[Security Concepts] On which part of the IT environment does DevSecOps focus?

DevSecOps is a methodology that integrates security practices into the DevOps process. Its primary focus is on the software development lifecycle (SDLC). The core principle, often called "shifting left," is to embed security controls, testing, and considerations from the very beginning of the application development process (coding, building, testing) through to deployment and operations. This approach aims to build secure applications from the ground up, rather than treating security as an afterthought. The focus is on the application and its delivery pipeline, not on specific network segments or infrastructure types.

B. wireless network: This is a specific domain of network security. DevSecOps is a development methodology focused on the application lifecycle, not a particular type of network infrastructure.

C. data center: While applications reside in data centers, DevSecOps focuses on securing the application code and its CI/CD pipeline, not the entire data center's physical or network infrastructure.

D. perimeter network: Perimeter security is a traditional network security concept. DevSecOps focuses on embedding security within the application itself, which is a distinct and complementary practice.

1. Official Vendor Documentation: Cisco

CCNP and CCIE Security Core SCOR 350-701 Official Cert Guide

1st ed.

Cisco Press

2020. Chapter 25

"Cloud and Content Security

" in the section "DevSecOps

" states

"DevSecOps is the philosophy of integrating security practices within the DevOps process... The main idea is to not make security an afterthought but to build it into the CI/CD pipeline from the beginning." This directly links DevSecOps to the application development pipeline.

2. Peer-reviewed Academic Publications / Official Standards: National Institute of Standards and Technology (NIST)

Special Publication (SP) 800-204

Security Strategies for Microservices-based Application Systems

October 2019. Section 4.1

"DevSecOps

" describes the methodology as "an organizational approach of integrating the security practices in the DevOps movement" and details its application throughout the "build

ship

and run" phases of the application lifecycle.

3. University Courseware / Reputable Institutions: Software Engineering Institute

Carnegie Mellon University

"What Is DevSecOps?". The institute defines DevSecOps as a practice that "aims at unifying software development (Dev)

security (Sec)

and operations (Ops)" with a focus on automating security within the software delivery process. This confirms the focus is on the software/application domain.