DevOps / SRE
Overview
DevOps/SRE are the artisans of automation and infrastructure.
They ensure that security is embedded in pipelines and at runtime, not bolted on afterwards. They build security highways that verify, validate and block insecure code.
Key Responsibilities
- Integrate security verification into pipelines (Ch. 07)
- Automate SBOM generation and dependency scans (Ch. 05)
- Ensure secure execution of IaC and containers (Ch. 08-09)
- Maintain continuous monitoring in production (Ch. 12)
Organisational Context
They respond directly to the requirements of DORA (digital operational resilience) and NIS2 (appropriate technical measures). They are the bridge between development and secure operations.
Regulatory Framework
Essential for:
- DORA: Digital operational resilience
- NIS2: Implementation of appropriate technical measures
Activities by Chapter
Ch. 01 - Application Classification
Classify technical artefacts (Dockerfile, pipeline, IaC, images) with the same criticality as the application, ensuring that security controls follow the integrity of the delivery.
User Stories:
- Classification of technical artefacts - Security traceability across artefacts
Ch. 02 - Security Requirements
Ensure that the CI/CD pipeline automatically verifies security requirements (SAST, SCA, DAST, SBOM, signatures), blocking non-compliant merges and releases.
User Stories:
- US-10: Automatic gates in CI/CD - Automatic verification of requirements
- US-11: SBOM generation and signing - SBOM and signatures in the pipeline
Ch. 03 - Threat Modelling
Update the threat model on significant changes and integrate validation into the pipeline for automatic review.
User Stories:
- US-03: Model update after a change - Keep the model up to date
- US-05: Integration with CI/CD - Automatic validation
- US-07: Automation and reuse of models - Tools for consistency
Ch. 04 - Secure Architecture
Validate architecture controls in the pipeline (topology, IaC, policies). Implement environment segregation (dev, QA, stage, prod) with logical and physical isolation.
User Stories:
- US-05: Architecture validation in CI/CD - Ensure automatic compliance
- US-13: Environment segregation - Isolation with least-privilege permissions
Ch. 05 - Dependencies and SBOM
Automate SBOM generation and management, integrating dependency vulnerability analysis into the pipeline.
User Stories:
- US-02: SBOM on every build - Complete traceability of components
- US-06: Internal repositories as the single source - Provenance and consistency
- US-08: Update automation with impact assessment - Automated secure PRs
- US-10: Inventory and SBOM per Build - Signed SBOM per artefact
- US-11: Vulnerability alerts - Proactive notifications
Ch. 06 - Secure Development
Integrate linters and SAST into the pipeline to detect failures early and generate continuous evidence of compliance.
User Stories:
- US-04: Automation in CI/CD - Automatic linters and SAST
- US-09: Pre-release security gate - Consolidation of evidence
- US-12: Mandatory local validation - Pre-commit hooks
Ch. 07 - Secure CI/CD
Design pipelines with scanners, gates and release signatures, ensuring that only validated artefacts advance from one phase to the next.
User Stories:
- US-02: Secure pipeline design - Versioned and auditable pipelines
- US-04: Secrets management - OIDC with short TTL
- US-05: Runner isolation - Ephemeral, segregated runners
- US-06: Signing and provenance - Trust in artefacts
- US-13: Base image integrity validation - Supply chain protection
Ch. 08 - IaC
Apply policy enforcement in IaC with policy-as-code, validating compliance before deployment.
User Stories:
- US-01: Remote backend, locking and traceability - Secure state without drift
- US-02: Environment segregation, tagging and least-privilege permissions - Isolation and traceability
- US-05: Traceability, versioning and naming - Complete history with rollback
- US-06: Formal plan review before apply - Impact validation
- US-09: Signing and Provenance of IaC artefacts - End-to-end integrity
- US-10: Secrets and identity management for IaC - OIDC with least-privilege permissions
- US-12: Rollback and destroy safeguard - Restore points
Ch. 09 - Containers and Images
Run vulnerability scanners on every build, validate executions against formal policies (OPA/Kyverno), generate SBOM automatically, enforce a registry allowlist and SHA256 digests, prohibit static credentials, apply minimal RBAC and NetworkPolicy, maintain the Golden Images catalogue.
User Stories:
- US-02: Automatic vulnerability validation of images - SCA with automatic blocking
- US-04: Formal runtime security policies - OPA/Kyverno for validation
- US-06: SBOM Generation and Traceability - Versioned SBOM per build
- US-07: Registry Governance - Allowlist + SHA256 digest
- US-08: Secrets Management with OIDC - Ephemeral identities
- US-09: Minimal RBAC and ServiceAccounts - Isolation per workload
- US-10: Network Segmentation - NetworkPolicy per namespace
- US-11: Golden Base Images - Standardised catalogue with SLA
- US-12: Secure Builders and Runners - Protection of the CI/CD pipeline
Ch. 10 - Security Testing
Integrate automatic gates into the pipeline (SAST/SCA/IAST) with thresholds per Lx. Centralise findings on a unified platform and automate delivery to the teams.
User Stories:
- US-04: Security gates in CI/CD - Thresholds per criticality level
- US-10: Centralised Findings Management - Unified platform
- US-11: Automatic Findings Feedback - Contextualised delivery
Ch. 11 - Secure Deployment
Deploy only signed, versioned artefacts. Implement fast rollback tested periodically, enable post-deploy monitoring, implement feature flags with metadata, ensure that secrets are never embedded, implement progressive deployment (canary/blue-green).
User Stories:
- US-02: Deploy only signed artefacts - Cryptographic integrity
- US-05: Fast, tested rollback - Documented and validated
- US-06: Post-deploy monitoring - Anomaly detection
- US-08: Feature Flags with Governance - Metadata and expiry
- US-09: Secure Secrets Management - Zero secrets in artefacts
- US-10: Progressive Deployment - Canary/Blue-Green
- US-11: Documented rollback per type - Tested rollback procedures
Ch. 12 - Monitoring and Operations
Configure production environments with continuous monitoring and coordinate alert response. Ensure log security and integrity (WORM retention), integrate with the SIEM.
User Stories:
- US-06: Monitoring domains - Coverage proportionate to risk
- US-07: Log security and integrity - WORM retention + restricted access
- US-08: SIEM integration - Parsing and normalisation
Chapter References
For full context and framing:
- Ch. 01 - Application Classification
- Ch. 02 - Security Requirements
- Ch. 03 - Threat Modelling
- Ch. 04 - Secure Architecture
- Ch. 05 - Dependencies and SBOM
- Ch. 06 - Secure Development
- Ch. 07 - Secure CI/CD
- Ch. 08 - IaC and Infrastructure
- Ch. 09 - Containers and Images
- Ch. 10 - Security Testing
- Ch. 11 - Secure Deployment
- Ch. 12 - Monitoring and Operations