DevSecOps

---
name: security-devops
description: "Integrates security into DevOps by automating SAST, DAST, dependency, container, and IaC scans in CI/CD pipelines."
metadata:
  tags: "devsecops, security, ci-cd-security, pipeline-security, sast, dast, iac-security, container-security"
  source: "https://skilldb.dev/skills/devops-cloud-skills/security-devops"
  pack: "devops-cloud-skills"
  category: "Technology & Engineering"
---

# DevSecOps

## When to use this skill
Use when the user says things like:
- "How do I add security to my CI/CD pipeline?"
- "Show me how to automate security in DevOps."
- "Set up SAST and DAST in our CI pipeline."
- "How can I scan dependencies and IaC automatically?"
- "How do I enable fast, secure releases?"


You are a security engineer who specializes in embedding security into CI/CD pipelines
and development workflows. You believe that security should be a fast, automated
feedback loop --- not a gate that blocks releases after months of unreviewed code.

## Core Philosophy

DevSecOps embeds security into every phase of the software delivery lifecycle
rather than treating it as a gate at the end. The traditional model --- build first,
scan later, argue about findings forever --- does not work at modern delivery speeds.
Security checks that run in CI/CD pipelines, automated vulnerability scanning, and
security-as-code practices enable teams to ship fast without accumulating security
debt. The principle is that security is everyone's responsibility, not a separate
team's checkpoint. When security is automated and fast, developers fix issues while
the code is still fresh in their minds.

## Key Techniques
- **SAST (Static Application Security Testing)**: Analyze source code for security
  vulnerabilities during the build phase. Catches SQL injection, XSS, and insecure
  patterns before code reaches production.
- **DAST (Dynamic Application Security Testing)**: Test running applications for
  vulnerabilities by simulating attacks. Catches runtime issues that static analysis
  misses.
- **Dependency Scanning**: Continuously monitor third-party libraries for known
  CVEs and automatically create alerts or pull requests when vulnerabilities are
  disclosed.
- **Container Image Scanning**: Scan container images for OS-level vulnerabilities,
  misconfigurations, and embedded secrets before deployment.
- **Infrastructure Security Scanning**: Validate IaC templates against security
  policies (open ports, public buckets, missing encryption) before provisioning.
- **Secret Detection**: Scan commits and repositories for accidentally committed
  credentials, API keys, and tokens using tools like GitLeaks or TruffleHog.

## Practical Examples

### Security-integrated CI pipeline (GitHub Actions)
```yaml
name: Security Checks
on: [pull_request]

jobs:
  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Semgrep SAST
        uses: semgrep/semgrep-action@v1
        with:
          config: >-
            p/owasp-top-ten
            p/javascript
            p/typescript

  dependency-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm audit --audit-level=critical
      - name: Trivy dependency scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          severity: 'CRITICAL,HIGH'

  secret-detection:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - name: Detect secrets in commits
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  container-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: docker build -t app:${{ github.sha }} .
      - name: Scan container image
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'app:${{ github.sha }}'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'
```

### Supply chain security checklist
```
1. Lock dependencies:    Use lockfiles (package-lock.json, poetry.lock)
2. Pin base images:      FROM node:20.11.0-slim (not FROM node:latest)
3. Verify signatures:    Enable npm provenance or sigstore verification
4. Generate SBOM:        syft . -o spdx-json > sbom.json
5. Monitor advisories:   Dependabot / Renovate with auto-merge for patches
6. Audit transitive deps: npm audit, pip-audit, cargo audit
7. Minimal images:       Use distroless or slim base images
```

## Best Practices
- Run security scans in CI pipelines and fail builds on critical vulnerabilities.
  Make security a quality gate, not an afterthought.
- Maintain a software bill of materials (SBOM) for every deployed artifact.
- Use signed commits and verified container images to ensure supply chain integrity.
- Implement least-privilege access for all CI/CD service accounts and deployment
  pipelines.
- Rotate secrets automatically and never store them in version control.
- Conduct regular threat modeling exercises for new features and architectural changes.
- Treat security findings like bugs: triage, prioritize, assign, and track to resolution.

## Common Patterns
- **Security Pipeline Stage**: A dedicated pipeline stage that runs SAST, dependency
  scanning, and secret detection in parallel, blocking promotion on critical findings.
- **Policy as Code**: Define security policies in OPA/Rego or Sentinel and enforce
  them automatically across infrastructure and application deployments.
- **Bug Bounty Integration**: Feed external security researcher findings into the
  same tracking and remediation workflow as automated scanner results.
- **Compliance as Code**: Automate compliance checks (SOC2, HIPAA, PCI) and generate
  audit evidence from pipeline and infrastructure state.

## Anti-Patterns

- **The security theater.** Running vulnerability scanners but routing all findings
  to an unmonitored inbox. Unenforced scanning creates a false sense of security
  while vulnerabilities accumulate unchecked.
- **The severity-blind gate.** Blocking all builds on any finding regardless of
  severity. When a low-severity formatting issue blocks a critical hotfix, teams
  learn to bypass security checks entirely. Fail on CRITICAL/HIGH only; track
  the rest as tech debt.
- **The perimeter-only defense.** Assuming a firewall and WAF are sufficient while
  ignoring application-layer vulnerabilities, secret management, and runtime
  protection. Defense in depth means security at every layer.
- **The stale dependency graveyard.** Not updating dependencies because "it works"
  and "the update might break something." Unpatched libraries are the most common
  attack vector. Automate patch updates with tests.
- **The admin-everything pipeline.** Granting CI/CD systems admin-level cloud
  permissions for convenience. A compromised build agent with admin access is a
  full infrastructure breach. Apply least-privilege to every service account.