What this book covers
Chapter 1, Agile, DevOps, and Azure Overview, will introduce the working definition of DevOps that we will use for the rest of the book. We will discuss the stages in a DevOps workflow and the five core DevOps implementation practices. We will also explain the relationship between Agile, DevOps, and cloud; the security challenges of implementing DevOps; and how organizations can start to address those challenges.
Chapter 2, Security Challenges of the DevOps Workflow, will explore the unique security risks and threats that arise from implementing DevOps practices. We will examine how organizations can begin to address these challenges effectively.
Chapter 3, Implementing Security in the Plan Phase of DevOps, covers how the PLAN phase of DevOps focuses on gathering requirements and feedback from key stakeholders and customers, producing an evolving product roadmap that prioritizes key requirements, and designing a flexible software architecture. Implementing DevSecOps for this phase should focus on security challenges that can be addressed before the developers start writing code! Activities in this phase should include implementing an agile threat modeling process to identify design-level security issues earlier; and implementing security training for your teams. In this chapter, we will cover what works when looking to implement a continuous threat modeling process. We will also discuss the different maturity levels of a secure code-to-cloud training program.
Chapter 4, Implementing Pre-commit Security Controls, will focus on security measures and checks that can be implemented before code changes are committed to a version control system by developers. This includes implementing security controls to reduce development environment risks, and setting up security safeguards to identify and fix vulnerabilities and common mistakes before code is committed to the local code repository.
Chapter 5, Implementing Source Control Security, examines how source control in DevOps is a way to organize and track the code for a project using a source control management (SCM) system such as Git or Team Foundation Version Control (TFVC). When implementing DevSecOps in source control, it is important to consider how the code repository is managed and secured. If access to the code repository is compromised or protections can be easily bypassed, it is hard to trust the code stored in it. To keep the code repository safe, we should implement a code-signing process to verify the authenticity of code changes. We should also protect sensitive branches and implement security controls.
Chapter 6, Implementing Security in the Build Phase of DevOps, will focus on understanding the continuous build phase of DevOps, securing CI environments and processes, hardening the build process to enhance security, and integrating SAST, SCA, and secret scanning into the build process.
Chapter 7, Implementing Security in the Test and Release Phases of DevOps, will focus on ensuring that release artifacts are built from protected branches, implementing a code review process, selecting a secure artifact source, and validating artifact integrity. Additionally, we will cover managing secrets securely in the release phase, implementing Infrastructure-as-Code security scans, and validating and enforcing runtime security with release gates.
Chapter 8, Continuous Security Monitoring on Azure, will focus on understanding continuous monitoring in DevOps, implementing runtime guardrails in Azure, and preventing, detecting, and remediating application risks at runtime.
