click to reveal definition
click to flip back
You know 0 of 24 cards in current set.
Ready to get certified?
Get CertifiedNeed this expertise applied inside your organization?
Explore Our ServicesFull Glossary
Foundations
- DevSecOps
- Integrating security into DevOps so security is built into the delivery pipeline continuously rather than added at the end.
- Discovery Workshop
- A facilitated session to assess current delivery and security practices and identify opportunities to improve.
- Solution Workshop
- A session to design concrete improvements and a roadmap for adopting DevSecOps practices.
- Shift Left Security
- Moving security activities earlier in the lifecycle so issues are found and fixed when cheap.
- Culture of Shared Responsibility
- Dev, ops, and security share accountability for delivering secure, working software.
Discovery
- Current-State Assessment
- Evaluating the existing pipeline, tools, and security practices to establish a baseline.
- Pipeline Mapping
- Mapping the steps from idea to production to reveal flow, handoffs, and where security fits.
- Identifying Bottlenecks
- Finding the constraints that most limit delivery speed and reliability.
- Security Gap Analysis
- Assessing where security controls are missing or manual across the pipeline.
- Value Stream Analysis
- Examining end-to-end flow to quantify delay, rework, and risk for improvement.
Pipeline
- Continuous Delivery Pipeline
- The workflow and automation delivering functionality: exploration, integration, deployment, and release on demand.
- Continuous Integration
- Frequently integrating and testing changes so defects surface early.
- Continuous Deployment
- Automatically moving validated changes toward production, reducing risk and time-to-market.
Security Practices
- Security Automation
- Automating security scans and checks in the pipeline so they run continuously and consistently.
- SAST and DAST
- Static and dynamic application security testing that find vulnerabilities in code and running systems.
- Software Composition Analysis
- Scanning dependencies for known vulnerabilities and license risks.
- Secrets Management
- Securely storing and controlling access to credentials and keys used in the pipeline.
- Infrastructure as Code Security
- Scanning and controlling infrastructure defined as code to prevent misconfigurations.
- Continuous Compliance
- Building compliance evidence into the flow of work so audits are continuous, not disruptive.
Solutions
- DevSecOps Roadmap
- A phased, prioritized plan to adopt security and automation improvements in the pipeline.
- Prioritizing Improvements
- Sequencing changes by value, feasibility, and risk to deliver the most benefit first.
- Toolchain Design
- Selecting and integrating tools to automate build, test, security, and deployment.
- Measuring Success
- Using metrics like deployment frequency, change failure rate, and vulnerability remediation time to track progress.
- Continuous Improvement
- Iterating on the pipeline and security practices so delivery gets faster and safer over time.