DevSecOps Lifecycle
1-plan-phase-devsecops

Plan Phase

The Planning phase supports software development planning, which includes configuration management planning, change management planning, project management planning, system design, software design, test planning, and security planning.

2-develop-phase-devsecops

Develop Phase

The Development phase supports the development activities that convert requirements into source code. The source code includes application code, test scripts, Infrastructure as Code, Security as Code, DevSecOps workflow scripts, etc.

3-build-phase-devsecops

Build Phase

The Build Phase performs the tasks of building and packaging applications, services, and microservices into artifacts. It also includes generating application documentation, copying files like libraries or icons to the appropriate locations, and creating a distributable file such as a zip file.

4-test-phase-devsecops

Test Phase

The Testing Phase involves continuous testing across the software development lifecycle. Test activities may include, but are not limited to, unit test, functional test, integration test, system test, regression test, acceptance test, performance test, and variety of security tests. All tests start with test planning and test development, which includes detailed test procedures, test scenarios, test scripts, and test data.

5-release-deliver-phase-devsecops

Release & Deliver Phase

In the release and deliver phase, the software artifacts are digitally signed to verify that they have passed build, all tests, and security scans. They are then delivered to the artifact repository. The content of the artifacts depends on the application. It may include, but is not limited to, container images, VM images, binary executables (such as jar, war, and ear files), test results, security scan results, and Infrastructure as Code deployment scripts.

6-deploy-phase-devsecops

Deploy Phase

In the Deployment Phase, the two major deployment options include virtual machines and software containers.

In a Virtual Machine Deployment, the virtualization manager manages the virtual compute, storage, and network resources.

In a Container Deployment, the container manages the configuration tasks, such as instantiation, scaling, monitoring, and rolling updates.

7-operate-phase-devsecops

Operate Phase

The Operation phase involves system scaling, load balancing, and backup. Load balancing monitors resource consumption and demand, and then distributes the workloads across the system resources. Scaling helps dynamic resource allocation based on demand.
Application deployment must have proper load balancing and scaling policies configured. During runtime, the management layer will continuously monitor the resources.

8-monitor-phase-devsecops

Monitor Phase

The Monitoring Phase involves the collection and assessment of key information about the use of the application to discover trends and identify problem areas. Monitoring spans the underlying hardware resources, network transport, applications / microservices, containers, interfaces, normal and anomalous endpoint behavior, and security event log analysis. It continuously inventories all system components, monitors the performance and security of all components, and logs application and system events.