DevSecOps
147 items from taptuit/awesome-devsecops ★1,746
-
DevSecOps Podcast Series soundcloud.com
OWASP - Discussions with thought leaders and practitioners to integrate security into the development lifecycle.
-
Snyk Open Source snyk.io
Snyk - Automated vulnerable dependency monitoring and upgrades using Snyk's dedicated vulnerability database.
-
Snyk Container snyk.io
Snyk - Scan Docker and Kubernetes applications for security vulnerabilities during CI/CD or via continuous monitoring.
-
DevSecOps Hub snyk.io
Snyk - Introduction to key DevSecOps concepts, processes and technologies.
-
Sigstore sigstore.dev
sigstore is a set of free to use and open source tools, including fulcio, cosign and rekor, handling digital signing, verification and checks for provenance needed to make it safer to distribute and use open source software.
-
SD Elements securitycompass.com
Security Compass - Identify and rank threats, generate actionable tasks and track related tickets.
-
SecureFlag secureflag.com
OWASP - Hands-on secure coding training for Developers and Build/Release Engineers.
-
Secure Code Warrior securecodewarrior.com
Secure Code Warrior - Gamified and hands-on secure development training with support for courses, assessments and tournaments.
-
CredScan secdevtools.azurewebsites.net
Microsoft - A credential scanning tool that can be run as a task in Azure DevOps pipelines.
-
SANS - A poster containing the Securing Web Application Technologies (SWAT) Checklist, SANS Cloud Security Curriculum, Cloud Security Top 10, Top 12 Kubernetes Threats, and Secure DevOps Toolchain.
-
Fundamental Practices for Secure Software Development safecode.org
SAFECode - Guidelines for implementing key secure development practices throughout the SDLC.
-
Requires.io requires.io
Olivier Mansion & Alexis Tabary - Automated vulnerable dependency monitoring and upgrades for Python projects.
-
Renovate renovate.whitesourcesoftware.com
WhiteSource - Automatically monitor and update software dependencies for multiple frameworks and languages using a CLI or git repository apps.
-
Practical DevSecOps practical-devsecops.com
Practical DevSecOps - Learn DevSecOps concepts, tools, and techniques from industry experts with practical DevSecOps using state of the art browser-based labs.
-
BurpSuite Enterprise Edition portswigger.net
PortSwigger - BurpSuite's web application vulnerability scanner used widely by penetration testers, modified with CI/CD integration and continuous monitoring over multiple web applications.
-
Application Security Podcast podcast.securityjourney.com
Security Journey - Interviews with industry experts about specific application security concepts.
-
Pentest-Ground pentest-ground.com
Pentest-Tools.com - Pentest-Ground is a free playground with deliberately vulnerable web applications and network services.
-
Our Approach to Employee Security Training pagerduty.com
Pager Duty - Guidelines to running security training within an organisation.
-
Vulnerable Web Apps Directory owasp.org
OWASP - A collection of vulnerable web applications for learning purposes.
-
Threat Dragon owasp.org
OWASP - Threat model diagramming tool.
-
Proactive Controls owasp.org
OWASP - OWASP's list of top ten controls that should be implemented in every software development project.
-
Dependency-Check owasp.org
OWASP - Scans dependencies for publicly disclosed vulnerabilities using CLI or build server plugins.
-
Secure Coding Practices Quick Reference Guide owasp.org
OWASP - A checklist to verify that secure development standards have been followed.
-
Nightfall nightfall.ai
Nightfall - A web-based platform that monitors for sensitive data disclosure across several SDLC tools, including GitHub repositories.
-
The Secure Developer mydevsecops.io
Snyk - Discussion about security tools and best practices for software developers.
-
Threat Modelling Tool microsoft.com
Microsoft - Threat model diagramming tool.
-
Secure Development Lifecycle microsoft.com
Microsoft - A collection of tools and practices that serve as a framework for the secure development lifecycle.
-
Kubescape kubescape.io
Cloud Native Computing Foundation - An open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters.
-
SecureFlag Knowledge Base knowledge-base.secureflag.com
OWASP - A repository of information about software vulnerabilities and how to prevent them.
-
JFrog XRay jfrog.com
JFrog - Security and compliance analysis for artifacts stored in JFrog Artifactory.
-
IriusRisk iriusrisk.com
IriusRisk - Draw threat models and capture threats and countermeasures and manage risk.
-
SecuriCAD foreseeti.com
Forseeti - Treat modelling and attack simulations for IT infrastructure.
-
NPM Audit docs.npmjs.com
NPM - Vulnerable package auditing for node packages built into the npm CLI.
-
Docker Secrets docs.docker.com
Docker - Store and manage access to secrets within a Docker swarm.
-
Ansible Vault docs.ansible.com
Ansible - Securely store secrets within Ansible pipelines.
-
Deep Dive discotek.ca
Discotek.ca - Static analysis for JVM deployment units including Ear, War, Jar and APK.
-
DevSecCon devseccon.com
Snyk - A community that runs conferences, a blog, a podcast and a Discord dedicated to DevSecOps.
-
Dependency-Track dependencytrack.org
OWASP - Monitor the volume and severity of vulnerable dependencies across multiple projects over time.
-
CyberArk Application Access Manager cyberark.com
CyberArk - Secrets management for applications including secret rotation and auditing.
-
Secure Software Development Framework csrc.nist.gov
NIST - A framework consisting of practices, tasks and implementation examples for a secure development lifecycle.
-
Csper csper.io
Csper - A set of Content Security Policy tools that can test policies, monitor CSP reports and provide metrics and alerts.
-
Google Cloud Key Management Service (KMS) cloud.google.com
Google Cloud Platform - Securely store secrets within GCP.
-
Building Security In Maturity Model (BSIMM) bsimm.com
Synopsys - A framework for software security created by observing and analysing data from leading software security initiatives.
-
BeerSecOps blog.aquasec.com
Aqua Security - Breaking down the silos of Dev, Sec and Ops, discussing topics that span these subject areas.
-
Azure Key Vault azure.microsoft.com
Microsoft Azure - Securely store secrets within Azure.
-
AWS Secrets Manager aws.amazon.com
Amazon AWS - Securely store retrievable application secrets in AWS.
-
AppSec Day appsecday.io
OWASP - An Australian application security conference run by OWASP.
-
Semgrep Academy academy.semgrep.dev
Semgrep - Free, on-demand courses covering topics including API security, secure coding and application security.
-
SafeStack academy.safestack.io
SafeStack - Security training for software development teams, designed to be accessible to individuals and small teams as well as larger organisations.
-
Absolute AppSec absoluteappsec.com
Seth Law & Ken Johnson - Discussions about current events and specific topics related to application security.
