Applying frameworks to DevSecOps

In this section, we will learn how to include the controls of frameworks in DevOps and embed them as DevSecOps. Good news: it's not as hard as it may sound. The following diagram shows this process:

Figure 13.3 – Process of applying controls from security frameworks to DevOps

In general, we start by assessing the framework that the enterprise needs to apply to their IT environments. From that assessment, the different controls are derived and set to the development and deployment cycles of applications and infrastructure. As soon as code is pulled from the repositories, scanning starts against these controls.

We are using the CIS benchmark as an example here since CIS is the most used framework for setting security controls. Applying controls starts with the realization that in DevOps, the IT environments are highly dynamic by default. Everything, including the infrastructure, is turned into code, so applications...