Which term is used to describe the practice that embeds security into software development and operations?

Which term is used to describe the practice that embeds security into software development and operations?

• A. DevOps
• B. Vulnerability Management
• C. DevSecOps
• D. Threat Modeling

Answer: (C)

Embedding security into the software development and operations lifecycle means making security part of every stage—from design and coding to building, testing, and deploying—so security checks happen continuously rather than as a final step. This approach is known as DevSecOps, a blend of DevOps and security that treats security as a shared responsibility and automates security controls within the CI/CD pipeline. By shifting security left, teams can detect and remediate vulnerabilities earlier, use secure coding practices, perform automated dependency and container security checks, and enforce policies without slowing down delivery. DevOps focuses on collaboration between development and operations to accelerate delivery, but it doesn’t inherently embed security into the process. Vulnerability Management centers on identifying and fixing weaknesses, often across environments, rather than weaving security into how software is built and deployed. Threat Modeling is a design activity that identifies potential threats, but it doesn’t by itself establish ongoing security practices throughout the development lifecycle. DevSecOps specifically combines these ideas into a continuous, integrated security approach within development and operations.

Embedding security into the software development and operations lifecycle means making security part of every stage—from design and coding to building, testing, and deploying—so security checks happen continuously rather than as a final step. This approach is known as DevSecOps, a blend of DevOps and security that treats security as a shared responsibility and automates security controls within the CI/CD pipeline. By shifting security left, teams can detect and remediate vulnerabilities earlier, use secure coding practices, perform automated dependency and container security checks, and enforce policies without slowing down delivery.

DevOps focuses on collaboration between development and operations to accelerate delivery, but it doesn’t inherently embed security into the process. Vulnerability Management centers on identifying and fixing weaknesses, often across environments, rather than weaving security into how software is built and deployed. Threat Modeling is a design activity that identifies potential threats, but it doesn’t by itself establish ongoing security practices throughout the development lifecycle. DevSecOps specifically combines these ideas into a continuous, integrated security approach within development and operations.