DevSecOps
DevSecOps: Integration of security practices into development, deployment, and operations. The term is relevant to the assessment and design of modern security architectures and should be applied within the specific technical and organizational context.
How it works and where it fits
DevSecOps places security within the lifecycle of software and technical change. Requirements, architecture, implementation, testing, release, and maintenance affect one another. The earlier a weakness or unsafe assumption is identified, the more precisely it can be corrected without relying solely on downstream security products.
Practical security relevance
Practical implementation requires explicit quality criteria, reviewable changes, and a traceable supply chain. Automated checks provide rapid feedback but do not replace threat modeling or manual analysis of security-critical logic. Dependencies, build systems, artifacts, and secrets need protection alongside source code; operational and incident findings feed back into development.
Related concepts
- Application SecurityApplication SecurityProtects software against vulnerabilities during development, operation, and maintenance.: Protects software against vulnerabilities during development, operation, and maintenance.
- Secure CodingSecure CodingProgramming practices aimed at avoiding common vulnerabilities and misconfigurations.: Programming practices aimed at avoiding common vulnerabilities and misconfigurations.
- Open Web Application Security ProjectOpen Web Application Security ProjectNon-profit community providing standards, tools, and knowledge bases regarding application security.: Non-profit community providing standards, tools, and knowledge bases regarding application security.
- Security TestingSecurity TestingExamines systems, applications, and controls for weaknesses and malfunctions.: Examines systems, applications, and controls for weaknesses and malfunctions.