The DevSecOps Journey at Prudential Asia

### Overview Mohan Yelnuda discusses the DevSecOps journey at Prudential Asia, reflecting on the guiding question, "Did we cover enough ground?" He defines DevSecOps as the integration of security across both development and operations to facilitate early and frequent automated feedback across the entire application attack surface. The presentation outlines the four primary DevSecOps tracks established at Prudential—Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), and Container Security (CSec)—exploring the distinct challenges, integration points, triage processes, and operational lessons learned along the way.

### Key Topics - **DevSecOps Implementation Strategy**: Requirements must be tailored to an organization's specific technology landscape rather than generic vendor or analyst guidance. Key steps include conducting proof-of-concept evaluations, placing automated build-breaker gates in pipelines, and establishing triage workflows to differentiate between false positives and non-applicable vulnerabilities. - **Tool Lifecycle and Stakeholder Enablement**: Security tools must be reevaluated or replaced every two to three years as risk profiles, exploitation techniques, and application frameworks evolve. Because security teams are heavily outnumbered (around one security consultant for every 200 developers), Prudential scaled enablement by producing self-service resources, including FAQs, false-positive guides, and 3-to-5-minute video tutorials. - **Progress Metrics**: Measuring track maturity begins with onboarding metrics (tracking how many applications are integrated into scanning pipelines) and shifts over time to remediation metrics prioritized by risk (starting with critical findings, followed by high, medium, and low).

### Technical Details across Tracks - **SAST**: Ingests custom developer source code and outputs code vulnerabilities. It integrates into developer environments via IDE plugins (e.g., Eclipse, IntelliJ, Visual Studio, VS Code) and CI pipelines (Jenkins, Bamboo, CircleCI, Azure DevOps). The primary challenges are high rates of false positives and tools lagging behind modern language versions. A recommended practice is having developers review findings first before escalating edge cases to security. - **DAST**: Requires a stable running pre-production application or API endpoint as input and integrates into CD pipelines. Automated DAST tools (such as Burp Suite and OWASP ZAP) excel at detecting low-hanging fruit like missing input validation and injection flaws, but manual penetration testing remains essential for application logic vulnerabilities. - **SCA / Open Source Security**: Scans third-party library dependencies by computing version hashes and matching them against vulnerability databases. Integration covers IDEs, CI pipelines, and artifact repositories. Triage focuses on determining whether an impacted library is actually applicable based on specific API usage. Yelnuda emphasizes enabling production monitoring on artifact folders to detect newly disclosed vulnerabilities in already deployed code (citing the 2017 Equifax breach as a cautionary tale). - **Container Security**: Analyzes Docker images, base OS layers, and container orchestration platforms (such as AKS, OpenShift, or Kubernetes). Scans are embedded into IDEs, CI pipelines, container registries, and runtime environments via sidecars, daemonsets, or micro-scanners that can alert or quarantine compromised pods.

### Takeaways DevSecOps is an ongoing process rather than a static goal. Organizations cannot rely on a single silver bullet tool across all layers of the attack surface. Sustainable adoption requires automating gate checks, building self-service educational content, enabling continuous production monitoring, and continually reassessing both tooling and architecture as new technologies and threats emerge.