Secure software development life cycle
Year: 2023
Type: dissertation
Abstract: The adoption of the DevSecOps methodology has been gaining prominence in the emerging technological scenario, progressively replacing traditional approaches. This increase in popularity is largely due to the urgent need to integrate security into the software development life cycle. Through DevSecOps, security is treated as an inherent element at all stages of the development process, and not just as an afterthought. This early and ongoing focus on security results in greater robustness against threats and vulnerabilities, a more efficient process, and a higher quality end product. Ignoring security during development can result in significant risks, from data breaches and substantial financial losses, to reputation damage. However, it is also necessary to acknowledge that there is a lack of clear guidance and standards regarding how to implement DevSecOps and select security tools. This absence of information leaves organizations with little guidance on how to effectively integrate security into their processes. It is in this context that the present dissertation was developed, having the goal of guiding organizations and individuals about the current problems and solutions associated with DevSecOps across all its phases. This works also aims at serving as a guide in its implementation and for selecting security tools, backed by a comparative analysis of these resources. In this way, organizations can increase the security of their supply chain and software development cycle. The culmination of this research has been demonstrated in a practical context through a case study at Altice Labs S.A. The findings not only reveal areas of improvement within their software development cycle, but also facilitated the implementation of a pipeline to analyze the security of one of their projects, SmartAL. This real-life application of DevSecOps concepts and tools underscores the practicality and importance of this research.
Author: Souto, Pedro Miguel Gomes de Almeida
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7071267731