Security as Culture: A Systematic Literature Review of DevSecOps
Abstract
DevOps goes beyond automation, continuous integration and delivery processes, since it also encompasses people. In fact, DevOps promotes the collaboration between the development team and the operations team. When security comes into DevOps routines, people play an even more relevant role involving the collaboration between those teams and security team. Moreover, security is especially relevant while developing critical systems where we need to manage goals, risks and evidences. After implementing security into the DevOps toolchain, work only starts. We also need to start with behavioral changes in order to create a security culture. Several authors underlined DevSecOps, as one of the proposals for solving or, at least, minimizing this challenge. However, to date, the characterization of such a culture remains unclear. In this paper, a Systematic Literature Review was carried out to provide a better understanding of this topic from the human factor's perspective. However it raises the following question: Is DevSecOps going to become mainstream?
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
DevSecOps was first mentioned in 2012, and the earliest related paper was published in 2013.
“This was the decade within which the DevOps concept became common while DevSecOps was first mentioned in 2012 (Sanchez-Gordon and Colomo-Palacios, 2020), actually the earliest related paper was published in 2013.”
From Identifying the primary dimensions of DevSecOps: A multi-vocal literature review (2024) · cites this paper as Sanchez-Gordon and Colomo-Palacios, 2020
The two SLR studies were used to validate the authors' findings in terms of OPC-related practices.
“Hence, these two SLR studies were used to validate our findings in terms of OPC-related practices.”
From Identifying the primary dimensions of DevSecOps: A multi-vocal literature review (2024) · cites this paper as Sanchez-Gordon and Colomo-Palacios, 2020
2 DevSecOps practices were complemented from Sánchez-Gordón and Colomo-Palacios' SLR.
“60 practices have been identified - 56 were identified from our included primary studies; 2 were complemented from Sánchez-Gordón and Colomo-Palacios' SLR (Sanchez-Gordon and Colomo-Palacios, 2020); and 2 were complemented from Rajapakse's SLR (Rajapakse et al., 2022).”
From Identifying the primary dimensions of DevSecOps: A multi-vocal literature review (2024) · cites this paper as Sanchez-Gordon and Colomo-Palacios, 2020
Sánchez-Gordón and Colomo-Palacios's SLR characterized DevSecOps from a people and cultural perspective.
“Sánchez-Gordón and ColomoPalacios's SLR (Sanchez-Gordon and Colomo-Palacios, 2020) characterized DevSecOps from people and cultural perspective.”
From Identifying the primary dimensions of DevSecOps: A multi-vocal literature review (2024) · cites this paper as Sanchez-Gordon and Colomo-Palacios, 2020
The asterisked items in Table 12 wholly or partly matched the findings of the SLR studies.
“The asterisked items wholly or partly matched the findings of the SLR studies (Sanchez-Gordon and Colomo-Palacios, 2020; Rajapakse et al., 2022)”
From Identifying the primary dimensions of DevSecOps: A multi-vocal literature review (2024) · cites this paper as Sanchez-Gordon and Colomo-Palacios, 2020
Cites
DevSecOps: A Multivocal Literature Review
Myrbakken, H., & Colomo-Palacios, R. (2017) · Communications in Computer and Information Science · doi:10.1007/978-3-319-67383-7_2 · Cited by 205 · see citing works
Self-citationImprove software quality through practicing DevOps
Perera, P., Silva, R., & Perera, I. (2017) · 2017 Seventeenth International Conference on Advances in ICT for Emerging Regions (ICTer) · doi:10.1109/icter.2017.8257807 · Cited by 69 · see citing works
An Empirical Study on Culture, Automation, Measurement, and Sharing of DevSecOps
Tomas, N., Li, J., & Huang, H. (2019) · 2019 International Conference on Cyber Security and Protection of Digital Services (Cyber Security) · doi:10.1109/cybersecpods.2019.8884935 · Cited by 66 · see citing works
Carter, K. (2017) · IEEE Software · doi:10.1109/ms.2017.3571578 · Cited by 42 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Challenges and solutions when adopting DevSecOps: A systematic review
Rajapakse, R. N., Zahedi, M., Babar, M. A., & Shen, H. (2022) · Information and Software Technology · doi:10.1016/j.infsof.2021.106700 · Cited by 235 · see citing works
Prates, L., & Pereira, R. (2025) · International Journal of Information Security · doi:10.1007/s10207-024-00914-z · Cited by 49 · see citing works
Identifying the primary dimensions of DevSecOps: A multi-vocal literature review
Zhao, X., Clear, T., & Lal, R. (2024) · Journal of Systems and Software · doi:10.1016/j.jss.2024.112063 · Cited by 40 · see citing works
Revisit security in the era of DevOps: An evidence-based inquiry into DevSecOps industry
Zhou, X., Mao, R., Zhang, H., Dai, Q., Huang, H., Shen, H., Li, J., & Rong, G. (2023) · IET Software · doi:10.1049/sfw2.12132 · Cited by 23 · see citing works
Integrating security controls in DevSecOps: Challenges, solutions, and future research directions
Sinan, M., Shahin, M., & Gondal, I. (2025) · Journal of Software: Evolution and Process · doi:10.1002/smr.70029 · Cited by 13 · see citing works
- Authors
- Sánchez-Gordón, M., & Colomo-Palacios, R.
- Affiliations
- Department of Computer Sciences, Østfold University College, Halden, Norway
- Venue
- Proceedings of the IEEE/ACM 42nd International Conference on Software Engineering Workshops
- Publisher
- ACM
- Published
- 2020-06-27
- Pages
- 266-269
- OpenAlex
- W3088227451
- Cited by
- 58
- References
- 4
- Citations by year
- 2026: 3 · 2025: 21 · 2024: 12 · 2023: 9 · 2022: 6 · 2021: 6 · 2020: 1
- FWCI
- 4.17
- Type
- conference paper
- Language
- en
- Open access
- closed
- Topics
- Physical Sciences › Computer Science › Information Systems › Software Engineering Techniques and Practices
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Keywords
- DevSecOps, security culture, DevOps, human factors, development and operations collaboration, behavior change, risk management
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
