed and agilityneedednottoslowdownotherDevOpspractices,organizationalchanges,toolsandpractices:
Keeping up with DevOps: Using traditional, manual security methods heav-ilyimpairsthespeedandagilityofDevOps.Thismeanssecuritymethodshaveto be more agile, and these agile security methods have to be understood by secu-rity teams and accepted by development teams [42] to make sure they contributemeaningfully to the DevOps movement without hampering their developmentspeedandservicedelivery[43].
Organizational: Getting started with DevSecOps means the organization hasto adopt change. Skills, culture, tools, processes, standards and practices mustbeconsideredasapossibilityforimplementingsecurity[29]:
Therewillbeaneedforskillsinareassuchasencryptionandloggingstan-dardsetc.[29].
The organizational barriers between security teams and the rest of the or-ganizationmustbebrokendown:
Developers and managers can be frustrated with the added time it takestoproducecode,whenaddingsecurity[33][21].Developersandopera-tors think of security as a hindrance to their goals, which is to deliverfunctionality fast, while security teams are focused on making sure thefunctionalityissecureandrobust[44].
The security teams not being properly trained on tools developers andoperators use, hinders them from being able to integrate security in atransparent and understandable way for other users, which would limitcollaborationbetweenteams[31].
Organizations see security as a costly activity, and not something thatgeneratesrevenue[32][35].
There will be a need for new standards for security prevention, detectionandresponse[29].
Tools and practices:The dynamic environment when practicing DevOpsmeansthatsecurityfunctionalityhastobeavailableintoolsthatworkontheright platforms. There is a lack of available tools[21]. Any security functionalitynotautomatedintheavailabletoolswillcreatefrictionintheDevOpscycle.Theusersneedtobeproperlytrainedwhenusingadvancedtools.[38]pointsto developers that had difficulties writing secure code because they couldn’t usethetoolsefficientenoughtokeepupwithDevOps’speed.
RQ4-TheevolutionofDevSecOps
TheneedforsecuritytobeintegratedinDevOpswasfirstmentionedinablogbyNeilMacDonald,aGartneranalyst,inablogpostcalled”DevOpsNeedsto Become DevOpsSec” in 2012. DevSecOps has since become more and moreacknowledged as a necessity. 2 shows the increase in number articles per year,whichisevidencethatawareness,recognitionanduseofDevSecOpsisontherise.
Table2.Overviewofnumberofresultsperyear
Limitationsofresults
Thisresearchisbasedonmultivocalliterature,andmostofthematerialhasnotbeen subject to the rigorous peer-review academic research usually is. The litera-turehasinsteadconsistedofblogs,white-papers,industryreportsandacademicresearch.
DevSecOps is a very new term, and the term has not even been agreedupon. It varies between SecDevOps, DevSecOps, DevOpsSec, Secure DevOps,andRuggedDevOps.InthisresearchpaperwehaveconsistentlyusedDevSec-Ops (with exception to where I am referring to other sources and their titles).The fact that it is as new as it is, means the results from this MLR can becomeoutdatedasbestpracticeschange.
Conclusion
ThisMLRpresentstheresearchwedidonDevSecOpstofindouthowDevSec-Opscanbedefined,whatdoingDevSecOpsmeansforanorganizationinregardtowhatprinciplesandpracticestheyshouldadhereto,whatchallengesthey
would face attempting to adopt DevSecOps, the benefits if it’s done successfullyandhowithasevolvedfromtheneedtoimplementsecurityinDevOpstowhatcouldseemlikeamovementonitsown.
We used Google Scholar and Google Search to locate literature and afterapplying our inclusion and exclusion criteria, 52 artefacts were found to be rel-evant to our search terms. Only 2 of those were academic research papers. Theremaining50consistedofwhitepapers,blogsandarticles.
We found that DevSecOps is defined by many as the integration of securityprocessesandpracticesintoDevOpsenvironments,thatDevSecOpspromotesaset of principles meant to shift the mindsets of all participants in the softwaredevelopment process so everyone participates and do what they can to ensuresecurity in the project and a set of practices that can ensure security in theproject based on the idea of planning and implementing security from the startandascode.
We identified a set of challenges and benefits to implementing DevSecOps.The challenges we identified should not be seen as deterrents to implementingDevSecOps, but a symptom of its youth. As DevSecOps matures, better meth-ods, practices, tools etc. can probably overcome them. The benefits we identifiedindicates it is maturing, by for example resulting in less unplanned work and adecreaseinmanuallabour.
Asfuturework,itwouldbeinterestingtoconductsurveysonorganizationstopossiblyexpandthisstudy’scoverageonDevSecOps.Itisalsoofinterestto investigate this study’s suggested practices: observing practices effects on thesurrounding environments (development, operations, business, customers) to findbest practices. A possibility would then be to investigate and propose possiblearchitectures or frameworks for implementing DevSecOps, [45] for example looksat continuous software engineering while using a microservices architecture whichcouldbeanalternativefor”securityascode”inDevSecOps.
References
P. M. Mell and T. Grance. The nist definition of cloud computing. Special Publi-cations(NISTSP)-800-145,(7),92011.NISTDefinitionsonCloudComputing.
B. Fitzgerald and K. J. Stol.Continuous software engineering: A roadmap andagenda.JournalofSystemsandSoftware,123:176–189,2017.
R. B. Svensson G. G. Claps and A. Aurum. On the journey to continuous deploy-ment: Technical and social challenges along the way.Information and SoftwareTechnology,57:21–31,2015.
J. Humble and M. Joanne. Why enterprises must adopt devops to enable contin-uousdelivery.TheJournalofInformationTechnologyManagement,(24),72011.
J. Hernantes C. Ebert, G. Gallardo and N. Serrano.Devops.IEEE Software,33(3):94–100,May2016.
J. Yankel C. A. Cois and A. Connell. Modern devops: Optimizing software devel-opmentthrougheffectivesysteminteractions.In2014IEEEInternationalProfes-sionalCommunicationConference(IPCC),pages1–7,Oct2014.
M. Callanan and A. Spillane. Devops: Making it easy to do the right thing. IEEESoftware,33(3):53–59,May2016.
D.Spinellis.Beingadevopsdeveloper.IEEESoftware,33(3):4–5,May2016.
Hewlett Packard Enterprise.Application security and devops.Technical report,HewlettPackardEnterprise,2016.
N. MacDonald and I. Head. DevSecOps: How to Seamlessly Integrate SecurityIntoDevOps.Technicalreport,Gartner,2016.
V.MohanandL.B.Othmane.Secdevops:Isitamarketingbuzzword?-map-ping research on security in devops.In 2016 11th International Conference onAvailability,ReliabilityandSecurity(ARES),pages542–547,Aug2016.
A. Ashfaque U. Rahman and L. Williams.Software security in devops: Synthe-sizing practitioners’ perceptions and practices.In Proceedings of the InternationalWorkshoponContinuousSoftwareEvolutionandDelivery,CSED’16,pages70–76,NewYork,NY,USA,2016.ACM.
M.OivoT.Karvonen,W.BehutiyeandP.Kuvaja.Systematicliteraturereviewon the impacts of agile release engineering practices.Information and SoftwareTechnology,86:87–100,2017.
L.E.LwakatareS.TeppolaT.SuomalainenJ.EskeliT.KarvonenP.KuvajaJ.
M.VernerP.Rodr´ıguez,A.HaghighatkhahandM.Oivo.Continuousdeployment of software intensive products and services: A systematic mapping study. JournalofSystemsandSoftware,123:263–291,2017.
D.St˚ahlandJ.Bosch.Modelingcontinuousintegrationpracticedifferencesin industry softwaredevelopment.JournalofSystemsandSoftware,87:48–59, 2014.
R. T. Ogawa and B. Malen.Towards rigor in reviews of multivocal literatures:Applying the exploratory case study method.Review of Educational Research,61(3):265–286,1991.
V.andM.V.M¨antyl¨a.Whenandwhattoautomateinsoftwaretesting?amulti- vocalliteraturereview.InformationandSoftwareTechnology,76:92–117,2016.
H.J.JuniorB.B.N.deFran¸caandG.H.Travassos.Characterizingdevops by hearing multiple voices.In Proceedings of the 30th Brazilian Symposium onSoftwareEngineering,SBES’16,pages53–62,NewYork,NY,USA,2016.ACM.
M.FeldererV.GarousiandT.Hacalo˘glu.Softwaretestmaturityassessmentand test process improvement: A multivocal literature review.Information and Soft-wareTechnology,85:16–42,2017.
M.FeldererV.GarousiandM.V.M¨antyl¨a.Theneedformultivocalliterature reviewsinsoftwareengineering:Complementingsystematicliteraturereviewswithgrey literature. In Proceedings of the 20th International Conference on Evaluationand Assessment in Software Engineering, EASE ’16, pages 26:1–26:6, New York,NY,USA,2016.ACM.
D.Shackleford.Adevsecopsplaybook.SANSInstituteInfoSecReadingRoom,32016.ADevSecOpsplaybook.
S.Vonnegut.4keystointegratingsecurityintodevops.https://goo.gl/aZ0S3i,2016.
S.Lietz.Shiftingsecuritytotheleft.https://goo.gl/sbheKS,2016.
G.Bledsoe.Gettingtodevsecops:5bestpracticesforintegratingsecurityintoyourdevops”.https://goo.gl/ZPzgxa,2016.
F.Lim.Devsecopsisthekravmagaofsecurity.https://goo.gl/BH4MS2,2016.
S.Lietz.Principlesofdevsecops.https://goo.gl/N8zcXV,2015.
T. Greene. What security teams need to know about devops.https://goo.gl/c8VOn4,2016.
Anonymous User. Securitybreaksdevops–here’showtofixit.https://goo.gl/Yr1jk3,2015.
D.Shackleford.Thedevsecopsapproachtosecuringyourcodeandyourcloud.
SANSInstituteInfoSecReadingRoom,22017.ADevSecOpsplaybook.
C. Caum. Gettingstartedwithpolicy-drivendevelopmentanddevsecops.https://goo.gl/AevVcX,2016.
Whitehat Security. Devops invites security to “join the party”.https://goo.gl/spj0wK,2016.
M.Hornbeek.Devopsmakessecurityassuranceaffordable.https://goo.gl/g0iKfZ,2015.
K. Lindros. Howtocraftaneffectivedevsecopsprocesswithyourteam.https://goo.gl/ppWtjx,2016.
C. Romeo. The 3mostcrucialsecuritybehaviorsindevsecops.https://goo.gl/FJKuYQ,2016.
A.Cureton.Buildingsecurityintodevops:Isdevsecopsthebeginningofthefuture?https://goo.gl/Npv2Py,2017.
J. McKay. Howto use devsecops to smooth cloud deployment.https://goo.gl/vqoh4L,2016.
Amazon Web Services.Introduction to devsecops on aws.https://goo.gl/wxl3YM,2016.
R. Francis. 7waysdevopsbenefitscisosandtheirsecurityprograms.https://goo.gl/RxieGr,2015.
A.Wallgreen.Devsecops:9waysdevopsandautomationbolstersecurity,compli-ance.https://goo.gl/RyA9QZ,2015.
M.Rotenberg.7essentialstepstodevsecopssuccess.https://goo.gl/JAOQlF,2016.
F.Paul.Secdevops:Injectingsecurityintodevopsprocesses.https://goo.gl/Eul2fn,2015.
M.Rohr.Agilesecurityandsecdevopstouchpoints.https://goo.gl/peuqpS,2015.
M.GoldschmidtandM.McKinnon.Devsecops–agilitywithsecurity.Technicalreport,SenseofSecurity,2016.
M.Elder.Securityconsiderationsfordevopsadoption.https://goo.gl/b0CStP,2014.
PM.Clarke.RV.O’Connor,P.Elger.Continuoussoftwareengineering—ami-croservicesarchitectureperspective.JSoftwEvolProc.2017;e1866.,2017.
Keywords:DevSecOps,DevOps,Security, Multivocal Literature Re-view
Introduction
In recent years a large part of software development companies have changedfocus from developing software as a product (SaaP), where companies developedthe software and delivered a finished product to a customer that then installedandranitlocally,todevelopsoftwareasaservice(SaaS),wheresoftwareiscen-trallyhostedonacloudinfrastructureandaccessedthroughforexampleaweb-browser[1],orotherchannelsthatdeliversitdirectlytoacustomer’smachineor device [2]. The use of it is then offered through licensing and subscriptions.With SaaS, the customers do not control the underlying cloud infrastructure orthe application’s functionality [1], as that is done by the provider. This givesthe provider the opportunity to continuously improve and deliver their soft-ware without having to redistribute it to all their clients as they simply updatethe software on their own cloud infrastructure. This modern software engineer-ingprocessofdevelopingwhilecontinuouslyintegratinganddeliveringsoftwareis complex. Continuous integration (CI) means to automatically integrate newcode from several developers into the same version of the software and at thesametime,checkforerrors[3].ContinuousDelivery(CD)meanstodeploynewsoftware to production, with the differing factor from traditional software de-ployment being the frequency of deployment, which can happen multiple timeseveryday[3].”Continuousdeliveryenablesbusinessestoreducecycletimesoastogetfasterfeedbackfromusers,reducetheriskandcostofdeployments,get
bettervisibilityintothedeliveryprocessitself,andmanagetherisksofsoftwaredelivery more effectively.” [4]. These processes require a large number of toolsandinformationsystems[5].Theseprocesses,toolsandsystemsareoftenman-agedbyindependentoperationsteams[6].ManychallengeswhenimplementingCI/CD resulted from lack of collaboration and communication between the op-erators and developers [2][3][6][7]. Attempts at overcoming these challenges haveresultedinaconcept,termedDevOps[2].
DevOps is described as the ”conceptual and operational merging of devel-opment and operations’ needs, teams, and technologies” [6]. This merging ismeanttoaligntheprioritiesofthedevelopmentteamsandoperationsteamssothey work together towards a common goal of successful project execution [6] bycooperatingonsoftwaredevelopmentanddeployingthatsoftwareintoproduc-tion [2]. This can be done by involving operations in all development stages, bydevelopers and operators collaborating to solve problems, make processes andproducts that can be automated, and agree on and develop metrics that everyonecan make use of [8]. This reflects the four main principles of DevOps: culture,automation,measurementandsharing(CAMS)[4][2].
As DevOps has become more popular, many organizations are adopting thepractices associated with it. However, a survey by the HPE Security Fortifyteam[9]from2016showsthatwhilemanybelievethatsecurityshouldbeapartofDevOps,securityisnotsomethingmanyDevOpsprogramshaveincludedaspartoftheirprocess.Gartnerestimatesin[10]thatlessthan20%of”enterprisesecurity architects have engaged with their DevOps initiatives to actively andsystematicallyincorporateinformationsecurityintotheirDevOpsinitiatives”.
[10] points to management, developers, and operators viewing security as aninhibitortotheagilityandspeedrequiredinDevOpspractices,likeCIandCD,asonereasonforthis.
The need for security in DevOps is met by DevSecOps. This concept is anattemptatcreatingandincludingmodernsecuritypracticesthatcanbein-corporated in the fast and agile world of DevOps. It promotes an extension toDevOps’ goal of promoting collaboration between developers and operators byinvolvingsecurityexpertsfromthestartaswell[11].
Since DevSecOps is a new trend, it is important to obtain an overview ofthe practices and experiences accumulated on the subject. There is not a lot ofresearch on DevSecOps, but a search of available literature shows: [12] is a studythat through Internet artefacts and a survey looks at practitioners experienceswith DevSecOps and the practices they perform, [11] is a systematic mapping(SM)studyonwhatisbeingresearchedinthefieldanditshowedresearchwas being conducted on the aspects of ”a definition, security best practices,compliance, process automation, tools for DevSecOps, software configuration,team collaboration, availability of activity data and information secrecy”. Asearch for systematic reviews or mappings on continuous processes (CI/CD)used in DevOps, resulted in a several results. Examples are: [13] examines theimpact agile release engineering (ARE) and the continuous processes involvedhadonsoftwareengineering.[14]mapsliteraturerelatedtoCDandprovidesan
analysis of the benefits and challenges related to CD. [15] uses a literature reviewtoshowdifferencesinhowCIisdonefordifferentcases.NoneoftheliteraturewefoundgivesacollectedoverviewofDevSecOpsandwhatitis.
To the best of authors’ knowledge, there is not a systematic literature reviewon DevSecOps or a large body of scientific work related to DevSecOps. Thisabsence of works devoted to the topic lead us to the need to work on the topicusingatoollikemultivocalliteraturereview,intendedtobridgethegapbetweenprofessionalandscientificliterature.Bythismean,authorsexaminetheconceptof DevSecOps, how it has evolved since it was first introduced, and the challengesandbenefitsDevSecOpsbringstoanorganization.
The rest of this paper is structured as a systematic literature review. Insection2themethodologyfortheresearchispresented.Insection3wepresentthe results from our study. In section 4 we conclude on our paper, summarizetheresultsandsuggestfuturework.
ResearchMethodology
Inthissection,anoverviewofourresearchmethodologyispresentedfollowedbyanoverviewofthesystematicapproachusedtogatherrelevantliterature.
MultivocalLiteratureReview
After an initial search on literature to learn more on the topic of DevSecOps,we could not find a substantial body of academic research on the topic. Wetherefore decided to conduct a multivocal literature review (MLR). Multivocalliteratureisdefinedasallaccessibleliteratureonatopic[16].Thisincludes,butis not limited to: blogs, white papers, articles and academic literature. By usingthis variety of literature the results will give a more nuanced look at the topic,since it includes the voices and opinions of academics, practitioners, independentresearchers,developmentfirmsandotherswithexperience[16].
PreviouslypublishedMLRsincludebutisnotlimitedto:[17]isanMLRon automated software testing and the proposed guidelines from practitionersand researchers for when and what to automate. [18] is an MLR providing anoverviewofDevOps.[19]isanMLRonsoftwaretestmaturityassessmentsandtestprocessimprovement.
To the best of our knowledge, this is the first MLR on the topic although itisnotthefirstforDevOps.
[20] points to the importance of MLRs in software engineering (SE) fieldsby stating that SE practitioners produces multivocal literature on a great scale,butthatitisnotpublishedinacademicforums.Theymentionhowever,thatnot including that literature in systematic reviews means researchers miss outonimportantcurrentstate-of-the-artpracticeinSE.
ResearchQuestions
ThisMLRisconductedtoobtainanunderstandingofwhatDevSecOpsis,howithasevolvedandthechallengesandbenefitsofadoptingsuchanapproach.Tospecifythegoalofthispaper,fourresearchquestionswereformulated:ResearchQuestion1:HowdoestheliteraturedefineDevSecOps?
ResearchQuestion2: Whatare the characteristics ofDevSecOps?ResearchQuestion3:WhatarethemainexpectedbenefitsandchallengesofadoptingDevSecOps?
ResearchQuestion4:Sinceitwasfirstmentioned,howhasDevSecOpsevolved?
Studyprotocol
Thestudyprotocoldescribesthesystematicwaywefoundtheliteratureusedin our study. This section lists the databases used in the search, what searchstrategy was used to find related literature, the inclusion and exclusion criteriausedtofindthemostrelevantliterature,andtheprocessinwhichwecataloguedtheliterature.
DatabasesFor this MLR we used Google’s search engines to find relevantliterature:
GoogleSearch(http://www.google.com/)tolocategreyliterature(whitepapers,blogs,articlesetc.)
GoogleScholar(http://scholar.google.com/)tospecificallylocateavailableacademicliterature.
Google’s search engines was chosen over more precise search engines (like SpringerLink, ACM Digital Library, IEEE Explore etc.) because DevSecOps is a very newtopic and very little academic research is available. We therefore knew before-hand that this literature review would rely mostly on the grey literature it wouldfind,whichGoogle’ssearchengineswouldbeabletolocate.
Search Terms DevSecOps is a new term based on adding the term ”SECurity”to DevOps which stands for ”DEVeloper” and ”OPeration”. There is not a con-sensusinthefieldontheorderingofthewords,sothesearchtermsmustcoverall possible permutations. The search string must also be made to find relevantliteratureaccordingtotheRQs.Thesearchstringusedisthereforeasfollows:
("DevSecOps"OR"SecDevOps"OR"DevOpsSec")AND
("definition"OR"characteristics"OR"challenges" OR "benefits"OR"evolution").
Study Selection Once initial search results were retrieved, a procedure toexcludeirrelevantpaperswereconductedusingthefollowinginclusionandex-clusioncriteria:
Inclusioncriteria:
LiteraturethatexplicitlydiscussDevSecOps.
LiteraturethatexplicitlydiscussDevOpsandSecurity,particularlythechallengesandbenefits.
LiteraturediscussingthepresentchallengestoDevSecOps.LiteraturediscussingthebenefitsofDevSecOps.
LiteraturethatdiscussthedefinitionofDevSecOps.Literaturepublishedafter2014.
Includeonlythe5firstpagesonGoogleSearch.
Exclusioncriteria:
Literaturethatisinaccessible.
Results Google Search deems tosimilar to other results.
Vendorstooladvertisements.
Search Procedure The process is as follows: First we perform an advancedsearch in Google Search and Google Scholar. To let Google’s search engine putprimary focus on the different RQs, the term will be split into 5 parts, eachfocusing on all permutations of DevSecOps and one of the words related to theRQs. The 5 search strings can be seen in 1. For each search we then read theliterature systematically applying the remaining inclusion and exclusion criteria,selectingonlyrelevantliteraturefortheprimarystudy.Theprocessisvisualizedinfigure1:
Fig.1.Anoverviewofthesearchprocesstofindrelevantliteratureforthisstudy.
Results
Inthefollowingsectionweshowtheresultsfromexecutingoursearchfollowedbyourreviewoftheliteratureinconjunctionwithourresearchquestions.
SearchExecution
Thesearchwasperformedonduringthefirstquarterof2017.Theinitialsearchgave 284 results. After applying the inclusion and exclusion criteria 52 resultswereleft.Table1summarizesthesearch:
SearchEngineInitialResultsTitle,abstract,keywordsandMetatextFulltext
GoogleScholar
34
4
2
GoogleSearch
250
62
50
Table1.Summaryofsearchresultsforprimarystudy
RQ1-howitisdefined
In the literature we reviewed there seemed to be a consensus on what DevSec-Ops is seen as. DevSecOps is seen as a necessary expansion to DevOps, wherethepurposeistointegratesecuritycontrolsandprocessesintotheDevOpssoft-ware development cycle [21] and that it is done by promoting the collaborationbetweensecurityteams,developmentteamsandoperationsteams[11].
RQ2-DevSecOpscharacteristics
When reviewing the literature, the features that stood out as characterizing De-vSecOpsweretheprinciplesseenasthebasisandreasoningforDevSecOpsandthe practices used when implementing security into their software developmentprocesses.
Principles: The principles that characterize DevSecOps are based on DevOpsand the CAMS principles [4][22], culture, automation, measurement, and shar-ing,butwiththeadditionofaddingsecurityfromthestart:
Culture:ADevOpsculturepromotescollaborationbetween developmentteamsandoperationteams[4],wheretheyallacceptthattheyareresponsiblefor delivering software to an end-user[2]. DevSecOps means to include collab-orationwiththesecurityteamaswellaspromoteaculturewhereoperationsand development also work on integrating security in their work [11] [23]. Thatmeans involving the security team from the planning stages, and making sureeveryoneagreesthatsecurityiseveryone’sresponsibilities[24][25].Togetevery-one to think security, practitioners points to creating a common mindset withregardstosuccessbydevelopingasetametricsthateverybodyagreesonand
can use [25], promote customer focus by creating an alignment of business andsecurity strategies to ensure just right and enough security that everyone in anorganizationcansupportandimplement[26][27].
Automation:In DevOps the automation of build, deployment, and testing isimportant to achieve rapid development, deployment [4][22], and feedback fromend-users[2]. DevSecOps promotes a focus on automating security as well, to beabletokeepupwiththespeedandscaleachievedbyDevOps.Theaimshouldbe100% automation of securitycontrols,wherethe controls can be deployedand managed without manual interference [28]. It is important to implementautomatic security in a way that does not hinder DevOps’ agility in any way,whichcancausefriction[29][27][10].
Measurement:In DevOps measurements include monitoring business metricssuch as revenue and key performance indicators, like the effect new releases haveon the stability of a system, in order to know the current state and finding outhowtoimproveit[4][2].DevSecOpspromotestheuseanddevelopmentofmet-rics that track threats and vulnerabilities throughout the software developmentprocess [10]. Automatic security controls throughout the software developmentprocess means metrics are available to track threats and vulnerabilities in real-time and that allows the organization to verify how good an application is ondemand[22].
Sharing:InDevOpsdevelopersandoperatorsshareknowledge,developmenttools, and techniques to manage the process [4] [2]. DevSecOps promotes theinclusionofthesecurityteaminthesharingpromotedinaDevOpsenvironment.By letting security teams know about the challenges faced by operators anddevelopers,andviceversa,thesecurityprocessestheydevelopwillbeimproved[22].
Shift securityto theleft:Inthetraditionalsoftwaredevelopmentprocess,se-curity is a step close to the end of the process. DevSecOps promotes a shift totheleftforsecurity,whereitistobeincludedineverypartofthesoftwaredevel-opmentprocess[23].Thismeansthatsecurityteamsareinvolvedfromtheveryfirst planning step and is part of planning every iteration of the developmentcycle [29][30]. It also means security is there to help developers and operatorsonsecurityconsiderations[28][31][24].
Practices:SeveralpracticesforDevSecOpswerepointedtointheliterature:
Threat modeling and risk assessments: Practicing secure DevOps means thatorganizations have to develop expertise and processes to best discover, protectagainst, and find solutions to threats and risks [32], preferably ahead of time[25].Performingriskassessmentsfromthefirstplanningstageandcontinuouslybeforeeveryiterationisimportantasawaytoprioritizerisks,examinecontrolsalready in place and decide which are needed going forward [33] [21]. Threatmodelingisanothermethodwhereyouattackyoursystemonpaperearlyinthe development cycle to identify how an attack can occur and where it is mostlikelytohappen[34].
Continuous testing: Automatic security controls at every part of the soft-ware development process is important for security assurance and allows teststocontinuouslyscancodeforchanges[34][32],continuouslydetectanomalies,andautomaticrollbackofcodewhenneeded[21][24].
Monitoring and logging: When automating security controls throughout thesoftwaredevelopingprocessitisimportantforthoseinvolvedtobeabletogen-erate evidence on demand that controls are working and that they are effective[35]. To that end, it is important to monitor every part of the inventory and tologeveryresource[25][33][21].
Securityascode:Thismeanstodefinesecuritypolicies,forexampleintegra-tiontesting,andnetworkconfigurationandaccess,andwritescriptedtemplatesor configuration files that can be implemented into the development process fromthe start of the project. These codified security policies can then be activatedautomatically according to schedules or be activated by user (simple push of abutton),andbestoredinacentralrepositoryforreuseonnewprojects[36].
Red-Teamandsecuritydrills:Tostayaheadofpossibleattackers,practition-ers of DevSecOps create a Red-Team that runs security drill on the deployed soft-ware. They have the task of finding and exploiting vulnerabilities in the system[25][34].Thisnotonlyhelpstofindsecurityflaws,butimprovesmeasurements,and helps the organization find solutions [26]. The point of the Red-Team is tohave people that never claim something can’tpossibly happen.
RQ3-Benefits
The following section provides an overview, according to the literature, of thebenefitsgainedfromDevSecOpsanditspractices:
Shiftingsecuritytotheleft:Byinvolvingsecurityexpertsfromthestartofthe development process it is easier to plan and execute integration of securitycontrolsthroughoutthedevelopmentprocesswithoutcausingdelaysorcreatingissuesby implementing securitycontrols after systemsare running [29].
Automating security: This allows security controls to be fast, scalable andeffectivethusmakingitpossibletokeepahighpacefordetectingerrors,alertingabouttheerrors,fixingtheerrors,findingcountermeasuresforfutureerrorsand forensics to identify why an error occurred [37]. This not only helps tolower risk and time spent on errors, but also makes it easier to understand riskand create policies and procedures [38]. The automation allows processes to beconsistent and repeatable, with predictable outcomes for similar tests, it allowslogging and documentation to be automatic [39] and letting security tests berun at the push of a button frees up developers time to write code instead ofrunningtests[40].Thisalsoreducestheriskforhumanerror[39].Theabilitytostoresecuritypolicytemplatesthatiscreatedduringadevelopmentprocessina central repository means that security teams don’t need to manually configureeverynewenvironmentwhenstartinganewprojectwhichfreessecurityexpertsfrommanual,repetitiveandunproductivework[36].
Value: [41] [38] points to how security missteps can be very expensive and thatitischeapertoimplementsecurityfromthestartthantowaitforsomethingto happen. [38] points to a survey that mentions how high-performance orga-nizations spend 22 % less time on unplanned work and rework. The ability tomonitor and measure for security flaws early in the process ensures that bugsthat prevent a delay in the deployment are caught and quantified [38]. Thisdecreasesthecostofmakingmistakes,findingthem,andfixingthem[36].
RQ3-Challenges
The following section provides an overview of the challenges an organizationfaces from DevSecOps. The challenges are connected to the speed and agilityneedednottoslowdownotherDevOpspractices,organizationalchanges,toolsandpractices:
Keeping up with DevOps: Using traditional, manual security methods heav-ilyimpairsthespeedandagilityofDevOps.Thismeanssecuritymethodshaveto be more agile, and these agile security methods have to be understood by secu-rity teams and accepted by development teams [42] to make sure they contributemeaningfully to the DevOps movement without hampering their developmentspeedandservicedelivery[43].
Organizational: Getting started with DevSecOps means the organization hasto adopt change. Skills, culture, tools, processes, standards and practices mustbeconsideredasapossibilityforimplementingsecurity[29]:
Therewillbeaneedforskillsinareassuchasencryptionandloggingstan-dardsetc.[29].
The organizational barriers between security teams and the rest of the or-ganizationmustbebrokendown:
Developers and managers can be frustrated with the added time it takestoproducecode,whenaddingsecurity[33][21].Developersandopera-tors think of security as a hindrance to their goals, which is to deliverfunctionality fast, while security teams are focused on making sure thefunctionalityissecureandrobust[44].
The security teams not being properly trained on tools developers andoperators use, hinders them from being able to integrate security in atransparent and understandable way for other users, which would limitcollaborationbetweenteams[31].
Organizations see security as a costly activity, and not something thatgeneratesrevenue[32][35].
There will be a need for new standards for security prevention, detectionandresponse[29].
Tools and practices:The dynamic environment when practicing DevOpsmeansthatsecurityfunctionalityhastobeavailableintoolsthatworkontheright platforms. There is a lack of available tools[21]. Any security functionalitynotautomatedintheavailabletoolswillcreatefrictionintheDevOpscycle.Theusersneedtobeproperlytrainedwhenusingadvancedtools.[38]pointsto developers that had difficulties writing secure code because they couldn’t usethetoolsefficientenoughtokeepupwithDevOps’speed.
RQ4-TheevolutionofDevSecOps
TheneedforsecuritytobeintegratedinDevOpswasfirstmentionedinablogbyNeilMacDonald,aGartneranalyst,inablogpostcalled”DevOpsNeedsto Become DevOpsSec” in 2012. DevSecOps has since become more and moreacknowledged as a necessity. 2 shows the increase in number articles per year,whichisevidencethatawareness,recognitionanduseofDevSecOpsisontherise.
Table2.Overviewofnumberofresultsperyear
Limitationsofresults
Thisresearchisbasedonmultivocalliterature,andmostofthematerialhasnotbeen subject to the rigorous peer-review academic research usually is. The litera-turehasinsteadconsistedofblogs,white-papers,industryreportsandacademicresearch.
DevSecOps is a very new term, and the term has not even been agreedupon. It varies between SecDevOps, DevSecOps, DevOpsSec, Secure DevOps,andRuggedDevOps.InthisresearchpaperwehaveconsistentlyusedDevSec-Ops (with exception to where I am referring to other sources and their titles).The fact that it is as new as it is, means the results from this MLR can becomeoutdatedasbestpracticeschange.
Conclusion
ThisMLRpresentstheresearchwedidonDevSecOpstofindouthowDevSec-Opscanbedefined,whatdoingDevSecOpsmeansforanorganizationinregardtowhatprinciplesandpracticestheyshouldadhereto,whatchallengesthey
would face attempting to adopt DevSecOps, the benefits if it’s done successfullyandhowithasevolvedfromtheneedtoimplementsecurityinDevOpstowhatcouldseemlikeamovementonitsown.
We used Google Scholar and Google Search to locate literature and afterapplying our inclusion and exclusion criteria, 52 artefacts were found to be rel-evant to our search terms. Only 2 of those were academic research papers. Theremaining50consistedofwhitepapers,blogsandarticles.
We found that DevSecOps is defined by many as the integration of securityprocessesandpracticesintoDevOpsenvironments,thatDevSecOpspromotesaset of principles meant to shift the mindsets of all participants in the softwaredevelopment process so everyone participates and do what they can to ensuresecurity in the project and a set of practices that can ensure security in theproject based on the idea of planning and implementing security from the startandascode.
We identified a set of challenges and benefits to implementing DevSecOps.The challenges we identified should not be seen as deterrents to implementingDevSecOps, but a symptom of its youth. As DevSecOps matures, better meth-ods, practices, tools etc. can probably overcome them. The benefits we identifiedindicates it is maturing, by for example resulting in less unplanned work and adecreaseinmanuallabour.
Asfuturework,itwouldbeinterestingtoconductsurveysonorganizationstopossiblyexpandthisstudy’scoverageonDevSecOps.Itisalsoofinterestto investigate this study’s suggested practices: observing practices effects on thesurrounding environments (development, operations, business, customers) to findbest practices. A possibility would then be to investigate and propose possiblearchitectures or frameworks for implementing DevSecOps, [45] for example looksat continuous software engineering while using a microservices architecture whichcouldbeanalternativefor”securityascode”inDevSecOps.
References
P. M. Mell and T. Grance. The nist definition of cloud computing. Special Publi-cations(NISTSP)-800-145,(7),92011.NISTDefinitionsonCloudComputing.
B. Fitzgerald and K. J. Stol.Continuous software engineering: A roadmap andagenda.JournalofSystemsandSoftware,123:176–189,2017.
R. B. Svensson G. G. Claps and A. Aurum. On the journey to continuous deploy-ment: Technical and social challenges along the way.Information and SoftwareTechnology,57:21–31,2015.
J. Humble and M. Joanne. Why enterprises must adopt devops to enable contin-uousdelivery.TheJournalofInformationTechnologyManagement,(24),72011.
J. Hernantes C. Ebert, G. Gallardo and N. Serrano.Devops.IEEE Software,33(3):94–100,May2016.
J. Yankel C. A. Cois and A. Connell. Modern devops: Optimizing software devel-opmentthrougheffectivesysteminteractions.In2014IEEEInternationalProfes-sionalCommunicationConference(IPCC),pages1–7,Oct2014.
M. Callanan and A. Spillane. Devops: Making it easy to do the right thing. IEEESoftware,33(3):53–59,May2016.
D.Spinellis.Beingadevopsdeveloper.IEEESoftware,33(3):4–5,May2016.
Hewlett Packard Enterprise.Application security and devops.Technical report,HewlettPackardEnterprise,2016.
N. MacDonald and I. Head. DevSecOps: How to Seamlessly Integrate SecurityIntoDevOps.Technicalreport,Gartner,2016.
V.MohanandL.B.Othmane.Secdevops:Isitamarketingbuzzword?-map-ping research on security in devops.In 2016 11th International Conference onAvailability,ReliabilityandSecurity(ARES),pages542–547,Aug2016.
A. Ashfaque U. Rahman and L. Williams.Software security in devops: Synthe-sizing practitioners’ perceptions and practices.In Proceedings of the InternationalWorkshoponContinuousSoftwareEvolutionandDelivery,CSED’16,pages70–76,NewYork,NY,USA,2016.ACM.
M.OivoT.Karvonen,W.BehutiyeandP.Kuvaja.Systematicliteraturereviewon the impacts of agile release engineering practices.Information and SoftwareTechnology,86:87–100,2017.
L.E.LwakatareS.TeppolaT.SuomalainenJ.EskeliT.KarvonenP.KuvajaJ.
M.VernerP.Rodr´ıguez,A.HaghighatkhahandM.Oivo.Continuousdeployment of software intensive products and services: A systematic mapping study. JournalofSystemsandSoftware,123:263–291,2017.
D.St˚ahlandJ.Bosch.Modelingcontinuousintegrationpracticedifferencesin industry softwaredevelopment.JournalofSystemsandSoftware,87:48–59, 2014.
R. T. Ogawa and B. Malen.Towards rigor in reviews of multivocal literatures:Applying the exploratory case study method.Review of Educational Research,61(3):265–286,1991.
V.andM.V.M¨antyl¨a.Whenandwhattoautomateinsoftwaretesting?amulti- vocalliteraturereview.InformationandSoftwareTechnology,76:92–117,2016.
H.J.JuniorB.B.N.deFran¸caandG.H.Travassos.Characterizingdevops by hearing multiple voices.In Proceedings of the 30th Brazilian Symposium onSoftwareEngineering,SBES’16,pages53–62,NewYork,NY,USA,2016.ACM.
M.FeldererV.GarousiandT.Hacalo˘glu.Softwaretestmaturityassessmentand test process improvement: A multivocal literature review.Information and Soft-wareTechnology,85:16–42,2017.
M.FeldererV.GarousiandM.V.M¨antyl¨a.Theneedformultivocalliterature reviewsinsoftwareengineering:Complementingsystematicliteraturereviewswithgrey literature. In Proceedings of the 20th International Conference on Evaluationand Assessment in Software Engineering, EASE ’16, pages 26:1–26:6, New York,NY,USA,2016.ACM.
D.Shackleford.Adevsecopsplaybook.SANSInstituteInfoSecReadingRoom,32016.ADevSecOpsplaybook.
S.Vonnegut.4keystointegratingsecurityintodevops.https://goo.gl/aZ0S3i,2016.
S.Lietz.Shiftingsecuritytotheleft.https://goo.gl/sbheKS,2016.
G.Bledsoe.Gettingtodevsecops:5bestpracticesforintegratingsecurityintoyourdevops”.https://goo.gl/ZPzgxa,2016.
F.Lim.Devsecopsisthekravmagaofsecurity.https://goo.gl/BH4MS2,2016.
S.Lietz.Principlesofdevsecops.https://goo.gl/N8zcXV,2015.
T. Greene. What security teams need to know about devops.https://goo.gl/c8VOn4,2016.
Anonymous User. Securitybreaksdevops–here’showtofixit.https://goo.gl/Yr1jk3,2015.
D.Shackleford.Thedevsecopsapproachtosecuringyourcodeandyourcloud.
SANSInstituteInfoSecReadingRoom,22017.ADevSecOpsplaybook.
C. Caum. Gettingstartedwithpolicy-drivendevelopmentanddevsecops.https://goo.gl/AevVcX,2016.
Whitehat Security. Devops invites security to “join the party”.https://goo.gl/spj0wK,2016.
M.Hornbeek.Devopsmakessecurityassuranceaffordable.https://goo.gl/g0iKfZ,2015.
K. Lindros. Howtocraftaneffectivedevsecopsprocesswithyourteam.https://goo.gl/ppWtjx,2016.
C. Romeo. The 3mostcrucialsecuritybehaviorsindevsecops.https://goo.gl/FJKuYQ,2016.
A.Cureton.Buildingsecurityintodevops:Isdevsecopsthebeginningofthefuture?https://goo.gl/Npv2Py,2017.
J. McKay. Howto use devsecops to smooth cloud deployment.https://goo.gl/vqoh4L,2016.
Amazon Web Services.Introduction to devsecops on aws.https://goo.gl/wxl3YM,2016.
R. Francis. 7waysdevopsbenefitscisosandtheirsecurityprograms.https://goo.gl/RxieGr,2015.
A.Wallgreen.Devsecops:9waysdevopsandautomationbolstersecurity,compli-ance.https://goo.gl/RyA9QZ,2015.
M.Rotenberg.7essentialstepstodevsecopssuccess.https://goo.gl/JAOQlF,2016.
F.Paul.Secdevops:Injectingsecurityintodevopsprocesses.https://goo.gl/Eul2fn,2015.
M.Rohr.Agilesecurityandsecdevopstouchpoints.https://goo.gl/peuqpS,2015.
M.GoldschmidtandM.McKinnon.Devsecops–agilitywithsecurity.Technicalreport,SenseofSecurity,2016.
M.Elder.Securityconsiderationsfordevopsadoption.https://goo.gl/b0CStP,2014.
PM.Clarke.RV.O’Connor,P.Elger.Continuoussoftwareengineering—ami-croservicesarchitectureperspective.JSoftwEvolProc.2017;e1866.,2017.
Post a Comment