Continuous Integration and Continuous Delivery (CI/CD)

  1. Security in CI/CD (DevSecOps)
    1. DevSecOps Principles
      1. Shifting Security Left
        1. Integrating Security Early
          1. Developer Security Training
            1. Security as Code
            2. Security Automation
              1. Automated Security Testing
                1. Security Policy Enforcement
                  1. Compliance Automation
                  2. Continuous Security Monitoring
                    1. Runtime Security
                      1. Threat Detection
                        1. Incident Response
                      2. Security Testing in Pipelines
                        1. Static Application Security Testing
                          1. Source Code Scanning
                            1. Integration with CI/CD
                              1. SAST Tools and Configuration
                              2. Dynamic Application Security Testing
                                1. Runtime Vulnerability Detection
                                  1. DAST Tools and Integration
                                    1. API Security Testing
                                    2. Software Composition Analysis
                                      1. Dependency Vulnerability Scanning
                                        1. License Compliance
                                          1. Supply Chain Security
                                          2. Infrastructure Security Testing
                                            1. Infrastructure as Code Scanning
                                              1. Container Image Scanning
                                                1. Cloud Configuration Assessment
                                              2. Secret Management
                                                1. Secret Management Principles
                                                  1. Least Privilege Access
                                                    1. Secret Rotation
                                                      1. Audit and Compliance
                                                      2. Secret Storage Solutions
                                                        1. HashiCorp Vault
                                                          1. AWS Secrets Manager
                                                            1. Azure Key Vault
                                                              1. Kubernetes Secrets
                                                              2. Secret Management in Pipelines
                                                                1. Secure Secret Injection
                                                                  1. Environment-Specific Secrets
                                                                    1. Secret Scanning in Code
                                                                  2. Pipeline Security
                                                                    1. Pipeline Access Control
                                                                      1. Authentication and Authorization
                                                                        1. Role-Based Access Control
                                                                          1. Audit Logging
                                                                          2. Secure Pipeline Configuration
                                                                            1. Pipeline Hardening
                                                                              1. Resource Isolation
                                                                                1. Network Security
                                                                                2. Supply Chain Security
                                                                                  1. Dependency Management
                                                                                    1. Build Environment Security
                                                                                      1. Artifact Integrity

                                                                                  Previous

                                                                                  7. Infrastructure and Tooling

                                                                                  Go to top

                                                                                  Next

                                                                                  9. Monitoring and Observability