What is DevSecOps?

When development organizations code with security in mind from the outset, it’s easier and less costly to catch and fix vulnerabilities—before they go too far into production or after release.

The benefits of moving from DevOps to DevSecOps include

• Finding issues early. Finding issues before they're pushed further into the SDLC reduces your chances of them slipping through to production.
• Fixing issues faster. Automating testing and orchestrating by policy, when combined with closed feedback loops between your security and development teams, helps your teams cut though findings noise, prioritize efficiently, and speed up remediation.
• Reducing the window of attack opportunity. Abbreviating the time span between detection and remediation means malicious actors have a much smaller opportunity to gain access.
• Increasing the ability to scale. Integrating testing into your development pipeline and managing with automated policy gives you the flexibility to scale up or down without sacrificing development velocity.

To implement DevSecOps, organizations should consider a variety of application security testing (AST) tools to integrate within various stages of their CI/CD process. Commonly used AST tools include

• Static application security testing (SAST). SAST tools scan proprietary or custom code for coding errors and design flaws that could lead to exploitable weaknesses. SAST tools such as Coverity® Static Analysis are used primarily during the code, build, and development phases of the SDLC. 
• Software composition analysis (SCA). SCA tools such as Black Duck® SCA scan source code and binaries to identify known vulnerabilities in open source and third-party components. They also provide insight into security and license risks to accelerate prioritization and remediation efforts. In addition, they can be integrated seamlessly into a CI/CD process to continuously detect new open source vulnerabilities, from build integration to preproduction release.
• Interactive application security testing (IAST). IAST tools work in the background during manual or automated functional tests to analyze web application runtime behavior. For example, Seeker® IAST uses instrumentation to observe application request/response interactions, behavior, and dataflow. It detects runtime vulnerabilities and automatically replays and tests the findings, providing detailed insights to developers down to the line of code where they occur. This enables developers to focus their time and effort on critical vulnerabilities.
• Dynamic application security testing (DAST). DAST is an automated black box testing technology that mimics how a hacker would interact with your web application or API. It tests applications over a network connection and by examining the client-side rendering of the application, much like a pen tester would. DAST solutions do not require access to source code or customization; they interact with your website and find vulnerabilities with a low rate of false positives. For example, Continuous Dynamic^™ and Polaris fAST Dynamic identify vulnerabilities on web applications and APIs, including web-connected devices such as mobile back-end servers, IoT devices, and RESTful or GraphQL APIs.