Security-as-code gives pragmatic meaning to the concept of DevSecOps. By embedding security throughout your SDLC, security controls can be automated and consistently applied. As the use of infrastructure as code accelerates, this automated approach to security policies becomes a critical necessity to keep up with DevOps velocity.
Predefined security policies boost efficiency, and also allow for checks on automated processes to prevent misconfigurations that result in exploitable security flaws.
Six security-as-code capabilities to prioritise
Developers want to create secure code, but they’ve lacked the tools and practices to do so. By embedding security into the DevOps workflow, developers are finally empowered to resolve security flaws that they create, resolving them early when it is most efficient and before vulnerabilities can be introduced for exploit.
Automate
Security scans and tests (such as static analysis, container scanning, and fuzz testing) within your pipeline so that they can be consistently applied across all projects and environments.
Build
An immediate feedback loop by presenting results to developers, allowing them to remediate issues while coding and learn best practices during the coding process.
Evaluate
Evaluate and monitor automated security policies by building checks into the process. For instance, verify that sensitive data and secrets are not inadvertently shared or published.
Standardize
Standardize exception-handling. When vulnerabilities are found, automate simple remediations as well as approvals for more complex issues.
Test
Test new code at every code change..
Monitor
Monitor vulnerabilities and track their remediation using both scheduled and continuous methods. Features, such as GitLab’s Security Dashboard and Compliance Dashboard, can improve visibility while simplifying efforts.
