Gartner has published a new guide for enterprises looking to use DevSecOps approaches that incorporate security into DevOps. According to the report, “In the past 12 months at Gartner, how to securely integrate security into DevOps — delivering DevSecOps — has been one of the fastest-growing areas of interest of clients, with more than 600 inquiries across multiple Gartner analysts in that time frame.” It suggested enterprises take the following 10 steps if they want to be successful with DevSecOps:
- Adapt your security testing tools and processes to the developers, not the other way around.
- Quit trying to eliminate all vulnerabilities during development.
- Focus first on identifying and removing the known critical vulnerabilities.
- Don’t expect to use traditional DAST/SAST without changes.
- Train all developers on the basics of secure coding, but don’t expect them to become security experts.
- Adopt a security champion model and implement a simple security requirements gathering tool.
- Eliminate the use of known vulnerable components at the source.
- Secure and apply operational discipline to automation scripts.
- Implement strong version control on all code and components.
- Adopt an immutable infrastructure mindset.
