This article is based on concepts originally covered by TechTarget and the SANS Institute’s Secure DevOps Toolchain initiative.
Why Traditional Security Falls Short in a DevOps World
DevOps and cloud computing have fundamentally changed how organizations design, build, deploy, and operate online systems. Delivery cycles that once spanned months now compress into days, hours, or even minutes. According to the SANS Institute’s application security research, a significant proportion of organizations are delivering changes to production on a weekly, daily, or continuous basis.
That pace creates a serious problem for conventional security programs. Traditional gate-based security reviews—conducted once per release cycle—simply cannot keep up when dozens of deployments happen every day. Security, IT, and risk professionals are left scrambling to reduce risk without slowing down delivery.
The answer is Secure DevOps (sometimes called DevSecOps): shifting security left and embedding automated controls throughout the entire software delivery lifecycle rather than bolting them on at the end.
The Secure DevOps Toolchain Framework
To help security professionals know where to start, the SANS security community developed the Secure DevOps Toolchain—a framework that maps key security activities and tools to each phase of a continuous integration and continuous delivery (CI/CD) pipeline. The framework organises security work into five sequential lifecycle phases.
Phase 1: Pre-Commit
Security work that happens before code reaches version control is the earliest—and often most cost-effective—opportunity to catch problems.
- Threat modeling: Identify design-level risks before a single line of production code is written. Structured threat modeling sessions (using frameworks such as STRIDE) surface architectural weaknesses early.
- Rapid risk assessments: Lightweight assessments performed by developers or embedded security champions help prioritise which features or changes warrant deeper scrutiny.
- Pre-commit hooks: Client-side Git hooks can run lightweight static analysis or secret-scanning checks (for example, detecting hardcoded credentials) before a developer’s commit is accepted locally.
- Manual security reviews: Platforms such as GitHub and GitLab support pull-request workflows that enforce peer code review, making it straightforward to include security-focused reviewers in the process.
The goal at this phase is to prevent vulnerabilities from entering the codebase in the first place, rather than detecting them later when remediation is more expensive.
Phase 2: Commit — Continuous Integration
Every code commit triggers an automated build. This is the right moment to run fast, automated security checks that give developers near-instant feedback.
- Static Application Security Testing (SAST): Linting and static analysis tools scan application source code for common vulnerability patterns (injection flaws, insecure APIs, etc.) without executing the code.
- Infrastructure-as-Code (IaC) analysis: Security linters for Terraform, CloudFormation, or Ansible detect misconfigurations in infrastructure definitions before they reach any environment.
- Dependency scanning: Tools that check third-party libraries and packages against known vulnerability databases (such as the CVE list) catch vulnerable dependencies automatically on every build.
- Security unit tests: Encoding security requirements as automated tests ensures that regressions are caught as quickly as functional bugs.
- Container hardening and scanning: In containerised environments, base images should be scanned for known CVEs, and Dockerfile best practices (running as non-root, minimising layers, etc.) should be enforced automatically.
Speed matters here. If a security scan takes 30 minutes, developers will disable it. Prioritise tools that complete within the normal build window.
Phase 3: Acceptance — Continuous Delivery
Before a release candidate is promoted toward production, it should pass a richer set of security tests in a staging or acceptance environment that mirrors production as closely as possible.
- Dynamic Application Security Testing (DAST): Automated scanners probe the running application for vulnerabilities such as SQL injection, cross-site scripting, and authentication weaknesses—without requiring access to source code.
- Functional security tests: Test cases that verify security requirements (for example, confirming that unauthenticated users cannot access privileged endpoints) run as part of the acceptance suite.
- Infrastructure compliance scanning: Tools check that servers, containers, and cloud resources conform to hardening baselines (CIS Benchmarks, for example) and regulatory compliance requirements.
- Security acceptance criteria: Defining explicit, measurable security acceptance criteria—and gating promotion on them—ensures that security is a first-class quality attribute alongside performance and correctness.
Phase 4: Production — Continuous Deployment
Deploying to production introduces a new set of security concerns. Controls at this phase focus on ensuring the deployment process itself does not introduce risk.
- Smoke tests: Lightweight post-deployment checks confirm that critical security controls (authentication, TLS, access controls) are functioning correctly in the live environment immediately after deployment.
- Configuration checks: Automated configuration validation detects environment-specific misconfigurations that may not have been present in staging.
- Secrets management: Tools such as HashiCorp Vault or cloud-native secrets managers (AWS Secrets Manager, Azure Key Vault) ensure that credentials, API keys, and certificates are injected securely at runtime rather than baked into images or configuration files.
- Immutable deployments: Treating infrastructure as immutable—replacing rather than patching running instances—reduces configuration drift and limits the attack surface over time.
Phase 5: Operate — Continuous Monitoring and Improvement
Security does not end at deployment. The operate phase covers the ongoing work needed to detect threats, respond to incidents, and feed learnings back into the next development cycle.
- Security monitoring and alerting: Centralised log aggregation, anomaly detection, and runtime application self-protection (RASP) tools provide continuous visibility into the behaviour of production systems.
- Vulnerability management: Continuously scanning running infrastructure and dependencies for newly disclosed CVEs ensures the team can respond quickly when a zero-day affects components in use.
- Game days and tabletop exercises: Simulated attack scenarios—run against production or a production-like environment—validate that detection and response capabilities work as expected under realistic conditions.
- Postmortems and retrospectives: Security incidents and near-misses should feed structured blameless postmortems. Findings become inputs to the pre-commit phase of the next iteration, closing the feedback loop.
- Learning engines and reporting: Aggregating data from monitoring, incidents, and postmortems into dashboards and reports helps teams track security posture over time and prioritise investments.
Tooling Across the Ecosystem
The SANS Secure DevOps Toolchain highlights that many effective security tools are free and open source. Contributors to the ecosystem include cloud providers (AWS, Microsoft Azure), infrastructure tooling vendors (HashiCorp), and engineering-led open source initiatives from companies such as Netflix and Etsy. The toolchain also references the Securing Web Application Technologies (SWAT) checklist as a practical resource for raising security awareness during software development.
Selecting the right tools matters less than integrating them consistently. A well-chosen set of tools, wired into your CI/CD pipeline and enforced as quality gates, will outperform a larger toolkit that developers can easily bypass.
Making Secure DevOps a Cultural Practice
Technology alone will not produce secure software. The five-phase framework succeeds only when development, operations, and security teams share responsibility for outcomes. Practically, this means:
- Embedding security champions within development teams who can provide in-context guidance.
- Treating security findings in the pipeline the same way as failing tests—as blockers that must be resolved before promotion.
- Investing in developer security education so that engineers understand not just what the tools flag but why it matters.
- Making security metrics visible to leadership so that risk reduction receives the same organisational attention as feature delivery.
DevOps has already redefined how software is built. Secure DevOps applies the same principles—automation, fast feedback, shared ownership, and continuous improvement—to the practice of security itself. For organisations operating at modern delivery speeds, it is no longer optional.
Original source: TechTarget / SANS Institute Secure DevOps Toolchain initiative (2018).