Explain like I'm five · Security

What is DevSecOps?

DevSecOps, told as a story about a guard who sits beside the builder from the first drawing, instead of inspecting the tower once it is finished.

all done!there is a crack here…so… tear it down and start over?the guard sees the tower for the first time after it is finished

In the old days, the guard looked only after the tower was finished.The builder spends months finishing the tower. Only then does the guard come and find a crack.

rebuild itmonthstearing down and rebuilding takes monthsskip the checkskip the check and the thief finds the crack firstfast or safe — back when you had to pick one

Rebuilding is slow, and skipping the check is dangerous.Tearing down and rebuilding to fix a crack takes months. Skip the check instead, and the thief finds the crack first. You had to pick one.

THE DRAWINGnew tower: one doorguard: no back doorbuilder: got it!the guard sits in from the first drawingevery brick is checked, automaticallyonly green bricks reach the towerfast and safe — builder and guard together from the very start

DevSecOps is the builder and the guard working side by side while building.The guard sits in from the first drawing. Every brick is checked automatically as it is laid. So it is fast and safe at once.

From the drawingmove the check to the very start
Every brick, auto-checkedno one has to wait
Check the parts listeven bricks made by others
Keys in the boxnever nailed to the drawing
every brick passes each station in turnread the drawingcheck the partslook for keysknock on the wallonly green bricks passa red brick stops at the gatestopped? the builder fixes it right away — minutes, not months

Bricks pass each station in turn, and a red brick stops at the gate.Read the drawing, check the parts, look for keys, knock on the wall. One red light and the gate closes — the builder fixes it on the spot.

built fast, and it is solid!the builder goes fast, the guard rests easynext: look at the drawing through a thief's eyes before building

Built fast, and it is solid.A crack caught before building costs one brick. Next: looking at the drawing through a thief's eyes before building.

In one breath

DevSecOps = instead of inspecting a finished tower, the guard sits beside the builder from the drawing and every brick is auto-checked — fast and safe at once.

DevSecOps. Development, security, and operations work as one team, with security checks automated inside the CI/CD pipeline. Security stops being a gate at the end and becomes a teammate from day one.

When grown-ups say it

DevSecOps
Builder and guard, building together. The people who build, protect, and run it are one team from the start.
Shift left
The check moves to the front. Move the check left, to the start of the plan. The earlier it is caught, the cheaper it is.
CI/CD pipeline
The belt the bricks ride. The builder puts a brick on, and checking and laying follow automatically.
Automated scanning
The stations on the belt. Reading the drawing, knocking on the wall. → reading the drawing and knocking on the wall
IaC scanning
Checking the building instructions too. Today the castle itself is built from written instructions (code). Scan them for lines like 'leave the door open'.
Container image scanning
Checking the whole shipping box. Bricks ship in boxes. Check the box for old parts inside. → the parts list
Secrets management
Keys in a locked box. Never nail a key to the drawing. → not nailing the key to the wall
Gate
The gate that stops red bricks. A brick that fails a check never reaches the tower. The pass rule is set in advance.
Next story
The Drawing Seen Through a Thief's Eyes →
Want another term as a picture book? Request →