DevSecOps University
The comprehensive collection of DevSecOps Learning Resources like Books, Tutorials, Infographics, Tools and much more. Enjoy!
1. Git (Version Control System)
DevSecOps heavily relies on Everything as Code (EaC). A version control system (VCS) becomes the most important tool in our arsenal. Git is the most famous of VCS at the moment.
2. CI/CD (Continuous Integration and Delivery)
No matter, you are an Agile shop, DevOps shop or a Cloud-Native shop, continuous integration, continuous delivery and deployment are the cornerstones of modern software development. If you like to attack or defend such a system, you need to understand the basics of it.
3. Artifact management
Organizations deploy software to production but giving access to production deployable artifacts is not a good idea. All deployable software is maintained in a tightly controlled, audible and automatic repo management software also known as artifact management. Think it like a war, jar, zip, tar.gz storage platform.
4. Infrastructure as Code (Configuration management tools)
Speed is a competitive advantage and to achieve speed, agility, and performance, organizations are creating infrastructure like its software/code instead of bare metal hardware servers.
Recent advances in virtualisation and cloud computing enables us to accomplish Infrastructure as Code.
5. Cloud Service Provider-Platform
Modern software development needs an on-demand, elastic, automated and measurable platform to build software on. Knowing on-prem or a public cloud-based solution is a must these days.
DevSecOps Resources
Now that basics are taken care of, we can explore the meat of the DevSecOps resources.
- Threat modelling and Security Review
- Static Analysis (SAST)
- Dynamic Analysis (DAST)
- Security as Code
- Compliance as Code
Feeling overwhelmed? you might want to check out our DevSecOps courses to learn more with easy step by step instructions.
6. Threat Modeling
Threat modeling helps individuals and organisations in quantifying the security efforts.
7. Static Analysis Security Testing (SAST)
Static Security Analysis Testing, is a technique to analyse source code, binary and byte code for security vulnerabilities without running the code/binary/byte code.
Since the code is not run but statically examined, its called static analysis. SAST tools are great at finding vulnerabilities which are common to a language, well known security issues and grep’able patterns.
8. Dynamic Analysis Security Testing (DAST)
Dynamic Analysis Security Testing is a technique to analyze the running application for security vulnerabilities. Since an application is running and examined dynamically its called dynamic analysis.
The dynamic analysis doesn’t need someone to have lots of knowledge in intricacies of a programming language.
9. Security as Code
Speed is a competitive advantage and to achieve speed, agility, and performance, organizations are creating infrastructure like its software/code instead of bare metal hardware servers.
Recent advances in virtualisation and cloud computing enables us to accomplish Infrastructure as Code.
10. Compliance as Code
If hardening can be done using Infrastructure as Code tools, why can’t compliance be automated as code?
Contributors
This project wouldn’t be possible without sponsorship from Practical DevSecOps and efforts from Atul Singh and Joshua Jebaraj