Roadmap for everyone who wants DevSecOps.

한글

📜 Table of Contents

• Roadmap
• Tools
• Resources
  • 1. Design
  • 2. Develop
  • 3. Build
  • 4. Test
  • 5. Deploy
  • 6. Operate and Monitor
• Other roadmaps
• Wrap Up
• Contributors
• Contribute

💭 Roadmap

🔩 Tools

Spending a lot of time on applying DevSecOps is searching, comparing, and making decisions about tools. These tool lists are a good way to help you reduce unnecessary time and apply them quickly 😎

Open https://github.com/hahwul/DevSecOps/blob/main/tools/README.md

📦 Resources

1. Design

• Development Lifecycle
  1. SDL(Secure Development Lifecycle) by Microsoft
• Threat Model
  1. What is Threat Modeling / Wikipedia
  2. Threat Modeling by OWASP
  3. Application Threat Modeling by OWASP
  4. Agile Threat Modeling Toolkit
  5. OWASP Threat Dragon

2. Develop

• Secure Coding
  1. Secure coding guide by Apple
  2. Secure Coding Guidelines for Java SE
  3. Go-SCP / Go programming language secure coding practices guide
  4. Android App security best practices by Google
  5. Securing Rails Applications

3. Build

• SAST(Static Application Security Testing)
  1. Scan Source Code using Static Application Security Testing (SAST) with SonarQube, Part 1
  2. Announcing third-party code scanning tools: static analysis & developer security training

4. Test

• DAST(Dynamic Application Security Testing)
  1. Dynamic Application Security Testing with ZAP and GitHub Actions
  2. Dynamic Application Security Testing (DAST) in Gitlab
  3. DAST using pdiscoveryio Nuclei (github action)
• Penetration testing

5. Deploy

• Security Hardening & Config
  1. CIS Benchmarks
• Security Scanning

6. Operate and Monitor

• RASP(Run-time Application Security Protection)
  1. Runtime Application Self-Protection by rapid7
  2. Jumpstarting your devsecops - Pipeline with IAST and RASP
• Security Patch
• Security Audit
• Security Monitor
• Security Analysis

🚀 Other roadmaps

U.S. Department of Defense	Larry Maccherone
The DevSecOps Security Checklist

🙏🏼 Wrap Up

If you think the roadmap can be improved, please do open a PR with any updates and submit any issues. Also, I will continue to improve this, so you might want to star this repository to revisit.

Idea from : Go Developer Roadmap

Contributors