In strong contrast to Waterfall, DevSecOps is a modern approach that integrates
security throughout the entire SDLC.
Outlining security controls for software development by following the DevSecOps
approach works well because security is integrated into every step of
DevSecOps.
Figure 1. The DevSecOps approach with security integrated in every step
Figure 1 shows how the steps relate. Each step is outlined below and relates the
step to the relevant security controls, scrum roles, scrum events and which
controls could be added to automated CI/CD pipelines.
Controls from compliancy standards like ISO 27002 are not added but with the
help of AI, a simple basic set can be generated. For making the list more
actionable AI can also assist with tool recommendations.
Not all security controls are equally critical. Their implementation must always
be guided by risk assessments. In this post, controls are categorized and
prioritized based on relative importance, as outlined below.
Importance
Description
Criteria
Essential
Foundational controls necessary for baseline security and operational integrity.
Ensures only verified, approved code gets built; prevents unauthorized or malicious changes.
Important
Support Coordinated Vulnerability Disclosure (CVD)
Enables secure reporting and response to vulnerabilities from external researchers.
Optional
Support bug bounty programs
Adds an external layer of security validation, but requires mature vulnerability management.
In the CI/CD pipeline
Importance
Control
Rationale
Essential
Scan dependencies for vulnerabilities
Open source components are common attack vectors; automated scanning helps mitigate this risk.
Essential
Detect hardcoded secrets (double check)
Also prevented during coding. Prevents exposure of sensitive credentials before they reach production.
Important
Enforce policy-as-code gates
Automates enforcement of security/compliance rules early in the pipeline.
Important
Automate dependency updates
Reduces risk from known vulnerabilities by keeping components current.
Optional
Integrate continuous penetration testing
Valuable for mature orgs; provides deeper testing, but can be complex and resource-intensive.
🔧 4 - Test
Product owner responsibilities
Importance
Control
Rationale
Essential
Ensure exploratory security testing is performed
Uncovers unanticipated risks; complements automated and structured testing methods.
Important
Schedule manual penetration tests periodically
Provides deep dive validation before major releases; supports compliance and proactive mitigation.
In the CI/CD pipeline
Importance
Control
Rationale
Essential
DAST, IAST and API Security Testing
Finds real world vulnerabilities in running apps and APIs.
Essential
Compliance and Privacy Validation
Ensures legal and regulatory alignment before release.
Important
Regression and Fuzz Testing
Detects edge case vulnerabilities from new changes or malformed input.
Optional
Chaos Security Testing
Validates system resilience in unpredictable scenarios; valuable in mature environments.
⚙️ 5 - Release
Product owner responsibilities
Importance
Control
Rationale
Essential
Implement secrets lifecycle management
Ensures secure handling of secrets throughout their lifecycle, reducing exposure risk.
Important
Validate rollback strategies
Enables recovery from faulty releases, minimizing downtime and damage.
Optional
Audit release approval workflows
Enhances transparency and traceability, though not mission critical for every release cycle.
During scrum review event
Importance
Control
Rationale
Essential
Conduct security reviews and obtain risk sign-off
Confirms that security risks are identified, mitigated or formally accepted before release.
Important
Document and communicate key security decisions
Builds an audit trail and supports team awareness and future decision making.
In the CI/CD pipeline
Importance
Control
Rationale
Essential
Enforce artifact signing and integrity verification
Protects against tampering by verifying that artifacts are legitimate and unaltered.
Important
Apply consistent version tagging policies
Enables traceability and structured rollback in case of release issues.
Optional
Generate release notes with security insights (CVEs, CWEs, OWASP Top 10)
Promotes awareness and improves communication, but not a direct control.
⚙️ 6 - Deploy
Product owner responsibilities
Importance
Control
Rationale
Essential
Ensure pre-deployment image scanning
Identifies known vulnerabilities before images are deployed, preventing insecure releases.
In the CI/CD pipeline
Importance
Control
Rationale
Essential
Analyze Infrastructure as Code (IaC) for misconfigurations
Prevents insecure infrastructure deployments from reaching production.
Important
Securely inject secrets at runtime
Protects sensitive data by avoiding exposure during build or deployment.
Optional
Implement Zero Trust deployment practices
Improves security posture; best suited for mature or highly regulated environments.
⚙️ 7 - Operate
Product owner responsibilities
Importance
Control
Rationale
Essential
Ensure incident response outcomes and monitoring results are incorporated into the backlog
Supports continuous improvement and proactive risk mitigation through feedback loops
Important
Ensure environment and network segmentation is preserved
Limits blast radius and helps contain breaches in case of an incident
Important
Ensure containers and host operating systems are appropriately hardened
Reduces the attack surface by minimizing exploitable vulnerabilities
Optional
Advocate for hardened runtime environments
Typically managed by platform or security teams; less central to the product owner’s core role
During scrum retrospective event
Importance
Control
Rationale
Essential
Reflect on operational incidents and concerns
Encourages learning from failures and builds a culture of continuous improvement in security operations.
In the CI/CD pipeline
Importance
Control
Rationale
Essential
Enforce least privilege IAM
Minimizes access-related risk by restricting privileges to the minimum necessary.
Essential
Auto patch known vulnerabilities
Reduces exposure to known exploits through timely updates.
Important
Implement secure and tamper-resistant audit logging
Supports investigations, compliance and operational integrity.
Optional
Enable Runtime Application Self-Protection (RASP)
Adds real time protection; best suited once foundational defenses are in place.
⚙️ 8 - Monitor
Product owner responsibilities
Importance
Control
Rationale
Essential
Ensure SIEM/SOAR integration and audit log monitoring
Enables centralized visibility, alerting and supports effective threat detection and response.
Important
Leverage threat intelligence and anomaly detection
Enhances proactive detection capabilities by identifying unusual or known malicious behavior.
Optional
Use ML or behavioral analytics
Useful for advanced detection; typically leveraged in mature security programs.
During scrum retrospective event
Importance
Control
Rationale
Essential
Track vulnerability resolution metrics
Drives accountability and improvement in remediation speed and efficiency.
Important
Review incident response performance
Helps refine playbooks and processes based on recent events.
In the CI/CD pipeline
Importance
Control
Rationale
Essential
Run continuous monitoring within the CI/CD pipeline
Provides real-time visibility and early detection of threats during the software lifecycle.
Important
Detect and alert on IDS/IPS events
Strengthens defense with actionable, network level threat detection.
Optional
Automate incident response with playbooks and ticketing
Improves response time and consistency, but requires mature alerting and monitoring infrastructure.
Detect versus Protect
The number of cybersecurity tools and acronyms continues to grow steadily. For
SDLC controls it is important to understand the distinction between:
detect, identifying and alerting on threats and suspicious activities and;
protect, actively safeguard systems and data by preventing and blocking threats.
The table below explains the roles and capabilities of IDS/IPS and SIEM/SOAR controls:
Control
Role
Detect
Protect
IDS
Monitor network or system traffic to detect suspicious activities
✅
❌
IPS
Detect and actively block threats
✅
✅
SIEM
Collect, analyze and correlate security events
✅
❌
SOAR
Automate and orchestrate response actions
✅
✅
Risk analysis
This post outlines many security controls whose full implementation is only
justified in very high risk or mission critical software projects.
In practice, selecting which controls to implement is guided by a cost benefit
analysis. Evaluating the security improvements that each control offers to the
SDLC compared to the resources required to implement them.
These benefits are best understood through thorough risk analysis. This helps
identify which threats are most relevant and which controls provide the greatest
value in mitigating them.
By embedding security into every phase of the Software Development Lifecycle (SDLC),
the DevSecOps approach ensures that security is no longer an afterthought, but a
continuous and integrated discipline. From planning and coding to deployment and
monitoring, each step introduces targeted controls that reduce risk and increase
resilience.
Rather than applying a one size fits all checklist, these controls should be
tailored through risk analysis and cost benefit evaluations, ensuring that
resources are focused where they matter most. Automation, tool integration and
security aware roles within agile teams make it possible to maintain both speed
and security.
In an environment where threats evolve rapidly, DevSecOps provides a structured
yet flexible foundation for building secure software by design, by default and
by deployment.
