Creating the reference architecture
Before we discuss the reference architecture of DevSecOps, we need to understand what the role of DevOps is and how security fits in. DevOps is about the software development life cycle. An important note that we have to make is the fact that developers increasingly use open source components. This makes sense since this provides great flexibility when developing new code.
Open source is community-driven, so developers can contribute to each other's code and speed up the process. Projects can and are shared in open Git and GitHub repositories, but also internally in enterprises. InnerSource type projects are a good example of this. InnerSource uses open source best practices for software development, within the boundaries of an organization. Typically, InnerSource projects make use of shielded, access restricted repositories in GitHub or alike.
Yet, there are some risks associated with open source that need to be addressed from a security...