There’s a call throughout the industry to shift security left in the software development lifecycle, expanding the DevOps methodologies that have been growing in adoption for more than a decade. DevSecOps is based on the idea that security is not an afterthought. Rather, it is a collaborative process that must be integrated from the start of the development process.
This blog is the second in a four-part series about how Puppet can help government agencies meet compliance and security requirements. Read the first post here. Zero Trust is a strategy created to combat system intrusions through a “never trust, always verify” model. DevSecOps is a collaborative software development strategy that integrates development, security, and operations practices into a continuously evolving lifecycle.
Software programs today can be likened to a complex stew, with multiple ingredients sourced from disparate places. In software, open-source tools are a major ingredient. According to the 2020 Open Source Security and Risk Analysis (OSSRA) report produced by the Synopsys Cybersecurity Research Center, 99 percent of the codebases contain at least one open source component, with open source comprising 70 percent of the code overall.
