Introduction to DevSecOps TryHackMe (THM)Walkthrough | THM Writeup

Hello everyone! I will do a TryHackMe walkthrough on the room for today. Integrating security practices into the DevOps workflow, DevSecOps ensures that security is prioritized immediately rather than being an afterthought. This approach helps to minimize vulnerabilities and enhance the security posture of applications and systems.

DevOps: A New Hope

What methodology relies on self-organising teams that focus on constructive collaboration?

Flag: Agile

• Agile methodology prioritizes the creation of self-organizing and cross-functional teams that are based on the work that needs to be done rather than pre-assigned roles.
• Such teams value open communication, flexibility, and continuous feedback to adapt quickly, deliver faster, and build collaborative relationships that enable constructive progress.

What methodology relies on automation and integration to drive cultural change and unite teams?

Flag: DevOps

• DevOps is a collaborative approach to integrating development and operations, which promotes a shared sense of responsibility and a unified team culture.
• By implementing practices like continuous integration and delivery, infrastructure as code, and monitoring, DevOps eliminates barriers between teams, reduces manual labor, and enhances visibility throughout the software delivery pipeline.

What traditional approach to project management led to mistrust and poor communication between development teams?

Flag: Waterfall

• The waterfall approach is a project management methodology that follows a strict sequence of phases and offers minimal opportunities for feedback.
• This linear process, which starts with requirements and ends with deployment, creates barriers between teams, hinders their ability to adapt to changes, and results in delays in delivering functional software.
• These issues often lead to conflicts and a lack of unity among development teams.

What does DevOps emphasize?

Flag: Building trust

• The DevOps methodology intends to promote collaboration among different teams such as development, QA, and operations by removing barriers and increasing communication.
• This is achieved by implementing practices like daily standups, integrating workflows, and automating deployments, which result in increased transparency, shared understanding, and trust within an organization.

The Infinite Loop

What helps in adding tests in an automated manner and deals with the frequent merging of small code changes?

Flag: CI/CD

• Teams can streamline their software development process by using continuous integration and continuous delivery (CI/CD) workflows, which involve automating the building, testing, and merging code changes through specialized tools.
• This integration allows code to be rapidly delivered by automating the testing and building of code each time it is pushed to a shared repository.

What process focuses on collecting data to analyse the performance and stability of services?

Flag: Monitoring

• By implementing this solution, the recovery process can be accelerated, team coordination can be improved, a larger volume of data can be collected and analyzed for more effective problem-solving, and an automatic response can be triggered.

What is a way to provision infrastructure through reusable and consistent pieces of code?

Flag: IaC

• It is possible to recycle the code utilized for deploying infrastructure, such as cloud instances, which can aid in ensuring uniformity in resource creation and management. Terraform, Vagrant, and other similar tools are commonly employed for Infrastructure as Code (IaC).

Shifting Left

What term is it used to describe accounting for security from the earliest stages in a development lifecycle?

Flag: Shift Left

• DevOps professionals aim to integrate security into the development process from the very beginning and foster a more collaborative approach between the development and security teams.

What is the development approach where security is introduced from the early stages of a development lifecycle until the final stages?

Flag: DevSecOps

• Integrating security into the DevOps process is crucial to improving the effectiveness of DevOps and avoiding potential issues.
• Given the increasing frequency of cyber attacks and stricter regulations, incorporating security into DevOps practices is no longer optional but mandatory.

DevSecOps: Security Strikes Back

What DevSecOps challenge can lead to a siloed culture?

Flag: Security Silos

• DevSecOps faces the challenge of security silos which create a fragmented culture with gaps in collaboration and visibility, as security teams and tools remain separate from development and operations.

What DevSecOps challenge can affect not prioritizing the right risks at the right times?

Flag: Lack of visibility

• When there’s a lack of visibility throughout the development lifecycle, it becomes challenging to identify and tackle the most crucial security risks at the appropriate stages in DevSecOps.

What DevSecOps challenge stems from needlessly overcomplicated security processes?

Flag: Stringent Processes

• DevSecOps may face difficulties due to security processes that are too strict or complicated and require appropriate scaling.
• These processes can create hurdles and slow down the development and deployment process.

DevSecOps Culture

How can you make security scalable so it’s not left behind when start ups face hypergrowth or in large corporations?

Flag: Promote Autonomy of Teams

• Enabling teams to take ownership of their own security can help to customize security measures according to their specific requirements, instead of following inflexible procedures that do not cater to their needs.
• This approach can facilitate security maintenance, even as companies experience rapid growth in startup ventures or established enterprises.

How can you support teams in understanding risk and educating on security flaws?

Flag: Visibility and Transparency

• It is essential to provide visibility into potential risks and maintain transparency around security flaws to strengthen security.
• This helps teams to learn from past incidents and develop a shared understanding of how to improve their security posture.

What are key factors to successfully instill security in the development process by accounting for flexibility?

Flag: Understanding and Empathy

• To effectively incorporate adaptable security measures into the development process, it is crucial to cultivate empathy, establish shared context, and encourage open communication between the security and development teams.

Exercise: Fuel Trouble

What Software Development Model did the team in Comic 1 follow?

Flag: Waterfall

What Software Development Model did the team in Comic 2 follow?

Flag: Agile

What Software Development Model did the team in Comic 3 follow?

Flag: DevOps

What is the flag?

Flag: THM{ONE_TWO_THREE}

Takeaways

I enjoyed the Introduction to DevSecOps TryHackMe room and am glad it exists. Comment below if you have tried this room. — I’d love to hear your thoughts! By implementing DevSecOps, it becomes possible to conduct continuous security monitoring and testing at every stage of the development process, thereby facilitating early detection and resolution of security issues. This approach fosters a security culture by promoting team collaboration and automating security-related processes. As a result, DevSecOps helps to enhance cybersecurity. See you in the next post!

Reference:

https://tryhackme.com/room/introductiontodevsecops

Thanks for reading!

One moment. You should get my articles in your inbox. Subscribe here.

👩‍💻 Follow me on YouTube | Instagram | GitHub for lifestyle and cyber education content 👩‍💻

I hope that you have a wonderful day. ✨

Follow for more: