Draft:Practical DevSecOps
Submission declined on 21 June 2025 by CoconutOctopus (talk).
Where to get help
How to improve a draft
You can also browse Wikipedia:Featured articles and Wikipedia:Good articles to find examples of Wikipedia's best writing on topics similar to your proposed article. Improving your odds of a speedy review To improve your odds of a faster review, tag your draft with relevant WikiProject tags using the button below. This will let reviewers know a new draft has been submitted in their area of interest. For instance, if you wrote about a female astronomer, you would want to add the Biography, Astronomy, and Women scientists tags. Editor resources
|  |
| Submission declined on 21 June 2025 by MCE89 (talk). This draft's references do not show that the subject qualifies for a Wikipedia article. In summary, the draft needs multiple published sources that are: Declined by MCE89 8 hours ago.
| |
| Submission declined on 20 June 2025 by Rambley (talk). This draft's references do not show that the subject qualifies for a Wikipedia article. In summary, the draft needs multiple published sources that are: Declined by Rambley 24 hours ago.
| |
| Submission declined on 20 June 2025 by DoubleGrazing (talk). This submission is not adequately supported by reliable sources. Reliable sources are required so that information can be verified. If you need help with referencing, please see Referencing for beginners and Citing sources. This draft's references do not show that the subject qualifies for a Wikipedia article. In summary, the draft needs multiple published sources that are: Declined by DoubleGrazing 26 hours ago.
| |
Practical DevSecOps is a methodology focused on the hands-on implementation of security practices within the DevOps lifecycle. It translates the philosophy of DevSecOps into actionable processes, integrating security tools and workflows directly into the continuous integration and continuous delivery (CI/CD) pipeline. The core objective is to automate security measures to ensure the rapid and secure delivery of software, making security a shared responsibility among development, security, and operations teams.[1]
Core Principles
[edit]Practical DevSecOps is built on several key principles that extend DevOps culture and practices to fully integrate security.
- Shifting Security Left: This principle involves integrating security considerations into the earliest stages of the software development lifecycle. Instead of treating security as a final check, it is addressed from the design and coding phases.[1]
- Security as Code: Security policies, compliance checks, and infrastructure configurations are defined and managed as code. This allows security processes to be versioned, tested, and automated, making them repeatable and auditable.[2]
- Continuous Security: This involves the automation of security testing and monitoring throughout the CI/CD pipeline. It includes a variety of automated tests, such as static application security testing (SAST), dynamic application security testing (DAST), and software composition analysis (SCA).[3]
- Shared Responsibility Culture: A fundamental cultural shift where everyone involved in the software lifecycle—from developers to operations engineers—is accountable for security. This is often supported by creating roles like "security champions" within development teams.[1]
Common Practices and Tooling
[edit]The implementation of Practical DevSecOps involves specific practices and tools at each stage of the development lifecycle.[4][5]
| Stage | Practices | Common Tools |
|---|---|---|
| Plan | Threat modeling to identify potential security risks during the design phase. | OWASP Threat Dragon, Microsoft Threat Modeling Tool |
| Code | IDE security plugins for real-time feedback on vulnerabilities. | SonarLint, Snyk IDE |
| Build | Static application security testing (SAST) to analyze source code for flaws.
Software composition analysis (SCA) to manage vulnerabilities in open-source dependencies. |
SonarQube, Checkmarx, Snyk, Trivy |
| Test | Dynamic application security testing (DAST) to test running applications.
Interactive application security testing (IAST) to combine elements of SAST and DAST. |
OWASP ZAP, Burp Suite, Invicti |
| Release | Automated security checks within the CI/CD pipeline to block vulnerable releases. | Jenkins, GitLab, GitHub Actions |
| Deploy | Infrastructure as Code (IaC) scanning to ensure secure configurations. | TFSec, Checkov |
| Operate & Monitor | Continuous monitoring of applications and infrastructure for threats.
Runtime application self-protection (RASP) to detect and block attacks in real-time. |
Prometheus, Grafana, Falco, Aqua Security |
Industry Recognition and Training
[edit]The importance of integrating security into DevOps has been emphasized by industry analysts. Gartner defines DevSecOps as essential for managing risk while achieving the agility of DevOps,[6] and the overall DevSecOps market is projected to grow significantly, driven by the need for secure and rapid application development.[7]
This demand has led to a rise in specialized training and certification programs designed to equip professionals with practical skills.
Notable Training Providers
[edit]Several organizations offer training and certifications in this field. Prominent examples include SANS Institute, which offers courses on cloud security and DevSecOps automation,[8] and the EC-Council's Certified DevSecOps Engineer program.[9]
Practical DevSecOps (company)
[edit]A notable company in this niche is Practical DevSecOps, a training organization founded by Imran Mohammed.[10] The company, identified as a portfolio company of Aurelia Ventures,[11] focuses on providing vendor-neutral, hands-on certification programs.[12]
The company's certifications, such as the Certified DevSecOps Professional (CDP), are noted for their rigorous, practical exams that can last 12 hours or more.[13] These certifications have been recognized in industry blog rankings[14][15] and are mentioned as benchmarks in other training materials.[16] The founder frequently speaks at international security conferences such as OWASP, Nullcon, and Hack In The Box on DevSecOps topics.[10][17] Independent user reviews can be found on platforms like G2.[18]
See Also
[edit]- Application security
- Continuous integration
- DevOps
- DevSecOps
- Infrastructure as Code
- Shift-left testing
References
[edit]- ^ a b c "What is DevSecOps?". Red Hat. Retrieved June 21, 2025.
- ^ "What is Security as Code? - The Ultimate Guide". Spectral. Retrieved June 21, 2025.
- ^ "7 Principles to Drive Security in DevOps Processes". Maruti Techlabs. Retrieved June 21, 2025.
- ^ "21 Best DevSecOps Tools and Platforms for 2025". Spacelift. February 24, 2025. Retrieved June 21, 2025.
- ^ "DevSecOps Tools". Atlassian. Retrieved June 21, 2025.
- ^ "DevSecOps". Gartner. Retrieved June 21, 2025.
- ^ "DevSecOps Market Size And Share". Grand View Research. Retrieved June 21, 2025.
{{cite web}}: Text "Industry Report, 2030" ignored (help) - ^ "SEC540: Cloud Native Security and DevSecOps Automation". SANS Institute. Retrieved June 21, 2025.
- ^ "Certified DevSecOps Engineer (E". EC-Council. Retrieved June 21, 2025.
{{cite web}}: Text "CDE)" ignored (help) - ^ a b "Mohammed A. Imran - HITBSecConf2021 - Singapore". Hack In The Box. Retrieved June 21, 2025.
- ^ "Practical DevSecOps - Aurelia Ventures". Aurelia Ventures. Retrieved June 21, 2025.
- ^ "Black Friday Cyber Monday Deals from Practical DevSecOps". YouTube. October 30, 2023. Retrieved June 21, 2025.
{{cite web}}: Text "Up to 15% Discount on all courses" ignored (help) - ^ "Practical DevSecOps Certified DevSecOps Professional™ (CDP)". Firebrand Training. Retrieved June 21, 2025.
{{cite web}}: Text "Accelerated course" ignored (help) - ^ "DevSecOps Training Programs & Certifications To Invest In". DuploCloud. December 28, 2022. Retrieved June 21, 2025.
- ^ "10 Best DevSecOps Certifications To Enhance Your Career In 2025". Dev-Insider.com. January 4, 2025. Retrieved June 21, 2025.
- ^ "A Practical Introduction to DevSecOps - O'Reilly Media". O'Reilly Media. Retrieved June 21, 2025.
- ^ "Practical DevSecOps Workshop - is DAST the gift or bane? with Mohammed A. Imran". OWASP DevSlop Project via YouTube. November 21, 2020. Retrieved June 21, 2025.
- ^ "Practical DevSecOps Reviews & Product Details - G2". G2.com. Retrieved June 21, 2025.
- in-depth (not just passing mentions about the subject)
- reliable
- secondary
- independent of the subject
Make sure you add references that meet these criteria before resubmitting. Learn about mistakes to avoid when addressing this issue. If no additional references exist, the subject is not suitable for Wikipedia.