SIGNAL Innovation Showcase: Acquired Data Solutions: DevSecOps Transformation
- Room: SIGNAL Innovation Theater - Booth #2769
Wednesday, May 07, 2025: 2:20 PM - 2:40 PM
Speaker(s)
Description
DevSecOps has evolved from DevOps by incorporating security into development and operational workflows. However, this retrofitted approach leaves critical gaps—it primarily focuses on application security, overlooks the security of deployment platforms and supply chain, and
treats operations security reactively rather than proactively. Our work addresses these limitations through a three-pronged approach that integrates comprehensive security and AI- driven automated risk assessment into the DevSecOps pipeline.
1. Unlike traditional DevSecOps, which emphasizes application security and operational monitoring, our approach extends security considerations to the deployment platform and supply chain, ensuring that infrastructure security is an integral part of the workflow. Additionally, rather than treating security operations as a static process, we position risk assessment as the driving force for security by using our innovative automated risk assessment technology. Automated risk assessment in the context of DevSecOps dynamically generates security requirements for secure operations and is continuously refined by interfacing with security intelligence, which focuses on emerging, relevant attack scenarios. These elements are processed in near real-time, feeding into an adaptive DevSecOps pipeline for continuous security management.
2. At the core of our approach is a novel AI-driven automated risk assessment system, which dynamically infers security risks from system models. This embeds Systems Engineering principles into DevSecOps, extending its scope beyond developers.
3. The entire assurance argument is managed as a knowledge graph alongside the DevSecOps pipeline, further enabling knowledge-based AI techniques to support structured security reasoning, traceability, and compliance verification.
By integrating platform security, risk-driven requirements, intelligence-driven adaptation, and AI-powered assurance, our approach transforms DevSecOps into a proactive, systemic, and dynamic security framework that is deeply embedded in both the software and infrastructure lifecycle.
Listen Here
Tracks: