--- source_url: "https://wenske-cs.de/en/devsecops/" title: "DevSecOps & CI/CD Security | WCS" mirrored_at: 2026-08-05T03:38:50.851Z host: wenske-cs.de cited_in_42a: true mirror_canonical: "https://index.42a.ai/wenske-cs.de/en/devsecops/index" --- > **Original source:** https://wenske-cs.de/en/devsecops/ DevSecOps · CI/CD Security ## Security belongs in the pipeline. Not beside it. Vulnerabilities discovered in production cost many times more to fix. We integrate security directly into your development processes: automated, auditable and without slowing down your releases. ## Shift security left Traditionally, security is checked at the end of the development cycle. Shift Left means: security checks happen automatically on every commit, not just before the release. ### Code: SAST · Secret Scanning Source code is automatically checked for vulnerabilities and accidentally committed secrets (API keys, passwords) on every commit. Semgrep, GitHub Advanced Security, Credential Scanner ## What happens when security is an afterthought Without integrated security checks, risks emerge that only become visible when it is too late. ### No Code Scanning Code goes live without automated security checks. Vulnerabilities land directly in production. ### Outdated Dependencies Outdated dependencies go unnoticed. Open-source libraries with known vulnerabilities continue to be used. ### Insecure Containers Container images are pulled from public registries without checking for vulnerabilities or tampering. ### Manual Infrastructure Infrastructure is set up manually. Misconfigurations are not reproducible and not auditable. ### Missing Compliance Compliance evidence is missing. Auditors ask for documented security processes, and there are none. ### Security as Bottleneck Security slows down releases. Security is added as a gate at the end: frustration, delays, workarounds. ## Four building blocks for secure software development From code analysis to security enablement: each building block strengthens your development pipeline at a different point. ### Automate code analysis PIPELINE INTEGRATION - Integrate static code analysis (SAST) directly into the CI/CD pipeline: vulnerabilities detected on every commit - Automate dynamic testing (DAST) against running applications - Secret scanning: detect API keys, passwords and tokens in code before they are committed - Prioritise findings and embed them into the developer workflow, directly in the pull request SEMGREP · GITHUB ADVANCED SECURITY · OWASP ZAP · AZURE DEVOPS ### Secure containers and Kubernetes CONTAINER SECURITY - Automatically scan container images for vulnerabilities before they reach the registry - Harden AKS clusters: network policies, pod security standards, RBAC design - Only signed and verified images may be deployed (admission control) - Runtime protection: detect and contain suspicious behaviour in running containers ACR · AKS · DEFENDER FOR CONTAINERS · TRIVY · OPA/GATEKEEPER ### Secure infrastructure as code IAC SECURITY - Automatically check Terraform and Bicep templates for security risks and misconfigurations - Policy-as-code: define security rules as code that every deployment must comply with - Drift detection: identify deviations between the desired state and actual infrastructure - Compliance mapping: map IaC checks to regulatory requirements (BSI, ISO 27001, NIS2) TERRAFORM · BICEP · CHECKOV · TFSEC · AZURE POLICY ### Enable development teams SECURITY ENABLEMENT - Secure coding workshops: hands-on training for your developers, not PowerPoint marathons - Threat modelling: identify threats together with the team before code is written - Build security champions: train individual developers as the security contact in each team - Secure coding guidelines: a practical ruleset that fits the team's tech stack OWASP TOP 10 · STRIDE · MICROSOFT THREAT MODELING TOOL ## NIS2 Compliance and Software Supply Chain The NIS2 directive and current BSI guidance require demonstrable security across the software supply chain. SBOM and DevSecOps are no longer optional — they are mandatory. ### NIS2 Requirements - Supply chain risk management (Art. 21(2)(d)) - Security in acquisition, development, and maintenance of IT systems - Mandatory incident reporting within 24 hours - Accountability and evidence obligations towards supervisory authorities ### SBOM — Software Bill of Materials - Complete inventory of all software components and dependencies - Automated SBOM generation on every build (CycloneDX, SPDX) - Continuous matching against CVE databases and vulnerability feeds - Licence compliance: detect and document open-source licences ### Supply Chain Security - Detect and prevent dependency confusion and typosquatting - Software signing and artefact integrity (Sigstore, Cosign) - SLSA framework: verifiable build provenance for every artefact - VEX documents: vulnerability context for your customers and partners Since October 2024, affected organisations must meet NIS2 requirements. Integrating DevSecOps and SBOM into your pipelines now creates not just compliance — but real transparency across your software supply chain. ## Your path to secure software development Four phases, each delivering standalone value. From assessment to ongoing operations. 1. 01 ### Pipeline Assessment 2-3 weeks - Inventory of existing CI/CD pipelines and tools - Identify security gaps in the development process: where checks are missing, where blind spots exist - Assess current container and IaC security posture - Prioritised roadmap with quick wins and strategic measures 2. 02 ### Security Integration 4-6 weeks - Integrate SAST/DAST tools into existing pipelines (no tool change required) - Set up container image scanning and registry hardening - Activate IaC scanning for Terraform/Bicep templates - Configure secret scanning and pre-commit hooks 3. 03 ### Policy & Governance 3-4 weeks - Build policy-as-code framework (Azure Policy, OPA/Gatekeeper) - Admission control for Kubernetes: only compliant workloads are deployed - Compliance mapping: map security checks to regulatory requirements - Create documentation for auditors and examiners 4. 04 ### Enablement & Operations 2-3 weeks + ongoing - Secure coding workshops for development teams - Identify and train security champions within teams - Runbook for handling security findings (prioritisation, escalation, SLAs) - Continuous optimisation: new rules, fewer false positives, regular reviews Approximately 3-4 months to a fully integrated process Each phase builds on the previous one and delivers standalone value. ## Why work with us ### Platform-agnostic Azure DevOps, GitHub Actions, GitLab CI: we work with whatever you already use. ### Developer-friendly Security that arrives in the workflow. Findings appear where developers work: in the pull request. ### Compliance-ready Every check maps to regulatory requirements: NIS2, DORA, ISO 27001, BSI IT-Grundschutz. ### Not an endless project Assessment, integration, enablement. The process is in place within 3-4 months. Then it runs automatically. Free & no obligation ## How secure is your pipeline? In a free initial consultation, we analyse together where the biggest security gaps lie in your development process and which measures have the greatest impact. No obligation. No sales pitch. Just clarity.