DevSecOps | Jurgens Schoeman

Foundation

What is DevSecOps?

DevSecOps extends the DevOps philosophy by integrating security practices at every stage of the software development lifecycle — rather than bolting it on at the end. The core idea is simple: shift security left.

In traditional models, security was a gate at the end of the SDLC. A security team would review code just before deployment, creating a bottleneck, slowing down delivery, and producing a last-minute scramble to fix vulnerabilities. DevSecOps eliminates this by making every developer responsible for security from the first commit.

Key Principle

The cost of fixing a vulnerability grows exponentially the later it is found. Caught in design: $1. Caught in code: $10. Caught in testing: $100. Caught in production: $10,000+.

Shift-Left Security

Move security checks earlier in the pipeline — into the developer's IDE, at PR time, and in every build — not just at deployment.

Continuous Monitoring

Runtime security monitoring, anomaly detection, and alerting in production.

Automated Compliance

Policy as code with OPA, Checkov, and Azure Policy to enforce compliance automatically.

The Pipeline

Security-Embedded CI/CD Pipeline

Every stage of the pipeline has a security gate. Fail fast, fail early — never let a vulnerability slip to production.

Plan

Code

SAST Scan

Build

SCA / Secrets

Test

DAST Scan

Container Scan

Deploy

Monitor

Normal Stage

Security Gate

Tooling

Security Testing Toolkit

SAST

Static Analysis

Scan source code for vulnerabilities without running it. Catches SQL injection, XSS, insecure deserialization, hardcoded secrets.

SonarQube Semgrep CodeQL

DAST

Dynamic Analysis

Test running applications for vulnerabilities. Simulates real-world attacks — CSRF, auth bypass, injection attacks, broken access control.

OWASP ZAP Burp Suite Nuclei

SCA

Dependency Scanning

Scan open source dependencies for known CVEs and license violations. Supply-chain attacks are a top threat vector — catch them early.

Snyk Dependabot OWASP DC

Secrets Scanning

Credential Detection

Prevent API keys, passwords, and tokens from being committed to source control. Pre-commit hooks and CI gates are non-negotiable.

GitLeaks TruffleHog GitHub SS

Azure DevOps

Azure DevOps Security Integration

Branch Protection Policies

Require PR reviews, status checks (including security scans), and signed commits before merging to protected branches. No direct pushes to main.

Security Quality Gates

SonarQube quality gates block the pipeline if critical vulnerabilities or high code smells are detected. Configure zero tolerance for OWASP Top 10 findings.

Variable Groups & Key Vault

Link Azure Key Vault to Azure DevOps variable groups. Secrets are retrieved at runtime — never stored in pipeline YAML or build artifacts.

Service Connection RBAC

Scope service connections with least-privilege managed identities. Separate identities per environment (dev, staging, prod) with approval gates on production.

GitHub Actions

GitHub Actions Security Workflow

YAML

name: Security Pipeline
on: [push, pull_request]
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      # Secrets scanning
      - uses: gitleaks/gitleaks-action@v2

      # SAST - CodeQL
      - uses: github/codeql-action/analyze@v3
        with:
          languages: ['csharp', 'javascript']

      # SCA - Snyk
      - uses: snyk/actions/dotnet@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high

      # Container image scan
      - uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:${{ github.sha }}
          exit-code: '1'
          severity: CRITICAL,HIGH

Pro Tip

Pin all third-party GitHub Actions to a specific SHA (not a tag) to prevent supply-chain attacks: uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744

Containers

Container & Kubernetes Security

Docker Best Practices

Use minimal base images (distroless, Alpine)
Run containers as non-root user
Multi-stage builds to exclude build tools
Scan images with Trivy before push
Sign images with Docker Content Trust / cosign
Never store secrets in Dockerfiles or layers

Kubernetes Hardening

RBAC with least-privilege service accounts
Network policies to restrict pod-to-pod traffic
Pod Security Standards (restricted profile)
Secrets in Azure Key Vault via CSI driver
OPA Gatekeeper for admission control policies
Falco for runtime threat detection

Best Practices

DevSecOps Pro Tips

Treat security findings as bugs

Put CVEs and security findings on the same backlog as feature bugs. Triage them by severity. Never let critical findings age past 24 hours in your pipeline.

Automate everything, gate on critical

Run all security scans automatically but only block the pipeline on CRITICAL/HIGH findings. LOW/MEDIUM go to a security dashboard for triage — don't create alert fatigue.

Threat model during sprint planning

Include a 15-minute threat modelling session for each new feature. Use STRIDE to identify threats before a single line of code is written. This is the true "shift-left."

Developer security training matters

The best security tool is a security-aware developer. Run quarterly OWASP Top 10 training, use gamified platforms like Secure Code Warrior, and do blameless post-mortems on security incidents.

Golden path for security tooling

Create a "golden path" — a pre-configured repo template with all security tools pre-wired. New projects inherit the security pipeline automatically. No opt-in required.

Measure your security posture

Track Mean Time To Remediate (MTTR) for CVEs, deployment frequency of security patches, and the number of security gates in your pipeline. What gets measured gets improved.