⚙️ DevSecOps

1Software Catalog — central registry of all services, APIs, owners, and dependencies.

2Golden Path Templates — pre-built scaffolding with CI/CD, security scanning, monitoring, and compliance baked in.

3Self-Service Actions — one-click operations for infra provisioning behind policy guardrails.

4Developer Portal & Scorecards — unified dashboard with DORA metrics, security posture, and production readiness.

5Security & Compliance Layer — RBAC, policy-as-code (OPA/Kyverno), secrets injection, and audit trails. Why organizations adopt IDPs: Reduce cognitive load on developers (they focus on business logic, not infra). Eliminate DevOps ticket bottlenecks (self-service vs 3-day wait). Enforce security-by-default (every service gets scanning, encryption, RBAC). Improve DORA metrics — deployment frequency goes from weekly to multiple per day. Standardize operations — golden paths prevent configuration drift and tribal knowledge. Key tools: Backstage (Spotify, open-source), Port.io (SaaS), Cortex (scorecards), Humanitec (dynamic provisioning), OpsLevel (service maturity). The platform engineering team is NOT another ops team — they build products for developers, treating developers as their customers.

• Every template auto-includes SAST pipeline stages, secrets management integration (Vault/AWS Secrets Manager), security headers, dependency scanning (SCA), and container image scanning
• Developers don't opt-in to security — it's impossible to opt-out

• When a developer provisions infrastructure through the portal, policy-as-code (OPA/Kyverno) validates EVERY action: no public S3 buckets, no root containers, encryption-at-rest enabled, network policies enforced
• Violations are blocked before provisioning, not detected after

• Automated scorecards grade every service on security metrics: SAST/DAST scan freshness, dependency vulnerability count, secrets rotation status, TLS certificate expiry, production readiness checklist
• Services below threshold are flagged and tracked

4SOFTWARE CATALOG + SECURITY POSTURE: The catalog shows real-time security posture per service — last scan results, open CVEs, compliance status, ownership (who to page for incidents). This enables security teams to see the entire attack surface in one place.

• Every self-service action is logged — who provisioned what, when, with what parameters
• Full audit trail for SOC 2, ISO 27001, PCI-DSS compliance

• Without IDP, security teams chase individual teams to adopt scanning
• With IDP, scanning is embedded in the platform — 100% coverage by default
• The result: security team shifts from enforcement ('you must add scanning') to enablement ('scanning is already there')

• ADO has granular resource-level permissions — service connections, environments, and variable groups each require explicit grants
• GitHub uses repository-level permissions with OIDC for cloud auth

• ADO has native 'Approvals and Checks' on environments — manual approval, business hours, template validation, branch control
• GitHub uses environment protection rules and required reviewers

• ADO integrates natively with Azure Key Vault via variable groups — secrets injected at runtime, never in YAML
• GitHub uses repository/org secrets with OIDC

• GitHub has CodeQL, Dependabot, secret scanning built-in
• ADO uses the Microsoft Security DevOps (MSDo) extension which bundles open-source tools (Bandit, Trivy, Terrascan)

• ADO is strongest in Microsoft-heavy enterprises (Entra ID SSO, Azure subscriptions, .NET)
• GitHub is preferred for open-source and cloud-native
• GitLab stands out with the most comprehensive built-in security scanning (SAST, DAST, SCA, secret detection all native)

• ADO provides audit logs, compliance reports, and integrates with Azure Policy for governance
• GitHub audit log + advanced security features require GitHub Enterprise

1Start with secrets scanning in pre-commit hooks (quick win).

2Add SAST and SCA to CI/CD with initially non-blocking alerts.

3Introduce IaC scanning for Terraform/K8s.

4Add container image scanning in registry.

5Implement DAST in staging pipelines.

6Graduate to blocking builds on critical/high findings.

7Establish security champion program.

8Measure with metrics: vulnerability escape rate, MTTR, developer adoption rate, pipeline failure false positive rate. Cultural change is harder than tooling.

• SAST on every PR (Veracode Pipeline Scan ~90 sec, Semgrep), SCA on dependency changes, DAST against staging
• Break builds on Critical/High findings

• Pre-commit — secret scanning (truffleHog, GitLeaks)
• PR/Build — SAST, SCA, license checks, container scanning (Trivy)
• Staging — DAST (Burp Enterprise, ZAP), API security
• Pre-Prod — full Veracode Policy Scan
• Post-Deploy — RASP, WAF validation

• Jenkins (Veracode Plugin), GitHub Actions (CodeQL, Snyk), GitLab (built-in templates), Azure DevOps
• Aggregate in DefectDojo/ThreadFix

Fast PR scans (<5 min), annotate PR comments, auto-create Jira tickets, tune rules to reduce alert fatigue.

Policy-as-code (OPA/Rego), compliance tracking per release, audit trails for SOC 2/ISO 27001, exception workflows with expiration dates.

1WHY IaC FOR SECURITY TOOLS: Manual deployment leads to configuration drift, undocumented changes, and inconsistent coverage across environments. IaC treats security infrastructure the same as application infrastructure — declarative, version-controlled, peer-reviewed, and automatically deployed.

• WAF — Terraform modules for AWS WAF, Azure Front Door, Cloudflare WAF with rule sets defined as code
• SIEM — deploy Splunk forwarders, Elastic Security agents, or Sentinel connectors via Terraform/Ansible
• EDR — deploy CrowdStrike Falcon or Microsoft Defender via Ansible playbooks
• Vulnerability Scanners — Nessus agents, Qualys Cloud Agents via IaC
• CSPM — deploy Prisma Cloud, AWS SecurityHub, or Wiz connectors via Terraform
• Secrets Management — deploy HashiCorp Vault clusters or AWS Secrets Manager via Terraform

• Write reusable modules for each security tool
• Use Terraform workspaces or Terragrunt to deploy identical security stacks across dev, staging, and production
• Store state in remote backends with encryption

• Use OPA with Rego policies to enforce security standards on all IaC
• Use Checkov, tfsec, or Bridgecrew to scan Terraform plans for misconfigurations
• Block terraform apply if policies fail

• Git workflow — security team writes Terraform modules, submits PRs
• Pipeline stages — terraform plan, policy validation, approval gate, terraform apply
• Blue-green deployments for security tools to avoid coverage gaps

• Security architects define requirements, DevSecOps engineers translate into Terraform modules
• Joint code reviews — security reviews configurations, platform team reviews infrastructure patterns

• Run terraform plan on schedule to detect manual changes
• Alert on drift, auto-remediate by re-applying IaC definitions
• Full audit trail through Git history