SECURITY-AS-CODE: ENFORCING CYBERSECURITY STANDARDS THROUGH AUTOMATED GOVERNANCE IN CLOUD PIPELINES

The recent widespread use of the cloud-native architectures and DevSecOps practices has changed the nature of software delivery pipelines, yet created new areas of attack and compliance exposures.Conventional security models cannot scale with the speed and sophistication of current CI/CD environments, resulting in vulnerability detection that is too often performed at the end of the pipeline and compliance issues.To reduce such challenges, this study proposes an automated governance framework using Security-as-Code(SaC) that integrates security requirements in cloud pipelines.The framework embeds policy-as-code, continuous compliance assessment and evidence production to guarantee that policy is enforced at each iteration of the development process. Evaluation on multi-cloud CI/CD pipelines indicated that the framework is effective in detecting policy violations early (82 percent), has low performance overhead during enforcement (reduction by five percent), and full coverage on audit evidence (95 percent completeness). The results indicate that the incorporation of governance as code would be able to substantially decrease the degree of human error, automate the process ofSecurity-as-Code: Enforcing Cybersecurity Standards through Automated Governance in Cloud Pipelines https://iaeme.com/Home/journal/IJCET11