Where to Integrate Security Practices on DevOps Platform
Abstract
“Software security” often evokes negative feelings amongst software developers because this term is associated with additional programming effort, uncertainty and road blocker activity on rapid development and release cycles. The Secure DevOps movement attempts to combat the toxic environment surrounding software security by shifting the paradigm from following rules and guidelines to creatively determining solutions for tough security problems (Taschner, 2015). Secure software should be focused on a proactive approach that limits the attack surface and produces reliable software. Secure DevOps developers want their software to bend but not break, which means the software absorbs attacks and continues to function. The burgeoning concepts of DevOps include a number of concepts that can be applied to increase the security of developed applications. Applying these and other DevOps principles can have a big impact on creating an environment that is resilient and secure. Specifically, this paper clearly explains how to address security concerns in the early stages of the development lifecycle and leverage that knowledge throughout the SDLC.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Lack of secure coding standards is a DevOps security challenge.
“We reviewed those studies briefly and extracted all the challenging factors including lack of secure coding standards [2], [23], [80], [81], using unsuitable performance metrics for security evaluation [2], [69], [78], [79] and lack of integrated testing tools to secure DevOps [14], [52], [53], [71].”
From Prioritization based taxonomy of DevOps security challenges using PROMETHEE (2020) · cites this paper as [23]
Cites
The Capabilities of Market-Driven Organizations
Day, G. S. (1994) · Journal of Marketing · doi:10.1177/002224299405800404 · Cited by 6,534 · see citing works
The Capabilities of Market-Driven Organizations
Day, G. S. (1994) · Journal of Marketing · doi:10.2307/1251915 · Cited by 2,117 · see citing works
Continuous Delivery: Reliable Software Releases Through Build, Test, and Deployment Automation
Humble, J., & Farley, D. R. (2010) · Cited by 911 · see citing works
Continuous Integration: Improving Software Quality and Reducing Risk
Duvall, P., Matyas, S., & Glover, A. (2007) · Cited by 515 · see citing works
Arkin, B., Stender, S., & McGraw, G. E. (2005) · IEEE Security & Privacy · doi:10.1109/msp.2005.23 · Cited by 265 · see citing works
Development and Deployment at Facebook
Feitelson, D. G., Frachtenberg, E., & Beck, K. L. (2013) · IEEE Internet Computing · doi:10.1109/mic.2013.25 · Cited by 243 · see citing works
Duvall, P., Matyas, S. M., & Glover, A. (2007) · Addison-Wesley Professional eBooks · Cited by 147 · see citing works
Houmb, S. H., Islam, S., Knauss, E., et al. (2009) · Requirements Engineering · doi:10.1007/s00766-009-0093-9 · Cited by 136 · see citing works
Modern DevOps: Optimizing software development through effective system interactions
Cois, C. A., Yankel, J., & Connell, A. (2014) · IEEE International Professional Communication Conference (ProComm) · doi:10.1109/ipcc.2014.7020388 · Cited by 74 · see citing works
Automated Software Testing Using Model-Checking
Sehgal, S. (2019) · Journal of Emerging Technologies and Innovative Research · Cited by 57 · see citing works
Towards agile security in web applications
Kongsli, V. (2006) · doi:10.1145/1176617.1176727 · Cited by 45 · see citing works
Liu, Y., Li, C., & Liu, W. (2014) · International Journal of u- and e- Service Science and Technology · doi:10.14257/ijunesst.2014.7.2.04 · Cited by 18 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Prioritization based taxonomy of DevOps security challenges using PROMETHEE
Rafi, S., Yu, W., Akbar, M. A., Alsanad, A., & Gumaei, A. (2020) · IEEE Access · doi:10.1109/access.2020.2998819 · Cited by 50 · see citing works
Enterprise-Driven Open Source Software: A Case Study on Security Automation
Angermeir, F., Voggenreiter, M., Moyon, F., & Mendez, D. (2021) · 2021 IEEE/ACM 43rd International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1109/icse-seip52600.2021.00037 · Cited by 30 · see citing works
- Authors
- Yasar, H., & Kontostathis, K.
- Affiliations
- Software Engineering Institute, CMU, Pittsburgh, PA, USA
- Software Engineering Institute (US)
- Venue
- International Journal of Secure Software Engineering
- Publisher
- IGI Global Scientific Publishing
- Published
- 2016-10
- Volume
- 7
- Issue
- 4
- Pages
- 39-50
- ISSN
- 1947-3036 (ISSN-L)
- 1947-3044
- OpenAlex
- W2581988150
- Cited by
- 25
- References
- 12
- Citations by year
- 2026: 1 · 2025: 2 · 2024: 1 · 2023: 1 · 2022: 4 · 2021: 4 · 2020: 6 · 2019: 1 · 2018: 4 · 2017: 1
- FWCI
- 4.46
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- International Journal of Secure Software Engineering (publishedVersion)
- RePEc: Research Papers in Economics (submittedVersion)
- Funders
- U.S. Department of Defense
- Carnegie Mellon University
- Topics
- Physical Sciences › Computer Science › Information Systems › Software Engineering Techniques and Practices
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Keywords
- software security, DevOps, security integration, software development lifecycle, attack surface reduction, security by design, security practices
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
