Problems of CI/CD and DevOps on Security Compliance

Abstract

In this chapter, the authors define the main problems when working on products in DevOps Teams and on CI/CD pipelines with regard to security and risk management. It focusses on the regulatory requirements and cyberthreats that have impact on organisations. Regulator requirements vary from industry and country. Working with multiple teams on products requires proper alignment in frameworks, controls, and architecture principles in order to be end-to-end protected throughout the connected platforms. This chapter examines the multiple compliance frameworks and architectural principles that can be applied to agile way of working and more precise to CICD pipelines. It defines the main problem statement and questions the authors wanted to answer. The authors looked with a lens of regulated industry since this industry suffers the most and therefore has the biggest benefit from this research project.