Research on Railway DevSecOps System Construction Based on “People-Process-Technology”

With the continuous development of railway business, the architecture of railway application software has become more and more complex, and the security threats faced by it have become increasingly severe. In order to repair the security vulnerabilities exposed by the application software, the railway software R&D enterprises have to respond passively after the software is put into operation and maintenance, which increases the cost in the software life cycle. Many organizations try to introduce the DevSecOps concept to shift software security to the left, so as to solve security problems in the R&D process, but pay more attention to relevant technical tools or processes. Based on the characteristics of railway enterprises, this research designed an enterprise R&D team structure, divided the technical tools supporting R&D into four domains, standardized the process system integrating safety detection and protection, formed a railway DevSecOps system based on “people-process-technology“, and achieved good results in the R&D practice of railway application software.