Security Policy Enforcement and Behavioral Threat Detection in DevSecOps Pipelines
DOI:
https://doi.org/10.47672/ejt.2723Keywords:
DevSecOps (JEL: O33, O32), Behavioral Detection (JEL: D83, L86), CI/CD Security (JEL: O33, L86), Jenkins Pipeline (JEL: L86, O32), Runtime Threat Monitoring (JEL: D83, L86), Infrastructure as Code (IaC) (JEL: O33, L86), Falco (JEL: L86, K24)Abstract
Purpose: The evolution of DevSecOps reflects a critical shift from traditional DevOps by embedding security seamlessly throughout the software development lifecycle. This research explores the convergence of security policy enforcement with behavioral threat detection within CI/CD pipelines, focusing on practices and tools. We discuss the limitations of legacy DevOps security approaches, including late-stage vulnerability identification and insufficient runtime protection, and highlight the rising need for behavior-based detection to counter advanced threats and insider breaches.
Materials and Methods: While static analysis and Infrastructure-as-Code scanning are useful strategies for evaluating security policies, a more comprehensive approach examines both compliance-focused tools and behavioral monitoring techniques.
Findings: Compliance as-code frameworks define policies that are automatically checked, yet anomaly detection within system calls, container events, and source code changes offers a dynamic perspective on threats. Previously, integration of these checks into CI/CD platforms like Jenkins and GitLab relied on manual security reviews of alerts and build checkpoints to demonstrate how security checkpoints and alerts were managed before the adoption of AI-driven automation. Through case studies such as the Solar Winds breach and practical pipeline examples, we illustrate how combined policy and behavior-based controls can enhance threat prevention. However, we also identify the significant challenges to solutions, including high false positive rates and limited cross-layer correlation capabilities.
Unique Contribution to Theory, Practice and Policy: Finally, the article looks ahead to the anticipated future of DevSecOps, emphasizing machine learning-driven behavior modelling, unified enforcement engines, and a zero-trust approach centered on identity and behavior analytics.
Downloads
References
R. Manchana, "The DevOps Automation Imperative: Enhancing Software Lifecycle Efficiency and Collaboration," Eur. J. Adv. Eng. Technol., vol. 8, no. 7, pp. 100–112, 2021.
R. Kumar and R. Goyal, "When security meets velocity: Modeling continuous security for cloud applications using DevSecOps," in Innovative Data Communication Technologies and Application: Proc. ICIDCA 2020, Singapore: Springer, 2021.
F. Yashu, M. Saqib, S. Malhotra, D. Mehta, J. Jangid, and S. Dixit, "Thread mitigation in cloud native application development," Webology, vol. 18, no. 6, pp. 10160–10161, 2021. [Online]. Available: https://www.webology.org/abstract.php?id=5338s
W. Tounsi and H. Rais, "A survey on technical threat intelligence in the age of sophisticated cyber-attacks," Comput. Secur. vol. 72, pp. 212–233, 2018.
Y. Smeets, "Improving the adoption of dynamic web security vulnerability scanners," M.S. thesis, Radboud Univ., Nijmegen, Netherlands, 2015.
V. Lenarduzzi et al., "Are sonarqube rules inducing bugs?," in Proc. 27th IEEE Int. Conf. Softw. Anal., Evol. Reeng. (SANER), 2020, pp. 217–227.
F. Hoces de la Guardia, S. Grant, and E. Miguel, "A framework for open policy analysis," Sci. Public Policy, vol. 48, no. 2, pp. 154–163, 2021.
C. A. Cois, J. Yankel, and A. Connell, "Modern DevOps: Optimizing software development through effective system interactions," in Proc. IEEE Int. Prof. Commun. Conf. (IPCC), 2014, pp. 1–5.
D. H. Ryu, H. Kim, and K. Um, "Reducing security vulnerabilities for critical infrastructure," J. Loss Prev. Process Ind., vol. 22, no. 6, pp. 1020–1024, 2009.
J. Hamunen, "Challenges in adopting a Devops approach to software development and operations," M.S. thesis, 2016.
W. J. Heinbockel, E. R. Laderman, and G. J. Serrao, "Supply chain attacks and resiliency mitigations," The MITRE Corporation, 2017, pp. 1–30.
H. S. Galal, Y. B. Mahdy, and M. A. Atiea, "Behavior-based features model for malware detection," J. Comput. Virol. Hacking Tech., vol. 12, pp. 59–67, 2016.
P. Bitra and C. S. Achanta, "Development and Evaluation of an Artefact Model to Support Security Compliance for DevSecOps," 2021.
J. Yang et al., "Towards better utilizing static application security testing," in Proc. 2019 IEEE/ACM 41st Int. Conf. Softw. Eng.: Softw. Eng. Pract. (ICSE-SEIP), 2019, pp. 525–534.
S. Chinamanagonda, "Automating Infrastructure with Infrastructure as Code (IaC)," SSRN, 2019. [Online]. Available: https://ssrn.com/abstract=4986767
S. R. Gopireddy, "Automated Compliance as Code for Multi-Jurisdictional Cloud Deployments," Eur. J. Adv. Eng. Technol., vol. 7, no. 11, pp. 104–108, 2020.
A. Bahaa et al., "Monitoring real time security attacks for IoT systems using DevSecOps: a systematic literature review," Information, vol. 12, no. 4, p. 154, 2021.
P. Cui, DevSecOps of Containerization, Ph.D. dissertation, Auburn Univ., 2020.
B. A. Kuperman and E. H. Spafford, "Audlib: a configurable, high‐fidelity application audit mechanism, Softw” Pract. Exp., vol. 40, no. 11, pp. 989–1005, 2010.
J. Diaz et al., "Self-service cybersecurity monitoring as enabler for DevSecOps," IEEE Access, vol. 7, pp. 100283–100295, 2019.
B. Jammeh, "DevSecOps: Security expertise a key to automated testing in CI/CD pipeline," M.S. thesis, Bournemouth Univ., 2020.
J. Martínez and J. M. Durán, "Software supply chain attacks, a threat to global cybersecurity: SolarWinds’ case study," Int. J. Safety Secur. Eng., vol. 11, no. 5, pp. 537–545, 2021.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2022 Khaja Kamaluddin
This work is licensed under a Creative Commons Attribution 4.0 International License.
Authors retain copyright and grant the journal right of first publication with the work simultaneously licensed under a Creative Commons Attribution (CC-BY) 4.0 License that allows others to share the work with an acknowledgment of the work's authorship and initial publication in this journal.
