Microservices-based DevSecOps Platform using Pipeline and Open Source Software

WEN-TIN LEE(李文廷) ； ZHUN-WEI LIU(劉峻維)

《Journal of Information Science and Engineering》 39卷5期 (2023/09) Pp. 1117-1128

https://doi.org/10.6688/JISE.202309_39(5).0007

摘要

Continuous integration and continuous deployment (CI/CD) are best practices for automating the software development process. People leverage them to ensure rapid iteration and delivery of product development. The rapid lifecycle makes traditional security management vulnerable to its lack of agility, exposing the urgent need to put security into DevOps processes. Development, security, and operation, quoted as DevSec Ops, advocates shift-left security, promotes people to implant security best practices into all DevOps stages, and builds continuous security analysis, testing, and management with automation. Based on CI/CD, this study defines continuous security practices and applies application security processes on a DevSecOps pipeline to implement shift-left security. The CodeHawk platform, based on the proposed secure pipeline and open source software, is developed to free the development team from testing manually, enable them to focus on development, gain the corresponding security assurance, and lower the operating costs. Experiments show that our DevSecOps pipeline design significantly improves the efficiency of the DevSecOps process.

關鍵字

DevOps ； DevSecOps ； continuous integration ； continuous delivery ； security testing ； open-source software