Embedding Security Practices into Taxonomy of DevOps Practices

DevOps practices' emergence into software development has revolutionized efficiency and agility in the development lifecycle. However, as organizations adopt DevOps, there is growing acceptance of the imperative to integrate security practices into the DevOps workflow. Traditionally, security practices were often implemented as standalone processes, but integration across the entire pipeline is imperative in the fast-paced DevOps environment. This research proposes a methodology to integrate DevOps and security practices to embed security seamlessly throughout the DevOps lifecycle. Our approach focuses on selecting, assessing compatibility, and incorporating security practices. First, we identify two distinct categories of practices. The nineteen DevOps Security practices were drawn from the prior studies focused on developing a framework for implementing DevOps practices, and eighteen security practices were chosen from a previous study aimed at constructing a framework for successful DevSecOps operation in software development organizations. Moreover, we also integrated ten security practices distributed among the distinct phases of the DevOps lifecycle that are highly compatible with DevOps practices.