The growth of smart and connected products is fuelling the need for DevSecOps across industries that have traditionally relied on isolated embedded systems. While connected products and the Internet of Things promises many advances in automation, efficiency, and capability, it comes with the risk of greater vulnerability to cybersecurity attacks. DevSecOps practices help close these vulnerability gaps and reduce risks.
According to Gartner, DevSecOps is –
“integration of security into emerging agile IT and DevOps development as seamlessly and as transparently as possible. Ideally, this is done without reducing the agility or speed of developers or requiring them to leave their development toolchain environment.”
In other words, DevSecOps is a holistic and comprehensive automated approach to cybersecurity layered onto DevOps.
A DevSecOps framework takes the phases and practices of Continuous Integration (CI) and Continuous Deployment (CD) that are fundamental to DevOps and extends them with security practices.
For example, looking at the figure above, we can see that the DevSecOps framework adds secure coding practices to the software development phase of a typical DevOps framework.
DevSecOps tools are the applications and infrastructure used by an enterprise to realize a DevSecOps framework. This includes applications such as integrated development environments (IDEs), defect tracking and management systems, static application security testing (SAST) solutions, as well applications that provide automation and orchestration of the framework into pipelines.
The United States Department of Defense (DoD) DevSecOps Initiative (also known as the DevSecOps Mission) is –
“to develop a Continuous Monitoring (CM) approach for all Department of Defense (DoD) mission partners that monitors and provides compliance enforcement of containerized applications which cover all the DevSecOps pillars (Develop, Build, Test, Release & Deploy, and Runtime) for a secure posture with the focus being on automation and integration going forward.”
To realize this initiative, the DoD has developed several useful resources including a Fundamentals document to define and describe DevSecOps concepts, a Fundamentals Guidebook that elaborates the DevSecOps phases and activities, a Fundamentals Playbook that advises on how to successfully adopt DevSecOps, and a Strategy Guide.
While both DevSecOps and DevOps embody the principles of Continuous Integration (CI) and Continuous Deployment (CD), DevSecOps adds security practices throughout the framework. Ideally, all the tools in the DevSecOps framework will also support and enforce a Zero Trust Security model.
The LDRA tool suite provides several capabilities to support DevSecOps:
Shifting Left is a core principle of DevSecOps. Security testing and analysis are performed as early as possible in the lifecycle, revealing issues and mitigating risks. This implies a need for software developers to perform more testing during development rather than leaving it all to a later integration test phase.
The LDRA tool suite’s TBvision component and IDE integrations accelerate the use of coding standards compliance (for example from MISRA, CERT, or CWE), static application security testing (SAST), as well as measure and improve overall quality (clarity, maintainability, and testability). TBvision together with LDRA Testbed also provide dynamic application security testing (DAST), including structural coverage analysis, and dynamic data flow coverage analysis, ensuring source code is thoroughly tested. TBrun extends DAST with unit testing on the host and target, including support for numerous targets, simulators and emulators. All the testing and analysis is highly configurable to meet varying needs, and to provide actionable information at different stages of DevSecOps.
Additionally, TBmanager manages traceability between requirements, source code, and tests, greatly reducing the time and effort to find and fix defects. The LDRA tool provides customizable and easy to understand reports and visualizations, making it easy to capture certification evidence and identify problems.
The LDRA tool suite can be integrated with Jenkins, Bamboo, GitLab and many other continuous integration platforms to greatly improve efficiency. Integration with Continuous Integration (CI) platforms simplifies iterative and incremental development. Testing can be added to pipelines as needed, to test an operation, a file, or groups of operations/files. Adding LDRA tools to pipelines with existing testing tools results in improved software robustness.
CI provides automation of workflows designed to facilitate parallel development, including “pull” requests to aid in merging and releasing software updates. Workflow automation results in executing uniform sets of tests to ensure consistent code quality. “Benchmark” unit testing and coverage analysis can be performed on host and virtual targets, increasing confidence that on target testing will uncover very few errors. “For Credit” unit testing and coverage analysis can easily be performed on the physical target.
The LDRA tool suite supports many on-premises and cloud-hosted deployment options including the Wind River Studio, Azure DevOps, and Amazon Web Services platforms to support environment hardening and simplifying achieving security at scale. Deployment options include hardened “Zero Trust” environments that rely on always available “known good” containers, eliminating systemic vulnerabilities.
Flexible deployment provides the ability to realize full lifecycle management from a “single pane of glass” (dashboard) and accelerate transformative business outcomes from mission-critical intelligent edge systems that require security, safety, and reliability. Single pane of glass management makes it easy to use LDRA’s qualified tools and follow a consistent process to reduce certification cost and effort, streamlining certification.
Email: info@ldra.com
EMEA: +44 (0)151 649 9300
USA: +1 (855) 855 5372
INDIA: +91 80 4080 8707