Revisit security in the era of DevOps: An evidence‐based inquiry into DevSecOps industry

作者：Xin Zhou, Runfeng Mao, He Zhang, Qiming Dai, Huang Huang, Haifeng Shen, Jingyue Li, Guoping Rong · 发表于：IET Software · 年份：2023 · DOI：10.1049/sfw2.12132 · 被引用次数：21 · 研究领域：Outsourcing and Supply Chain Management、Software Engineering Techniques and Practices、Technology Assessment and Management

Abstract By adopting agile and lean practices, DevOps aims to achieve rapid value delivery by speeding up development and deployment cycles, which however lead to more security concerns that cannot be fully addressed by an isolated security role only in the final stage of development. DevSecOps promotes security as a shared responsibility integrated into the DevOps process that seamlessly intertwines development, operations, and security from the start throughout to the end of cycles. While some companies have already begun to embrace this new strategy, both industry and academia are still seeking a common understanding of the DevSecOps movement. The goal of this study is to report the state‐of‐the‐practice of DevSecOps, including the impact of DevOps on security, practitioners' understanding of DevSecOps, and the practices associated with DevSecOps as well as the challenges of implementing DevSecOps. The authors used a mixed‐methods approach for this research. The authors carried out a grey literature review on DevSecOps, and surveyed the practitioners of DevSecOps in industry of China. The status quo of DevSecOps in industry is summarized. Three major software security risks are identified with DevOps, where the establishment of DevOps pipeline provides opportunities for security‐related activities. The authors classify the interpretations of DevSecOps into three core aspects of DevSecOps capabilities, cultural enablers, and technological enablers. To materialise the interp...