Continuous risk assessment in secure DevOps

TL;DR

This paper advocates integrating risk assessment, especially threat modeling, into secure DevOps practices to enhance early security considerations, improve automation, and align security with continuous software delivery.

Contribution

It provides a roadmap for embedding risk activities within secure DevOps, combining threat modeling with continuous practices, supported by case studies and practical tools.

Findings

Risk assessment enhances security in DevOps workflows.

Automating threat modeling improves early security integration.

Case studies demonstrate practical benefits of the proposed approach.

Abstract

DevOps (development and operations), has significantly changed the way to overcome deficiencies for delivering high-quality software to production environments. Past years witnessed an increased interest in embedding DevOps with cybersecurity in an approach dubbed secure DevOps. However, as the practices and guidance mature, teams must consider them within a broader risk context. We argue here how secure DevOps could profit from engaging with risk related activities within organisations. We focus on combining Risk Assessment (RA), particularly Threat Modelling (TM) and apply security considerations early in the software life-cycle. Our contribution provides a roadmap for enacting secure DevOps alongside risk objectives, devising informed ways to improve TM and establishing effective security underpinnings in organisations focusing on software products and services. We aim to outline proven methods over the literature on the subject discussing case studies, technologies, and tools. It presents a case study for a real-world inspired organisation employing the proposed approach with a discussion. Enforcing these novel mechanisms centred on security requires investment, training, and stakeholder engagement. It requires understanding the actual benefits of automation in light of Continuous Integration/Continuous Delivery settings that improve the overall quality of software solutions reaching the market.