Extensive Review of Threat Models for DevSecOps

Amidst the rising tide of cyber threats, the software industry is gravitating toward the widespread adoption of DevSecOps as a crucial defense strategy. In response to the evolving application development needs, DevSecOps enables developers and enterprises to seamlessly integrate security and, fortify digital realms against modern cybersecurity challenges. This study attempts to identify and review various threat models that can be combined with components of DevSecOps, such as its principles, methodology, tools, and workflows. Underscoring the necessity of early security considerations in the software development life cycle, the discussion then delves into the details of adaptable strategies and best practices to mitigate potential threats proactively, while also emphasizing the pivotal role of monitoring and incident response in the prompt detection and mitigation of potential risks. Moreover, this study focuses on identifying the challenges associated with adopting traditional threat models in the contemporary landscape of multi-cloud architecture, a prevalent paradigm in current technological landscapes. Recognizing the intricacies of securing applications across diverse cloud environments, this scholarly work proposes a layered framework for multi-cloud, which can be adopted by practitioners to address the security challenges of the multi-cloud environment. Hence, this investigation furnishes valuable insights into the requirements, workflow and threat models of DevSecOps in single-cloud and emerging multi-cloud environment.