Glossary

DevSecOps

Building security practices and automated checks into DevOps delivery, so security work happens in the same pipelines and teams that build and run the software rather than as a gate at the end. NIST SP 800-204D covers software supply chain security in DevSecOps CI/CD pipelines.

Defined in: NIST SP 800-204D, Software Supply Chain Security in DevSecOps CI/CD Pipelines

Covered in

Guide

Place each security control in the pipeline and decide what it blocks

Put secrets scanning, SAST, SCA, IaC and image scanning, DAST, fuzzing, attestation and admission control where each sees the right input, block only on findings a developer can act on, and deploy only images the pipeline has attested.

Practice: Local project: Repair a security pipeline for GitHub Actions and GitLab CI