DevSecOps

Secure DevSecOps Solutions

Obsidian delivers secure software development, continuous integration, automated testing, and continuous delivery to help agencies build, deploy, and maintain mission-critical applications with confidence.

Trusted DevSecOps Partner

Obsidian's DevSecOps Approach encompasses the entire Software Development Lifecycle (SDLC). Obsidian's Software Development Lifecycle (SDLC) includes agile development, continuous integration, continuous testing, and continuous delivery while providing continuous security testing throughout every phase of the lifecycle. The key steps for automation that enable our DevSecOps include:

Mission-Focused

Delivering secure, reliable software that supports federal mission objectives.

Agile by Design

Iterative development, rapid feedback, and continuous improvement to adapt to evolving requirements.

Security Embedded

Integrating security into every phase of the software development lifecycle to reduce risk early.

Collaborative Delivery

Supporting transparent planning, iterative development, and continuous stakeholder engagement.

How We Deliver Secure Software

Daily Code Commit

Our Developers check-in code on a daily basis into a central source code repository. SAST tools are run every time code is committed and attempt to highlight vulnerabilities within static source code using techniques such as Taint Analysis and Data Flow Analysis.

Automated Builds

A Continuous Integration (CI) server is continually polling the source repository for changes; when a change occurs, the code is checked out of the repository and built. The built software is stored in a repository manager by the CI server.

Automated Testing

The code is automatically unit tested; code quality tested; code static, dynamic, and interactively security tested; smoke and UI tested; and performance tested. DAST tools are run on operating code to detect issues with interfaces, requests, responses, scripting (i.e. JavaScript), data injection, sessions, authentication, and more. IAST tools are run using knowledge of application and data flow to create advanced attack scenarios.

Automated Delivery

The built version is deployed using provisioning tools that treat infrastructure as code and is integrated into the CDM testing tools, monitoring tools, and processes that may include Splunk, Nessus, McAfee ePO, New Relic, etc.

Continuous Integration (CI)

Continuous Integration (CI) and Continuous Delivery (CD) are designed to create an automation environment for the entire end-to-end release process so that every change to the application results in a releasable, security-validated version that is built automatically.

Secure DevSecOps Solutions

Mission-Focused

Delivering secure, reliable software that supports federal mission objectives.

Agile by Design

Iterative development, rapid feedback, and continuous improvement to adapt to evolving requirements.

Security Embedded

Integrating security into every phase of the software development lifecycle to reduce risk early.

Collaborative Delivery

Supporting transparent planning, iterative development, and continuous stakeholder engagement.

Daily Code Commit

Our Developers check-in code on a daily basis into a central source code repository. SAST tools are run every time code is committed and attempt to highlight vulnerabilities within static source code using techniques such as Taint Analysis and Data Flow Analysis.

Automated Builds

A Continuous Integration (CI) server is continually polling the source repository for changes; when a change occurs, the code is checked out of the repository and built. The built software is stored in a repository manager by the CI server.

Automated Testing

Automated Delivery

The built version is deployed using provisioning tools that treat infrastructure as code and is integrated into the CDM testing tools, monitoring tools, and processes that may include Splunk, Nessus, McAfee ePO, New Relic, etc.

Continuous Integration (CI)

Continuous Integration (CI) and Continuous Delivery (CD) are designed to create an automation environment for the entire end-to-end release process so that every change to the application results in a releasable, security-validated version that is built automatically.

Assess

Evaluate your current processes, tools, and security posture.

Integrate

Embed security into your DevOps toolchain and workflows.

Automate

Automate security testing, compliance checks, and monitoring.

Monitor

Continuously monitor and detect threats across the lifecycle.

Improve

Continuously refine and improve security and DevOps practices.

Obsidian Global is an equal opportunity employer, that does not discriminate on the basis of race, color, creed, religion, sex, national origin, disability, age, genetic information or any other characteristic protected by law.