Our Research
DevSecOps
DevSecOps is a set of principles and practices that provide faster delivery of secure software capabilities by improving the collaboration and communication between software development teams, IT operations, and security staff within an organization, as well as with acquirers, suppliers, and other stakeholders in the life of a software system.
To keep pace with potential adversaries, the Department of Defense (DoD) and government software development efforts need to deliver cutting-edge software capabilities quickly. However, as of 2012, the average development time from concept to deployment for major DoD IT systems was seven years, and in February 2017, the Government Accounting Office reported that the DoD “pays more than anticipated, can buy less than expected, and, in some cases, delivers less capability to the warfighter.” The budgeting process alone can take as long as two years.
With the increasing importance for developing and deploying new technologies, it is critical for the DoD to find ways of accelerating the speed at which it moves from concept to capability. DevSecOps has proven successful in industry for doing just that, with many companies increasing not only the velocity at which they deliver secure software to users, but their incident response capabilities as well. DevSecOps can increase system quality, reduce costs and capability time-to-value, and minimize cognitive differences among all key system stakeholders.
As a result, the DoD and other government agencies are invested in finding how to effectively apply these techniques to their projects. The SEI supports this work by researching how to apply DevSecOps in the DoD and government settings to deploy new technologies more quickly and ensure that those technologies are secure.
Better Software Faster
Since the SEI began its research on DevSecOps in 2012, we have become a recognized leader in the practice. The SEI integrates research on AI, software, and cybersecurity into its work in DevSecOps to provide solutions for DoD capabilities, acquisition, integration, and delivery of software.
In 2015, the SEI became the first federally funded research and development center (FFRDC) to work on implementing DevSecOps practices at the DoD. Currently, the SEI is engaged in several projects that involve the application of DevSecOps to complex, mission-critical systems development, as well as for reducing software cycle times and cost, and improving the sustainability of DoD platforms.
In the same year we began working with the DoD, we leveraged our expertise to launch the first course in the world on the topic of DevSecOps in the graduate program of Carnegie Mellon University’s (CMU) world renown School of Computer Science. The course was co-designed and co-taught by Hasan Yasar.
Since 2015, demand for our DevSecOps course has grown, and it is now offered every semester of the academic year at CMU. Today, we also offer the course internationally and have consulted with top-tier universities across the world to help them build their own DevSecOps curricula, including universities in Germany, Spain, Portugal, Rwanda, Turkey, India, and more.
Your organization can benefit from the SEI’s expertise. We offer training, mentoring, and engineering support for organizations that are new to DevSecOps or that are looking to optimize their techniques. Our experts can help you apply DevOps to your organization’s development, testing, and operational processes and create synchronous environments that enable you to deploy new capabilities and update current features securely.
We can also help you leverage DevSecOps to better meet the requirements set forth in various standards (e.g., IEEE P2675 DevOps and NIST 800-160), frameworks (e.g., DOD Architecture Framework), regulations (e.g., DoDD 5000.01 and DFARS), and strategic plans (e.g., the DISA Strategic Plan).
What We Offer
The Latest from the SEI Blog
Acquisition Archetypes Seen in the Wild, DevSecOps Edition: Cross-Program Dependencies
September 03, 2024 • Blog Post
William E. Novak
Shared capabilities can help manage costs and complexities but can also result in cross-program dependencies. This post examines this phenomenon in a DevSecOps...
read
Cultivating Kubernetes on the Edge
July 08, 2024 • Blog Post
Patrick Earl, Jeffrey Hamed, Doug Reynolds, Jose A. Morales
Members of the SEI DevSecOps Innovation team were asked to explore an alternative to VMware’s vSphere Hypervisor in an edge compute environment. This post explores their...
readExplore Our DevSecOps Projects
Our Vision for the Future of DevSecOps
The SEI continues to research DevSecOps to accelerate and assure software transformations. Our research program reaches a wide range of DoD and U.S. government organizations. In the near-term, the SEI is working to streamline continuous assurance via DevSecOps. In the future, our research aims to develop the next generation of DevSecOps that will be capable of integrating automated code repair and adversarial AI models, enabling the development of AI systems, and using AI in all phases of the SDLC to support DevSecOps practices and processes with smart decisions.
To stay up to date on the SEI’s DevSecOps research, subscribe to our blog.