Up until now, I haven't really said much about security.
Have I?
I mean, we've built an integrated code into our current code base,
and then we deliver code to some environment,
but we don't really talk about security.
If we really broke down a full-fledged DevOps pipeline,
you might see something like,
upon a GitHub pull request,
it will deploy the build environment. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it will deploy the build environment.
So we'll put build right here,
where it then clones the repository,
basically copies the code to this local environment,
build the code,
deliver the code
to a Dev server. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to a Dev server.
Then this repeats two more times for the test environment,
and then the prod environment.
At no point did we actually come through and check for security, did we?
That's because security in the DevOps pipeline for a long time
was an afterthought.
We didn't really look at security until maybe it was deployed to the Dev WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We didn't really look at security until maybe it was deployed to the Dev
environment or in particular the test environment.
The test environment is when we start allowing other users to jump in, right?
Of course, the developers are going to be in the test environment
clicking around and making sure things work.
But we'll also do things like user acceptance testing
or smoke testing,
or even this might be when the security team jumps into the application
and starts looking for security flaws. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and starts looking for security flaws.
But this still to get to this point,
it still got through this whole pipeline through the Dev environment
and then most of the pipeline again for the test environment.
And before we actually started looking at security at this point,
that's a problem.
Security being an afterthought is a problem.
So what do we do about this?
The idea with DevSecOps is that during these stages, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The idea with DevSecOps is that during these stages,
particularly the build stage,
we run tests to make sure the application isn't going to fail security.
We also run regular tests at this time too,
like unit tests to make sure the application doesn't break functionality.
We want to make sure that all of the functions of our application
continue to work the way we expect it to.
So at some point after the code is built, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So at some point after the code is built,
but before the code is delivered,
we want to run unit tests or integration test,
anything that makes sure we can integrate into our current environment
and then run security tests.
Only after these items passed will then be moved on to the next stage. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Only after these items passed will then be moved on to the next stage.
And yes, yes, this environment,
we will define the tests in a format that looks like this.
This is YAML, by the way.
It'll define all of our tests in a format that looks like this.
And if the tests fail, that stops the pipeline from running,
and it notifies the pipeline owners that CI has failed,
and here are the reasons why.
So they'll be able to see if it was a unit test that failed WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So they'll be able to see if it was a unit test that failed
and specifically what in the unit test that failed,
or if a security test fails and specifically what in the security test that
fails.
So this is now where DevSecOps comes into play.
We can now confirm that we're not running into major security flaws,
like leaking secrets or any type of injection attacks or scripting attacks,
anything that we can test for.
We can now build into the pipeline in an automated fashion WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We can now build into the pipeline in an automated fashion
and fail the build, fail the pipeline in the event that these tests fail.
That gives our developers a chance to fix any problems
before it ever makes its way into a production environment,
and that keeps our application online and running and generating revenue.
So in the next video, really the next couple videos,
we'll take a moment to pause and actually look at what the security portion WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we'll take a moment to pause and actually look at what the security portion
of the DevSecOps pipeline is going to look like.