DevSecOps
35 items tagged with "devsecops"
Best Practices10
Supply-chain Levels for Software Artifacts (SLSA)
End-to-end integrity guarantees for software supply-chain; defines levels 1-4.
Infrastructure-as-Code Security Playbook
Best practices for securing Terraform, CloudFormation, and ARM templates in CI/CD pipelines.
OWASP Software Assurance Maturity Model (SAMM)
A maturity model that helps organizations assess and improve their software security program across governance, design, implementation, verification, and operations.
Microsoft Security Development Lifecycle (SDL)
A set of security practices integrated across every phase of software development, from training and design through implementation, verification, and response.
Sigstore Keyless Signing
An open standard for signing software artifacts using short-lived certificates tied to identity, removing the burden of managing long-lived private keys.
in-toto Supply Chain Attestation
A framework that secures the software supply chain by cryptographically verifying that each step in the build and release process was performed as intended.
Secrets Management Best Practices
Practices for storing, rotating, and accessing credentials and keys securely, keeping them out of source code and limiting their exposure.
Reproducible Builds
A set of practices ensuring a given source plus build environment always produces bit-for-bit identical binaries, so anyone can independently verify what shipped.
Pre-Commit Hooks Automation
Automating checks such as formatting, linting, and secret scanning that run on every Git commit, catching issues locally before they ever reach the shared repository.
Static Application Security Testing in CI
Integrating SAST tools into the CI pipeline to scan source code for security vulnerabilities automatically on every change.
Blueprints6
Secrets in Config to HashiCorp Vault Blueprint
Move plaintext secrets out of config files and environment variables into HashiCorp Vault with dynamic secrets, leasing, and rotation.
Static Secrets to Cloud Secrets Manager Blueprint
Migrate hard-coded and static secrets to a managed cloud secrets manager with IAM-scoped access, versioning, and automatic rotation.
Perimeter Security to Zero Trust Blueprint
Move from VPN and network-perimeter trust to a zero-trust architecture with identity-aware access, microsegmentation, and continuous verification.
No SBOM to Software Supply Chain Security Blueprint
Establish SBOM generation, artifact signing, and provenance attestation to meet SLSA and secure the software supply chain.
Manual Vulnerability Scanning to DevSecOps Pipeline Blueprint
Shift security left by embedding SAST, dependency, secret, and container scanning into automated CI/CD with policy gates.
Standing SSH Access to Just-in-Time Access Blueprint
Replace standing SSH keys and shared bastion logins with short-lived, identity-based just-in-time access, certificates, and full session audit.
Reference Architectures4
Zero-Trust Network Architecture on AWS
Identity-aware, least-privilege access design that authenticates and authorizes every request regardless of network location.
WAF and DDoS Edge Protection on Google Cloud
Edge security design combining a web application firewall, DDoS mitigation, and a CDN to protect public applications.
Centralized Secrets Management Platform
HashiCorp Vault-based platform for issuing, rotating, and auditing secrets and short-lived credentials across hybrid environments.
Cloud Security Posture Management
Continuous, agentless detection of misconfigurations and compliance drift across AWS, Azure, and GCP accounts.
Playbooks5
Cloud Governance Rollout Playbook
A phased program to establish guardrails, policy-as-code, and compliance automation across a growing multi-account cloud estate.
Zero-Trust Architecture Rollout Playbook
A phased program to adopt zero-trust security: verify every request, enforce least privilege, and remove implicit network trust.
DevSecOps Program Playbook
A program to embed security into the software lifecycle with shift-left scanning, secure pipelines, and shared ownership between dev, sec, and ops.
Secrets Management Program Playbook
A program to eliminate hardcoded secrets and adopt centralized, rotated, least-privilege secret storage with dynamic and short-lived credentials.
Software Supply Chain Security Program Playbook
A program to secure the build-to-deploy pipeline with SBOMs, artifact signing, provenance attestation, and SLSA-aligned controls.
Checklists9
Container Security Hardening Checklist
Harden container images, build pipelines, and runtime so containerized workloads resist compromise and supply-chain attacks.
Cloud Network Security Review Checklist
Audit a cloud network's segmentation, access controls, and exposure to reduce the blast radius of a compromise.
CI/CD Pipeline Review Checklist
A structured review of a continuous integration and delivery pipeline for correctness, speed, security, and reproducibility.
Security Hardening Checklist
Reduce the attack surface of an application and its infrastructure across identity, network, runtime, and supply chain.
Secrets Management Audit Checklist
Audit how an organization stores, distributes, rotates, and revokes secrets such as keys, tokens, and credentials.
SBOM & Supply-Chain Security Review Checklist
Verify software supply-chain integrity through SBOM generation, dependency provenance, build integrity, and artifact signing.
Zero-Trust Readiness Checklist
Assess readiness to adopt a zero-trust architecture where no user, device, or network is implicitly trusted.
SOC 2 & ISO 27001 Evidence Readiness Checklist
Prepare the controls and evidence needed for a SOC 2 or ISO 27001 audit across access, change management, and monitoring.
AI Red-Team Checklist
Adversarial test items for probing an LLM or AI application for prompt injection, jailbreaks, data leakage, and unsafe behavior.