When working in a DevOps environment, security professionals are sometimes overwhelmed with just how fast the Dev and Ops teams are moving. We’re used to having more control, more time, and more… time!
Personally, I LOVE DevSecOps (the security team weaving security throughout the processes that Dev and Ops are doing). Due to my enthusiasm, I am often asked by clients when, how, and where to inject various types of tests and other security activities. Below is my list of options that I offer to clients for automated testing (there’s lots more security to do in DevOps — this is only automated tests). They analyze the list together and decide which places make the most sense based on their current status, and choose tools based on their current concerns.