Understanding the DevSecOps ecosystem

DevSecOps is a software industry culture shift that aims to incorporate security into the rapid-release cycles typical of modern application development and deployment, also known as the DevOps movement. Embracing this shift-left mindset necessitates organizations bridging the gap that typically exists between development and security teams, to the point where many of the security processes are automated and handled by engineering teams.

The following diagram helps depict how security fits into the existing DevOps loop:

Figure 11.3 – Diagram showing the interaction between DevOps and DevSecOps

Historically, major software developers would release new versions of their applications every few months, if not years. This gave the code enough time to go through quality assurance and security testing, which was handled by separate specialized teams, either internal or externally contracted.

However, the last 10 years...