Skip to main content
SpringerLink
Log in

From DevOps to DevSecOps is not enough. CyberDevOps: an extreme shifting-left architecture to bring cybersecurity within software security lifecycle pipeline

  • Published:
Software Quality Journal Aims and scope Submit manuscript

Abstract

Software engineering is evolving quickly leading to an urgency to discover more efficient development models. DevOps and its security-oriented extension DevSecOps promised to speed up the development process while ensuring more robust code. However, many third-party libraries and infrastructure vulnerabilities may still pose security flaws. Besides, regulatory compliance and standards go beyond secure software asking for comprehensive security and accurate infrastructure hardening. Thus, we may wonder: is DevSecOps enough? In this paper, we propose CyberDevOps, a novel architecture which integrates cybersecurity within DevSecOps. Specifically, (i) we revise software composition analysis to deal with nondeterministic environments and (ii) we incorporate vulnerability assessment and compliance within a further pipeline step. To assess the effectiveness of CyberDevOps, we conduct an experimental evaluation. Specifically, we attack a web application and we show how CyberDevOps is able to detect hidden defects while a standard DevSecOps pipeline fails. Furthermore, we assess code quality and security by comparing DevOps, DevSecOps, and CyberDevOps by monitoring two Conio code bases over a year. The results show that CyberDevOps helps to fix up to 100% of known bugs and vulnerabilities and improve significantly the code quality.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5
Fig. 6
Fig. 7
Fig. 8
Fig. 9
Fig. 10
Fig. 11
Fig. 12
Fig. 13
Fig. 14
Fig. 15
Fig. 16
Fig. 17

Similar content being viewed by others

Data availability

The datasets generated during the current study are available in the CDO DATASET repository of the author Lombardi (2022).

Notes

  1. After DevSecOps, SecDevOps have been proposed. Although we detail their difference in the next section, for the sake of simplicity, in this paper, we refer to them only as “DevSecOps.”

  2. Falcon Spotlight has a 15-day free trial.

  3. Conio OSINT-VA uses machine learning inferences inspired by the PASCAL Forecaster (Lombardi et al., 2019).

  4. The wrapper for Pillow we implemented can be found on the pypi.org website Fanton.

  5. VirusTotal page of the gs binary under exam: https://www.virustotal.com/gui/file/13a6540ba15c62bac6340d0e6c64e9db766502bca15194621b537c4e4f0d29e6/details

  6. API call to the MITRE DB: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=ghostscript

  7. The available Sonarqube metrics can be found in SonarSource S.A..

References

Download references

Author information

Authors and Affiliations

  1. Conio Inc., San Francisco, CA, 94105, USA

    Federico Lombardi & Alberto Fanton

Authors
  1. Federico Lombardi
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Alberto Fanton
    View author publications

    You can also search for this author in PubMed Google Scholar

Contributions

The contribution of the authors is described as follows: Federico Lombardi — research, concept, methodology, implementation, paper writing. Alberto Fanton — methodology, implementation, evaluation, paper writing support.

Corresponding author

Correspondence to Federico Lombardi.

Ethics declarations

There are no ethical issues with the contribution provided in this work. The code prototype will be publicly released to the official Conio git repository (Conio Inc., 2018). The authors give their consent for publication in this journal.

Conflict of interest

The authors declare no competing interests.

Additional information

Publisher’s Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Appendix: Lightening the DevOps pipeline

Appendix: Lightening the DevOps pipeline

This appendix shows how we speed up the CI/CD process, either with DevOps or CyberDevOps, by detecting and addressing issues before running the pipeline. The goal is to solve problems at development time, in order to lighten the pipeline execution and avoid wasting time and computing resources. As a general practice, the sooner a defect is detected and fixed, the better it is. Furthermore, we practically observed that discovering issues at development time improves the developers’ code quality and security awareness; therefore, the entire CI/CD process can speed up.

Usually, pipelines run in a dedicated environment shared by developers. In Conio, we juxtapose a shorter pipeline also in developer local environments.

Specifically, each local environment is set to execute preliminary static checks and dynamic tests through Git Hooks (Hudson, 2012). Specifically, we run the following controls on pre-commit and pre-push hooks:

  • Pre-commit*: this hook triggers the execution of SCA, SAST, and unit test steps. Furthermore, we include linters and autoformatters that are not part of a common CI/CD pipeline, but they are good for the health of the code base in terms of both security and cleanness. This step is relatively fast to run and can detect preliminary security, quality, and functional problems;

  • Pre-push: this hook triggers all the steps of pre-commit adding some more computationally expensive steps such as the integration test step. We can afford to use some more time since push are less frequent of commit.

Following, an example of the preliminary tests set on the local environment:

  • id: SCA - Pipenv check stages: [commit, push] language: system entry: pipenv check types: [python]

  • id: SAST - bandit stages: [commit, push] language: system entry: pipenv run bandit types: [python]

  • id: Unit tests stages: [commit, push] language: system entry: pipenv run pytest unit

  • id: Integration tests stages: [push] language: system entry: pipenv run pytest integration

Rights and permissions

Springer Nature or its licensor (e.g. a society or other partner) holds exclusive rights to this article under a publishing agreement with the author(s) or other rightsholder(s); author self-archiving of the accepted manuscript version of this article is solely governed by the terms of such publishing agreement and applicable law.

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Lombardi, F., Fanton, A. From DevOps to DevSecOps is not enough. CyberDevOps: an extreme shifting-left architecture to bring cybersecurity within software security lifecycle pipeline. Software Qual J 31, 619–654 (2023). https://doi.org/10.1007/s11219-023-09619-3

Download citation

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s11219-023-09619-3

Keywords

Search

Navigation