DevSecOps: UNIFYING DEVELOPMENT AND SECURITY PROCESSES

Research objective: the objective of this study is to examine and describe the concept of DevSecOps, its structure, and key components, as well as to develop a simplified DevSecOps maturity model. This model can be utilized by organizations to assess their current DevSecOps maturity level and identify priority areas for the phased implementation of secure software development practices. Methods: the research involved analyzing modern approaches to integrating security into DevOps processes, developing a DevSecOps maturity model based on international standards and practices, and creating methodologies for maturity assessment and metrics for monitoring and managing security. Results: the research revealed that DevSecOps unifies development, operations, and security processes, reducing cybersecurity risks by integrating protective measures at the early stages of the software lifecycle. Three key domains of DevSecOps were identified: technology, processes, and people, which form the foundation for transitioning to secure development. The proposed maturity model comprises three levels and 24 activities that organizations can use for self-assessment and strategy development for implementation. Additionally, metrics were introduced to monitor progress and evaluate the effectiveness of DevSecOps practices, including vulnerability detection and remediation time, early detection rates, and performance coefficients. Practical significance: a simplified DevSecOps maturity model was developed, providing a structured approach to implementing secure development practices. For the first time, comprehensive metrics for DevSecOps monitoring were proposed, enabling organizations to adopt a systematic approach to security management and risk minimization.