security-devops-assessment

name	security-devops-assessment
enabled	true
description	Use when performing security devops assessment — assesses the integration of security practices into DevOps workflows (DevSecOps). Covers shift-left security, automated security testing in CI/CD, supply chain security, runtime protection, security culture, and vulnerability management maturity.
required_connections	[{"prefix":"ci-cd","label":"CI/CD Platform"},{"prefix":"security-tools","label":"Security Scanning Tools"}]
config_fields	[{"key":"organization_name","label":"Organization Name","required":true,"placeholder":"e.g., Acme Corp Engineering"},{"key":"ci_cd_platform","label":"CI/CD Platform","required":true,"placeholder":"e.g., GitHub Actions, GitLab CI, Jenkins"},{"key":"primary_languages","label":"Primary Languages","required":false,"placeholder":"e.g., Java, Python, Go, TypeScript"}]
features	["DEVOPS","SECURITY","DEVSECOPS"]

Security DevOps (DevSecOps) Assessment

Phase 1: Shift-Left Security Assessment

1. Evaluate pre-commit security practices
   • Pre-commit hooks for secret detection
   • IDE security plugins/linters
   • Secure coding guidelines published
   • Security training for developers (annual)
   • Threat modeling in design phase
   • Security champions program in dev teams
2. Score: 1 (No shift-left) to 5 (Security embedded in design)

Security in Development Lifecycle

Phase	Security Activity	Implemented	Automated	Blocking
Design	Threat modeling	[ ]	N/A	N/A
Code	Secret scanning	[ ]	[ ]	[ ]
Code	SAST	[ ]	[ ]	[ ]
Build	SCA (dependency scan)	[ ]	[ ]	[ ]
Build	Container image scan	[ ]	[ ]	[ ]
Test	DAST	[ ]	[ ]	[ ]
Deploy	IaC security scan	[ ]	[ ]	[ ]
Runtime	RASP/WAF	[ ]	[ ]	N/A
Operate	Vulnerability management	[ ]	[ ]	N/A

Phase 2: CI/CD Pipeline Security

1. Evaluate security scanning in pipelines
   • SAST (Static Application Security Testing) integrated
   • SCA (Software Composition Analysis) for dependencies
   • Container image vulnerability scanning
   • IaC scanning (Terraform, CloudFormation, Kubernetes)
   • Secret detection in code and configs
   • License compliance checking
   • SBOM (Software Bill of Materials) generation
   • Scan results break builds for critical findings
2. Measure scan coverage and false positive rates

Pipeline Security Scan Coverage

Scan Type	Tool	Repos Covered	Auto-Run	Blocking	False Positive Rate
SAST		%	[ ]	[ ]	%
SCA		%	[ ]	[ ]	%
Container		%	[ ]	[ ]	%
IaC		%	[ ]	[ ]	%
Secrets		%	[ ]	[ ]	%

Phase 3: Supply Chain Security

1. Evaluate software supply chain security
   • Dependency pinning (lockfiles committed)
   • Private registry/mirror for packages
   • Dependency update automation (Dependabot, Renovate)
   • SBOM generation and storage
   • Signed commits enforced
   • Signed container images (cosign, Notary)
   • SLSA framework compliance level
   • Third-party code review process
2. Score: 1 (No controls) to 5 (SLSA Level 3+)

Phase 4: Runtime Security

1. Evaluate production security controls
   • Web Application Firewall (WAF) deployed
   • Runtime application protection (RASP)
   • Network segmentation and policies
   • Container runtime security (Falco, Sysdig)
   • Workload identity and least-privilege IAM
   • Secrets management (Vault, cloud KMS)
   • Encryption in transit and at rest
   • API security (rate limiting, auth, input validation)
2. Score: 1 (Perimeter only) to 5 (Defense in depth)

Phase 5: Vulnerability Management

1. Evaluate vulnerability management process
   • Vulnerability scanning schedule (continuous, weekly, monthly)
   • SLA for remediation by severity (critical: 7 days, etc.)
   • Vulnerability tracking and metrics
   • Exception/risk acceptance process
   • Patch management automation
   • Vulnerability trending and reporting
2. Measure vulnerability management metrics

Vulnerability Metrics

Metric	Current	Target	Status
Open critical vulns		0
Open high vulns		<
Mean time to remediate (critical)	days	< 7 days
Mean time to remediate (high)	days	< 30 days
Scan coverage	%	100%

Phase 6: Security Culture & Governance

1. Evaluate security culture
   • Security champions in each dev team
   • Regular security training and awareness
   • Security considered in sprint planning
   • Bug bounty or responsible disclosure program
   • Security metrics reported to leadership
   • Compliance automation (SOC 2, ISO 27001)
2. Score: 1 (Security is separate team only) to 5 (Security is everyone's job)

Overall DevSecOps Maturity

Dimension	Score (1-5)	Key Strength	Priority Gap
Shift-Left
Pipeline Security
Supply Chain
Runtime Security
Vulnerability Mgmt
Culture & Governance
Overall	/5

Counter-Rationalizations

Shortcut	Counter	Why
"We can skip some steps for this case"	Adapt the workflow steps, don't skip them	Skipped steps are where incidents and oversights originate
"The user seems to already know what to do"	Complete all workflow phases with the user	The workflow catches blind spots that experience alone misses
"This is a minor case, full process is overkill"	Scale the process down, don't turn it off	Minor cases become major when unstructured; the process scales, not disappears
"I'll fill in the details later"	Complete each section before moving on	Deferred details are forgotten; real-time capture is more accurate
"The template output isn't necessary"	Always produce the structured output format	Structured output enables comparison, audit trails, and handoff to other teams

Output Format

• Maturity Scorecard: Per-dimension scores with evidence
• Pipeline Security Gaps: Missing scans and coverage
• Vulnerability Report: Open findings and remediation SLA compliance
• Supply Chain Assessment: SLSA compliance level
• Improvement Roadmap: Prioritized DevSecOps initiatives

Action Items

• Integrate missing security scans into CI/CD pipelines
• Establish vulnerability remediation SLAs
• Implement supply chain security controls
• Launch security champions program
• Automate SBOM generation and tracking
• Set up security metrics dashboard for leadership
• Schedule quarterly DevSecOps maturity review