Like DevOps, DevSecOps seeks to achieve greater efficiency and productivity through team collaboration, but the DevSecOps approach incorporates security principles.

So, DevSecOps is similar to DevOps in that both seek to achieve better results through greater operational focus and communication, but in this case the framework involves security principles. DevSecOps represents a mentality as promoted by a group of security practitioners. Their philosophy involves building security into applications so it's baked in rather than applied after the fact -- or worse, retro-fitted on. TechRepublic covered the DevSecOps approach earlier in 2018 in an analysis of some of their other concepts which include threat modeling, risk assessment, automation of security tasks and an emphasis on team collaboration. In short, security principles and communication should come into play every step of the way when building applications.

The DevSecOps philosophy was created by security practitioners who seek to "to operate and contribute value with less friction." These practitioners operate a website which details their approach to better security, explaining that "the goal of DevSecOps is to bring individuals of all abilities to a high level of proficiency in security in a short period of time. Security is everyone's responsibility."

The DevSecOps manifesto involves principles such as building a platform of least-privilege access, focusing on science and avoiding fear, uncertainty and doubt (FUD), collaboration, consumable and business-driven security services, team testing to analyze potential exploits, continuous security monitoring and sharing intelligence.

Why does it matter?
DevSecOps practitioners seek to work alongside developers at every step of the way, unlike traditional security approaches, which can be slow and come along too late in the deployment process.

Who does this affect?
DevSecOps is primarily comprised of security experts and technological workers, but all users who run or rely upon software are affected by security principles, good or bad.

How do I implement it?
DevSecOps requires an increased focus on collaboration (both within and between teams), automation and building security as you go. Adopting these principles is a good first step to implement this mindset. Like DevOps itself, this is not a culture which can be immediately applied, but will require gradual changes as the various concepts are applied within the organization and existing frameworks are replaced with new practices.