DevSecOps Phases 101

DevSecOps, a combination of ‘Development,’ ‘Security,’ and ‘Operations,’ has brought a paradigm shift to the integration of security within the software development lifecycle. DevSecOps cycle incorporates security practices at each juncture, from ideation to deployment, guaranteeing that software is not just functionally sound but also inherently secure. This article delves into the five pivotal phases of the DevSecOps framework, outlining how each phase fosters a secure software development journey.

To successfully adopt DevSecOps, the following steps should be taken:

• Ensure that security controls, DevSecOps processes, and tools are incorporated at the beginning of the DevOps workflow, enabling automated security checks to be conducted throughout the entire software delivery process.
• Mitigate vulnerabilities in software programming by integrating security principles right from the outset of the software development lifecycle (SDLC).
• Foster a collective responsibility among all stakeholders, including IT operations teams and developers, to strictly adhere to security procedures in their respective tasks.

The 5 Phases of DevSecOps

The core principles of DevSecOps are divided into five stages. Let’s understand the 5 phases that must be incorporated during the DevSecOps software development cycle:

Plan

When approaching new roadmap initiatives, individual projects, or feature enhancements, it is crucial to thoroughly analyze and tackle the potential threat models specific to the undertaking. It is necessary to assess any risk of data breaches or data leakage and implement proactive measures to prevent such incidents. Furthermore, it is essential to consider and incorporate any applicable national or local security policies into the development requirements. From our experience, threat models often exhibit resemblances among companies operating in industries such as Healthcare or Financial Services, so conducting comprehensive research and engaging in collaborative planning are recommended to address these factors effectively.

Code

During the code phase, developers can improve the security of their code by utilizing DevSecOps technologies. Key security practices during this phase include conducting code reviews, performing static code analysis, and implementing pre-commit hooks.

By integrating security technologies directly into the developer’s existing Git workflow, each commit and merge can automatically trigger a security test or review. These technologies are designed to support multiple integrated development environments and programming languages. Popular security tools commonly used in this context include PMD, Gerrit, SpotBugs, CheckStyle, Phabricator, and Find Security Bugs.

Build

Once you have defined your requirements and established a plan with code, it is essential to examine your backlog and ensure that all your security requirements are accounted for. Have you included acceptance criteria in your backlog stories to address the security needs associated with each feature? Have you incorporated stories specifically for managing permissions and system settings that may be affected? It is worth noting that there are distinct considerations for declarative features compared to custom-built ones:

• Custom Development: Conduct code reviews and inspect open-source libraries and other code assets for custom-built features to ensure compliance with security requirements. Automated code scanning tools can assist in maintaining quality control and achieving spot-checks during development.
• Declarative Development: Establish clear standards and best practices for declarative features in the Salesforce platform. Properly describe fields and objects, label process builders and flows, and apply suitable security settings. Utilize automated tools to enforce security best practices, including data classification, auditing profiles, and permission sets, and implementing data visibility controls with intelligent alerting capabilities.

Whether your focus is on custom or declarative development, planning for tracking user behavior in your new application, release, or feature is essential. Particularly for highly regulated industries like Financial Services and Healthcare, incorporating backlog items that facilitate employee behavior tracking and provide alerts for suspicious activities is crucial. This becomes crucial when managing significant data extractions, personally identifiable information (PII), or regulated functionalities such as chat or support channels.

Test

To strengthen your DevSecOps approach during testing for new features and releases, you must take the following requirements into account:

Penetration Testing: As Salesforce apps become more client- and partner-facing, it is crucial to have a robust plan for conducting penetration testing. This involves assessing the security of apps exposed to external entities beyond your collective VPNs and firewalls, including communities, Experience Cloud, Lightning Web Components, custom mobile apps, and chatbots.

Static Application Security Testing (SAST): To ensure the security of Salesforce code, it is vital to integrate a static code analysis tool into your development process. Conduct thorough audits of Apex, Visualforce, Lightning Components, and JavaScript to identify OWASP’s top 10 vulnerabilities and adhere to Salesforce security best practices. While tools like Clayton and PMD are recommended, explore other available options.

Interactive Application Security Testing: Incorporating advanced in-browser tools for runtime security analysis is crucial for identifying vulnerabilities in Salesforce applications. These tools assess runtime issues, including 3rd-party modules and managed package components that may not be fully covered by static application security testing (SAST). To ensure effective security testing, having a well-defined plan for integrating these tools into your functional testing process and promptly addressing any identified issues is important.

Addressing these considerations can strengthen your DevSecOps approach and ensure robust security testing for your Salesforce applications.

Release

As your development and testing phase transitions to the release phase, it is crucial to prioritize security and incorporate it into your DevSecOps process flow. Auditing becomes a key consideration. How will you effectively track and audit changes, identify requesters and reasons, and understand connections and timing? While the Salesforce audit trail has limitations, following and documenting changes diligently is crucial. The audit and release log play a crucial role in the DevSecOps workflow, and utilizing tools such as Confluence, Jira, and Git repositories can significantly facilitate release management operations.

Deploy

Upon successful completion of the abovementioned steps, the next phase demands deployment. It may require you to address security-related issues that can impact the live production system. Furthermore, this stage focuses on logging change activities and the production release, including identifying configuration variations that may occur between the initial staging and development settings and the existing production environment.

Operation

After deployment, the DevSecOps life cycle requires an operation during which operations personnel perform regular maintenance tasks. The presence of zero-day vulnerabilities is a serious concern. Therefore, operation teams need to monitor them consistently. DevSecOps can leverage Infrastructure-as-Code (IaC) tools to swiftly and effectively protect the organization’s infrastructure, mitigating the risk of human error.

Monitor

It is essential to monitor security for any anomalies to prevent a breach. Therefore, it is crucial to implement a reliable continuous monitoring tool that operates in real-time. This tool will help track system performance and detect any potential vulnerabilities at an early stage.

The Bottom Line

DevSecOps incorporates security seamlessly throughout the software development lifecycle. Organizations can mitigate risks and prevent breaches by integrating security controls and tools early on. The five phases of DevSecOps – plan, code, build, test, and release – provide a structured framework for incorporating security. Organizations should conduct thorough threat analysis, use security technologies during coding, ensure security requirements are addressed during backlog management, perform comprehensive testing, including penetration testing and static/interactive application security testing, prioritize security during release and deployment, and implement continuous monitoring. By following these steps, organizations can achieve a proactive and comprehensive approach to security in their software development practices.

Frequently Asked Questions

What is the DevSecOps lifecycle approach?

The DevSecOps lifecycle approach involves incorporating security practices throughout the software development process:

• It begins with thorough planning, analyzing potential threats, and incorporating security requirements.
• During the code phase, developers utilize DevSecOps technologies and conduct code reviews and static code analysis.
• The build phase involves examining the backlog to ensure security requirements are accounted for in custom and declarative development.
• Testing includes penetration testing, static application security testing, and interactive application security testing.
• Release involves prioritizing security, tracking changes, and documenting them.
• Deployment addresses security issues and focuses on logging change activities.
• Operation requires regular maintenance and monitoring for zero-day vulnerabilities.
• Continuous monitoring in real-time helps detect potential vulnerabilities.