DevSecOps, Security, and Compliance Automation
This domain tests how security evidence is generated automatically and enforced as code: scan types and their limits, supply-chain integrity, pipeline identity, and converting controls into auditable repeatable checks instead of review meetings.
Core rules
- Scan types are not interchangeable. SAST analyses source without executing it; SCA/dependency scanning finds known CVEs and licence issues in dependencies; DAST probes a running application as a black box; secret scanning covers working tree and full history; IaC scanning checks plan or template; image scanning covers OS packages and language libraries in layers. Each fails the build at a defined severity with a documented exception path.
- Supply chain: generate an SBOM (SPDX or CycloneDX), sign artifacts and attestations with Sigstore cosign and in-toto, target SLSA provenance, and verify at admission with a policy engine (Kyverno, OPA Gatekeeper) that requires your builder identity's signature.
- Pipeline identity: OIDC federation to the cloud, short-lived tokens, no static keys. Scope the trust policy to repository, ref and environment, and set least-privilege job permissions explicitly.
- Secrets: vault-managed, rotated, masked in logs, and never passed as build args that persist in layers.
- Compliance as code: CIS benchmarks and cloud config rules as policies; evidence collected automatically from CI and cloud APIs into the audit trail.
Worked example
A repository pushes images to ECR using a long-lived access key stored in CI secrets. Reasoning: any pull request that can run a pipeline step can exfiltrate that key, and it never expires. Replace it with GitHub Actions OIDC: the job requests a token, then assumes a role whose trust policy conditions on sub = repo:org/app:ref:refs/heads/main and aud = sts.amazonaws.com. The build signs the image digest with cosign in keyless mode, so the OIDC identity is the recorded signer; the SBOM is attached as an attestation; the admission controller rejects images without a valid signature from that identity. Result: no static credential and verifiable provenance at deploy time.
Traps
- Failing builds on every CVSS 9.8 including unreachable, dev-only transitive dependencies - this produces bypass culture. Triage with reachability and exploit-likelihood signals.
- Scanning only at release; the same scan in the pull request costs less to fix.
- Confusing a signed image with a safe image - a signature proves origin, not absence of vulnerabilities.
- Giving the scanner's CI token write access to the repository, so a compromised scanner can push code.