This article traces the development of DevOps, explains how its evolution into DevSecOps integrates security early in the software lifecycle, outlines the resulting benefits of faster, cheaper, and safer delivery, and discusses the technical, cultural, and organizational challenges that must be overcome for successful adoption.
This article provides a comprehensive guide to implementing DevSecOps in enterprises, covering fundamental principles, collaboration between security and development teams, integration of security testing, building a secure toolchain, and practical strategies for scaling security within DevOps pipelines.
This article reviews the historical evolution of software testing, explains the concepts of continuous testing within DevOps, outlines testing lifecycles, tools, and models, and looks ahead to emerging trends such as DevSecOps and AI‑driven autonomous testing.
This article outlines the major DevOps trends—including micro‑service architecture, serverless computing, low‑code platforms, Kubernetes evolution, DevSecOps, and AI integration—that are expected to drive faster delivery, higher quality, and greater agility in software development and operations.
The article examines application security challenges for startups, presents statistical attack data, defines what application security entails, outlines common security issues, and compares two main frameworks—Microsoft's Security Development Lifecycle (SDL) and DevSecOps—offering guidance on selecting and implementing a suitable security system.
Zhengzhou Bank’s electronic banking system passed the Level 2 security‑operation assessment of the DevSecOps standard, showcasing how standardization, tool empowerment, and a culture of shared security responsibility can elevate a financial institution’s DevOps practices to an advanced domestic level.
The 2021 GOLF+ IT Governance Forum highlighted Zhongtai Securities’ successful DevSecOps assessment, revealing how the company’s online business system met the second‑level security and risk management standards, and sharing detailed insights on cultural, procedural, and technical practices that drove their advanced security maturity.
GuoXin Securities' GoldSun platform passed the CAICT DevSecOps Level‑2 security and risk management assessment, showcasing how standardization, tool empowerment, and a collaborative DevOps culture can elevate a financial app's security posture to an advanced domestic level.
Zhongyuan Bank’s personal mobile banking project passed the national DevSecOps security and risk management assessment, showcasing how standardized DevOps practices, a dedicated security platform, and cultural, procedural, and technical integration can elevate a financial institution’s development lifecycle to an advanced, industry‑leading level.
The article reports on Zhengzhou Bank's successful DevSecOps assessment at the 2021 GOLF+ IT New Governance Forum, detailing the bank's interview on implementation practices, cultural, process and technical measures, and the broader significance of the national DevOps maturity model for digital governance.
The article examines the U.S. Department of Defense’s DevSecOps initiative, outlining its cloud‑computing challenges, the shift to Kubernetes, Istio and Knative, the creation of a centralized container registry, and the broader lessons for large organizations seeking open‑source, vendor‑neutral cloud‑native transformations.
This article explains how Taobao builds a comprehensive client safety production system—covering development, build, release, and emergency stages—by leveraging Alibaba's mature technical solutions, automated platforms, and data‑driven processes to continuously improve code quality, user experience, and operational reliability.
The US Air Force’s chief security officer, Nicolas Chaillan, stepped down, citing the daunting challenges of implementing DevSecOps and the Air Force’s failure to prioritize IT security, inconsistent policies, and outdated procurement practices that hinder large‑scale projects.
The 2021 China DevOps Landscape Survey, conducted by the Cloud Computing Open Source Industry Alliance with 1,862 valid responses across multiple sectors, reveals that over half of Chinese enterprises have reached comprehensive DevOps maturity, agile development is widespread, DevSecOps adoption exceeds 50%, and IAST tools, especially Xmirror’s LingMai, dominate the security tooling market.
This article outlines JD Daojia's comprehensive application security strategy, including risk analysis, threat modeling, DevSecOps processes, open‑source component scanning, SAST/DAST/IAST testing, manual security assessments, and evaluation of testing effectiveness to mitigate vulnerabilities before production.
This article outlines comprehensive container security best practices across kernel, container image, runtime, pod, network, node, and cluster components, emphasizing how to harden each layer in Kubernetes environments to protect against attacks and maintain robust, scalable deployments.
The Shanghai DevOps Best‑Practice Salon gathered experts from banks and tech firms to share real‑world experiences on DevOps adoption, lean R&D efficiency, agile pipeline construction, and DevSecOps integration, offering actionable lessons for modern IT operations.
This article explains how microservice architecture introduces new security challenges and presents seven best‑practice recommendations—including using an API gateway, strong defense layers, DevSecOps, trusted encryption libraries, service‑level security, multi‑factor authentication, and dependency verification—to help protect microservice‑based applications.
This article explains what DevSecOps is, why integrating security into DevOps is essential in fast‑paced software delivery, outlines its key characteristics and benefits, and provides practical guidance on organizational, process, and tooling practices—including CI/CD pipelines and open‑source security tools.
This article examines the growing security concerns of container images, presents alarming vulnerability statistics, explains why image scanning should be placed before image push in the CI/CD pipeline, and outlines practical best‑practice recommendations such as using lightweight base images, non‑root users, secret management, minimal packages, Dockerfile linting, and avoiding unmaintained images.
Threat modeling is a systematic, cross‑functional practice that identifies design‑level security flaws early, prioritizes mitigations using methods like ASTRIDE, and integrates risk assessment into DevSecOps, despite tool scarcity and process integration challenges, to reduce costs, meet compliance, and improve overall security maturity.
This article explains three practical methods—Sealed Secrets, Helm Secrets, and Kamus—for encrypting Kubernetes secrets, covering their principles, encryption and decryption processes, installation steps, and usage examples with full command‑line and manifest snippets to securely store sensitive data in GitOps workflows.
Microservice architectures increase deployment flexibility but also expand the attack surface, so this article outlines seven essential security best practices—including using an API gateway, layered defenses, DevSecOps, trusted encryption libraries, service-level protection, multi-factor authentication, and dependency vulnerability scanning—to safeguard microservice-based applications.
The article reviews eight major DevOps trends expected in 2021—including infrastructure automation, application release orchestration, evolving toolchains, DevSecOps, APM, cloud‑management platforms, AgileOps, and chaos engineering—while also offering the author’s own forecasts for how DevOps, CI/CD, cloud‑native, AI, and people‑centric practices will shape the industry in the coming years.
This article analyzes the most influential DevOps trends for 2021, including the rise of DevSecOps, AI‑driven AIOps, infrastructure automation, chaos engineering, serverless adoption, hybrid cloud, GitOps, and edge computing, backed by market forecasts and expert predictions.
The article outlines six key DevSecOps best practices—including establishing a security model, enforcing governance policies, automating security tasks, training developers, applying network segmentation, and limiting administrative privileges—to help organizations overcome staffing and collaboration challenges while maintaining consistent security throughout the development and operations lifecycle.
The article outlines eight major 2021 DevOps trends—including the rise of microservices, increased DevSecOps adoption, infrastructure automation, predictive analytics in AIOps, AgileOps, AI/ML‑driven pipelines, Kubernetes integration, and cloud management platforms—highlighting their benefits and future impact on software delivery.
The 2020 DevSecOps Industry Insight Report, released by XuanJing Security and Freebuf Consulting, examines the rapid adoption of DevSecOps in China, highlights survey results from over a thousand IT professionals, outlines a security tool pyramid, and forecasts emerging trends and best practices for agile security.
The article explains how DevSecOps extends DevOps by embedding security controls throughout the software lifecycle, outlines its key components, adoption steps, essential tools, implementation capabilities, and the business benefits of merging security with development and operations.
Huatai Securities' data science development platform passed the DevSecOps security and risk management assessment at level 2, showcasing advanced domestic security practices, and the interview reveals the cultural, procedural, and technical steps that enabled this achievement and future improvement plans.
The 2020 GOLF+ IT New Governance Leadership Forum in Beijing showcased Ping An Bank's Smart Due Diligence System passing the first DevSecOps security and risk management assessment, highlighting the role of the Starlink platform in integrating DevOps practices, enhancing security, and driving industry‑wide IT governance improvements.
The article details how Industrial and Commercial Bank of China’s mobile banking project passed the DevSecOps security and risk‑management assessment, outlining the standards, implementation steps, challenges faced, and the benefits gained for both the organization and the broader financial industry.
The article explains how DevSecOps embeds security controls into CI/CD pipelines, enabling continuous delivery while addressing vulnerabilities, fostering collaboration between development and security teams, and ultimately improving software quality, market reputation, and consumer trust.
This whitepaper provides a detailed, end‑to‑end framework for organizations and technical leaders to understand, implement, and continuously improve security across the cloud‑native lifecycle—covering development, release, deployment, runtime, supply‑chain protection, zero‑trust architecture, and compliance—while emphasizing automation, observability, and cross‑functional collaboration.
The article explains how to structure DevSecOps into multiple security layers—from fast inline scans at code commit to continuous post‑deployment monitoring—so that organizations can maintain strong protection while still delivering changes daily or even hourly.
Cisco and Veeam are bolstering their product portfolios with cloud‑native security acquisitions—Cisco buying Portshift and Veeam acquiring Kasten—to integrate DevSecOps capabilities, support Kubernetes security, and offer unified cloud data management, though financial details remain undisclosed.
This guide explains the concepts of DevOps, SecOps, and DevSecOps, outlines their respective benefits, and helps organizations decide which security‑focused operational model best fits their needs by comparing their focus on integration, automation, and collaboration across development, operations, and security teams.
OPPO’s security team outlines its DevSecOps transformation, detailing how security and privacy activities are embedded across product lifecycles—from requirement reviews and automated CI/CD scans to comprehensive protection layers, cultural initiatives, external collaborations, and continuous improvement to meet global compliance challenges.
Recent misconfigurations in DevOps tools led to a massive leak of source code from dozens of major tech, finance, and manufacturing firms—including Microsoft, Adobe, Nintendo, and Lenovo—prompting security experts to warn of hard‑coded credentials, legal risks, and the urgent need for robust DevSecOps practices.
This article explains what "security as code" means, why shifting security left in the software development lifecycle matters, and provides eleven actionable tips—including understanding Secure SDLC, using SAMM, integrating SAST/DAST, and automating security checks—to help teams embed security directly into their DevOps pipelines.
The article examines how personal grievances have led to tragic events—from a bus driver’s fatal crash to destructive IT incidents—highlighting the need for psychological care, robust security policies, and a DevSecOps mindset to prevent such revenge‑driven catastrophes.
The article details Ctrip's DevSecOps challenges and solutions, covering security team structuring, threat modeling, SCA and SAST integration, IAST/DAST architecture, vulnerability management, and the resulting improvements in automated security testing within a high‑frequency CI/CD environment.
The article explains how DevSecOps extends the Secure Development Lifecycle by embedding security early and throughout CI/CD pipelines, combining threat‑based and vulnerability‑based defenses, automated testing tools such as SAST, DAST, IAST, and SCA, and fostering a collaborative culture of shared responsibility, illustrated by Tencent Cloud’s comprehensive “Golden Pipeline” implementation.
The GitLab 2023 DevSecOps survey of 3,700 software professionals reveals that developers are increasingly responsible for configuring environments, managing infrastructure, and handling security, while organizations report higher deployment frequencies, broader CI/CD tool adoption, and persistent testing and vulnerability‑prioritization challenges.
This article explains how to embed static application security testing (SAST) into a DevSecOps CI/CD pipeline by defining five essential checkpoints—pre‑commit, commit‑time, build‑time, test‑time, and deployment—covering purpose, benefits, handling false positives, result merging, custom rule sets, and automation strategies.
The article outlines five major DevOps trends for 2020—including AI‑driven automation, the rising popularity of Golang, the shift toward Serverless and cloud‑native architectures, and the growing emphasis on DevSecOps—highlighting how these developments will transform software delivery and IT operations worldwide.
This article explains how DevSecOps integrates security into CI/CD pipelines, discusses the shortcomings of traditional waterfall security, outlines benefits of DevOps, and provides practical tool recommendations and a step‑by‑step example using open‑source solutions like Jenkins and git‑secrets.
This comprehensive guide explains why code auditing is essential for modern enterprises, compares enterprise and white‑hat audits, outlines a seven‑step methodology, and reviews both open‑source and commercial SAST tools with practical case studies across PHP, Node.js, Python, and Go.
The article summarizes Chen Weijia’s DevOps International Summit talk on confronting expanding cloud security threats, covering DevSecOps practices, code scanning tools, encryption strategies, permission segmentation, and unified identity management to balance efficiency and security in modern software delivery.
This article summarizes essential DevSecOps concepts from the DevOps Handbook, explaining how to embed security throughout the software lifecycle—from making security a shared responsibility to integrating automated checks in development, testing, deployment pipelines, and change management—while highlighting real‑world examples and practical recommendations.
The DevOps International Summit 2024 in Beijing, the sole China‑based global DevOps conference, brings together over 80 leading experts to showcase end‑to‑end practices—from Lean‑Agile, Continuous Delivery, SRE, and microservices to DevSecOps, AI‑driven tooling, and the new Research and Operations Integration Capability Maturity Model—through industry‑focused tracks, hands‑on training, and real‑world case studies across finance, telecom, retail and more.
This article shares insights from a security‑focused discussion on nurturing security‑oriented developers, balancing leadership and analyst needs in security visualization, and evaluating whether machine‑learning techniques truly add value to internal security data processing.
