Title: A Pipeline of Problems, or Software Development Nirvana? The Challenges of Adopting DevSecOps in a Safety-Critical Environment

Author(s): James Sharp, Mike Drennan, Paul McKernan

Publication Event: Proceedings of the Thirtieth Safety-Critical Systems Symposium

Publication Date: 2022-02-08

Resource URL: https://scsc.uk/r1536.pdf

Abstract:

The use of DevOps methodologies is now common throughout the technology world, driving a cultural change in the development of software. DevSecOps takes this one-step further, embedding the security measures required in today’s hyper-connected world. The adoption of DevSecOps in defence will pose significant challenges to the way that we currently build and deliver software; this will be particularly challenging in the safety-critical domains, such as aviation. In this paper we introduce the principles and technologies proposed in the DevSecOps software development pipeline. An examination into how the US DoD are deploying DevSecOps to maintain operational superiority is given. Two challenges are identified for the UK: providing assurance for safety-critical systems through the DevSecOps pipeline and making the cultural changes necessary to adopt and adapt from the tried and tested methods to this new approach. Finally, we highlight the path that adoption of DevSecOps introduces, identifying the capabilities and further technologies that will naturally be incorporated into this cultural and technological shift for safety-critical software development.