Integrate Shift-Left Security, automation, IaC, and compliance into every stage of development, ensuring strong application security and continuous protection for modern software with DevSecOps best practices
Key Features
Understand security posture management to maintain a resilient operational environment
Master DevOps security and blend it with software engineering to create robust security protocols
Adopt the left-shift approach to integrate early-stage security in DevSecOps
Purchase of the print or Kindle book includes a free PDF eBook
Book DescriptionDevSecOps is built on the idea that everyone is responsible for security, with the goal of safely distributing security decisions at speed and scale to those who hold the highest level of context. This practice of integrating security into every stage of the development process helps improve both the security and overall quality of the software. This book will help you get to grips with DevSecOps and show you how to implement it, starting with a brief introduction to DevOps, DevSecOps, and their underlying principles.
After understanding the principles, you'll dig deeper into different topics concerning application security and secure coding before learning about the secure development lifecycle and how to perform threat modeling properly. You'll also explore a range of tools available for these tasks, as well as best practices for developing secure code and embedding security and policy into your application. Finally, you'll look at automation and infrastructure security with a focus on continuous security testing, infrastructure as code (IaC), protecting DevOps tools, and learning about the software supply chain.
By the end of this book, you'll know how to apply application security, safe coding, and DevSecOps practices in your development pipeline to create robust security protocols.What you will learn
Find out how DevSecOps unifies security and DevOps, bridging a significant cybersecurity gap
Discover how CI/CD pipelines can incorporate security checks for automatic vulnerability detection
Understand why threat modeling is indispensable for early vulnerability identification and action
Explore chaos engineering tests to monitor how systems perform in chaotic security scenarios
Find out how SAST pre-checks code and how DAST finds live-app vulnerabilities during runtime
Perform real-time monitoring via observability and its criticality for security management
Who this book is forThis book is for individuals new to DevSecOps and want to implement its practices successfully and efficiently. DevSecOps Engineers, Application Security Engineers, Developers, Pentesters, and Security Analysts will find plenty of useful information in this book. Prior knowledge of the software development process and programming logic is beneficial, but not mandatory.
Sprache
Verlagsort
Maße
Höhe: 235 mm
Breite: 191 mm
Dicke: 14 mm
Gewicht
ISBN-13
978-1-80323-149-5 (9781803231495)
Copyright in bibliographic data and cover images is held by Nielsen Book Services Limited or by the publishers or by their respective licensors: all rights reserved.
Schweitzer Klassifikation
Vandana Verma Sehgal is a seasoned cybersecurity professional with over 17 years of experience. She specializes in DevSecOps and has a diverse background in vulnerability management, SOC, infrastructure, application, and cloud security. She is a speaker and trainer, having presented at events like Global OWASP AppSec, BlackHat, and Grace Hopper. Vandana actively contributes to the cybersecurity community as a member of the OWASP Global Board of Directors and Black Hat Asia Review Board and is deeply involved in diversity initiatives like InfosecGirls, WoSec, and null. She has earned numerous awards, including Cyber Security Woman of the Year 2020 and Application Security Influencer 2020 in India. Her passion for diversity and inclusion drives initiatives like InfosecGirls, WoSec, and InfosecKids, inspiring and empowering the next generation of security professionals.
Table of Contents
Introducing DevSecOps
DevSecOps Principles
Understanding the Security Posture
Understanding Observability
Understanding Chaos Engineering
Continuous Integration and Continuous Deployment
Threat Modeling
Software Composition Analysis (SCA)
Static Application Security Testing (SAST)
Infrastructure-as-Code (IaC) Scanning
Dynamic Application Security Testing (DAST)
Setting Up a DevSecOps Program with Open Source Tools
Licenses Compliance, Code Coverage, and Baseline Policies
Setting Up a Security Champions Program
Case Studies
Conclusion
