DevSecOps
What this guide covers
AI Covers how to enforce at the pipeline level that code produced by coding tools does not violate your organization's open source policies. This is a practical guide to building a company-wide DevSecOps system, including SBOM creation, vulnerability management, license governance, and continuous monitoring. It also explains how to link with the ISO/IEC 5230 (license compliance) and ISO/IEC 18974 (security assurance) standard requirements.
AI Relationship to coding guide
The Quick CI/CD of the AI Coding Guide aims to help developers create a basic gate in 30 minutes. This DevSecOps guide covers enterprise policy design, multi-repository management, and audit response. The two guides can be used independently, but we recommend reading them in the following order: AI Coding — 4-Step Strategy → Quick CI/CD → DevSecOps.
Structure of this menu
| Page | Contents covered | Recommended Readers |
|---|---|---|
| Introduction Strategy | Maturity model/step-by-step roadmap | Team Lead/Architect |
| SAST | Static analysis — CodeQL·Semgrep | Developer·DevOps |
| SCA | Dependency Analysis — syft·grype·SBOM | DevOps·Security Team |
| Secret Detection | Prevent key/token leakage — Gitleaks | Developer·DevOps |
| Container Security | Image vulnerability — Trivy | DevOps·Security Team |
| IaC Security | Infrastructure Code Inspection — Checkov | DevOps·SRE |
| DAST | Dynamic Analysis — OWASP ZAP·Nuclei | Security Team·QA |
| Pipeline Design | Full Integrated Design·GitHub Actions | DevOps Engineer |
| Monitoring·Automatic Correction | Continuous scanning and automatic PR after deployment | DevOps·Security Team |
| ISO standard linkage | ISO/IEC 18974 Requirements Mapping | Compliance Manager |
Where to start?
- DevSecOps is the first → From Introduction Strategy
- I want to catch code quality and security vulnerabilities at the code stage. → From SAST
- I am concerned about open source dependency vulnerabilities. → From SCA
- API Key/Token has been exposed to code → From Secret Detection
- Running a container environment → From Container Security
- ISO/IEC 18974 Preparing for certification → From ISO standard linkage (However, we recommend reading the SCA page first)