Best of DevSecOps — August 2024

1. 1
   Article

   Arcjet·2y

   Whatever happened to DevSecOps?

   The concept of DevSecOps aimed to integrate security throughout the development lifecycle, but it hasn't worked out as planned. The clash between development speed and security needs remains an issue. The future might resemble the rise of Site Reliability Engineering (SRE), where dedicated security teams build tools and provide guidance, allowing developers to handle application-specific security details. This approach mirrors platform engineering with a security focus.

   19

   2
2. 2
   Article

   GitLab·2y

   FAQ: GitLab CI/CD Catalog

   The GitLab CI/CD Catalog enhances software development by enabling users to discover, reuse, and contribute CI/CD components. Available starting from GitLab 17.0, the catalog supports version control, composite components, and multiple input types. It can be used both on GitLab.com and self-managed instances. Testing strategies include using $CI_COMMIT_SHA and child pipelines. Users can create private components, clone public repos, and prevent job name collisions using dynamic names. Documentation and best practices are essential for effective usage.

   18
3. 3
   Article

   DevOps.com·2y

   DevSecOps: Integrating Security Into the DevOps Lifecycle

   DevSecOps integrates security into the DevOps process, ensuring protection at every step of software development. By embedding security within the workflow, it creates a more secure end product while speeding up development and ensuring regulatory compliance. Key principles include 'security as code' and a shared responsibility model, with the use of automated security testing tools across different stages. Challenges include the need for skill upgrades and balancing rapid deployment with security. Emerging trends like AI in security, increased compliance, and cloud-native practices are set to shape the future of DevSecOps.

   13