Skip to content

awesome-devsecops-learning-resources.md

Latest commit

 

History

History
168 lines (147 loc) · 14.2 KB

awesome-devsecops-learning-resources.md

File metadata and controls

168 lines (147 loc) · 14.2 KB
Raw

Awesome DevSecOps Learning Resources

DevSecOps learning resources

ToC

  1. Books
  2. Videos
  3. Free/Paid Courses
  4. Free/Paid Labs
  5. DevSecOps Tools
  6. DevSecOps Certifications
  7. Blogs/Articles

Books

Here are some DevSecOps learning resources to help you become a skilled DevSecOps engineer. They will boost your confidence in this domain, and you will be ready to explore further.

  1. The Phoenix Project by Gene Kim — A novel that illustrates how DevOps principles can transform IT operations and business performance. I would highly recommend this book to every IT professional specially Developers, QA, Infra engineers, DevOps, and security folks.
  2. Learning DevSecOps — A practical guide to integrating security into DevOps pipelines to deliver secure software faster. Quite a new release (published in May 2024)
  3. Securing DevOps: Securing in the cloud - It explores modern DevOps security techniques and tools to secure cloud environments. It is one of the books that I have read in the past.
  4. Security in DevOps by PackT — Comprehensive strategies for embedding security into DevOps workflows.
  5. Agile Application Security — A guide to building secure applications with agile methodologies. Being a DevSecOps engineer, you should have a fair idea of AppSec.

Videos

  1. DevSecOps Explained in 5 Minutes
  2. DevSecOps - What, Why and How by Anant Shrivastava (Null)
  3. DevSecCon talks (official channel)
  4. All Day DevOps - Security track archives
  5. Shifting left on security - OWASP AppSec talks
  6. DevSecOps at scale - Netflix / Shopify / GitHub engineering talks

Free/Paid Courses

  1. DevSecOps Fundamentals on Udemy - A beginner’s course on understanding and implementing DevSecOps practices in software development.
  2. DevSecOps for Absolute Beginners - An introductory course for those new to DevSecOps, covering key concepts and tools.
  3. DevSecOps by KodeCloud - A practical course on mastering DevSecOps tools and methodologies with hands-on labs. You should try it.

Free/Paid DevSecOps Labs

  1. DevSecOps Integra project
  2. DevSec Hardening project - Ansible/Chef/Puppet baselines for Linux/Windows hardening.
  3. DevSecOps Playbook - Widely-shared playbook (note: Vermava fork may be outdated).
  4. DevSecOps Bootcamp
  5. Practical DevSecOps - free labs (require signup)
  6. Vulnerable Pipeline / AWSGoat / IaCGoat - INE Labs' intentionally vulnerable CI/CD and IaC.
  7. OWASP WrongSecrets - Hands-on secrets-management lab.

DevSecOps Certifications

  1. CDP by Practical DevSecOps — Certified DevSecOps Professional, a hands-on certification focused on applying security in DevOps practices. I had given my feedback after this examination in 2020
  2. DevSecOps Essentials by EC-Council — A foundational certification covering essential skills and knowledge for implementing security in DevOps.
  3. E|CDE by EC-Council — EC-Council Certified DevSecOps Engineer, designed for professionals aiming to integrate security into DevOps environments.

Blogs/Articles

Blog, articles, and other relevant learning resources

  1. DevSecOps University by Practical DevSecOps
  2. OWASP DevSecOps Maturity Model (DSOMM)
  3. OWASP DevSecOps Guideline
  4. OWASP CI/CD Security Top 10
  5. SLSA - Supply-chain Levels for Software Artifacts
  6. Introduction to DevSecOps - DZone refcard
  7. Google SRE - Building Secure and Reliable Systems (free book)
  8. NIST SP 800-218 - Secure Software Development Framework (SSDF)
  9. NSA/CISA - Securing the Software Supply Chain series
  10. Sigstore - keyless signing
  11. Shifting left vs shifting everywhere (Maya Kaczorowski)
  12. Boring AppSec newsletter
  13. SolarWinds, Codecov, 3CX - supply-chain attack post-mortems (read all of them)

DevSecOps Tools

DevSecOps tools can be categorised into several groups based on their functionality.

These categories include:

Static Application Security Testing (SAST) Tools

  1. SonarQube: Static code analysis tool supporting multiple programming languages.
  2. Bandit: A security linter for Python.
  3. Brakeman: Security scanner for Ruby on Rails applications.
  4. SpotBugs + find-sec-bugs plugin: Static analysis tool to find security vulnerabilities in Java code.
  5. Semgrep: Lightweight static analysis tool supporting multiple languages and frameworks.
  6. CodeQL by GitHub: Semantic code analysis, free for open source.
  7. Coverity (Black Duck): Comprehensive commercial SAST.
  8. Checkmarx One / Veracode / Snyk Code: Commercial SAST options.
  9. gosec: Go security checker.
  10. njsscan / nodejsscan: Node.js SAST.

Secrets Scanning Tools

  1. git-secrets: Detects secrets in git commits and prevents them from being included.
  2. TruffleHog: Finds and verifies secrets in git history, files, cloud, chats.
  3. gitleaks: Fast SAST secrets scanner.
  4. detect-secrets by Yelp: Baseline-driven secrets detection.
  5. Talisman: Pre-commit hook for secrets.
  6. Whispers: Structured-config secrets scanner.
  7. GitGuardian: Commercial secrets scanning at scale.

Secrets Management Tools

  1. HashiCorp Vault
  2. CyberArk Conjur
  3. AWS Secrets Manager / AWS SSM Parameter Store
  4. Azure Key Vault
  5. Google Cloud Secret Manager
  6. Doppler, Infisical, 1Password Secrets Automation
  7. External Secrets Operator (Kubernetes)
  8. SOPS by Mozilla: Encrypted files for GitOps.

Dynamic Application Security Testing (DAST) Tools

  1. OWASP ZAP: Open-source web application scanner; supports automation and API scanning.
  2. Nuclei: Template-based fast scanner; widely used in CI.
  3. Nikto: Web server scanner.
  4. Burp Suite (Community / Professional / Enterprise): Industry-standard web/API testing.
  5. Arachni (maintenance mode): Still usable but not actively maintained.
  6. StackHawk: DAST tuned for CI/CD pipelines.
  7. Akto, Levo.ai, 42Crunch: API-centric DAST.

Software Composition Analysis (SCA) Tools

  1. Snyk: Security platform that scans open-source dependencies for known vulnerabilities.
  2. OWASP Dependency-Check: Open-source tool to identify publicly disclosed vulnerabilities in dependencies.
  3. Dependabot: Automatically checks dependencies for vulnerabilities and sends pull requests to update them.
  4. Retire.js: Scanner that helps identify known vulnerabilities in JavaScript libraries.
  5. npm audit: Security audit tool for Node.js applications, focusing on package vulnerabilities.

Container Security Tools

See also the dedicated Container Security learning resources.

  1. Trivy: Comprehensive vulnerability scanner for containers, Kubernetes, IaC, filesystem and git repos.
  2. Grype + Syft by Anchore: Vulnerability scanner + SBOM generator.
  3. Clair: Static analysis of vulnerabilities in containers (used by Quay).
  4. Checkov: IaC + Dockerfile + K8s YAML static analysis.
  5. Docker Scout: Built-in scanning.
  6. Kube-bench: CIS Kubernetes Benchmark scanner.
  7. kube-hunter: Kubernetes penetration scanner.
  8. Kubesec: Scans YAML for risky settings.
  9. Hadolint and Dockle: Dockerfile/image linters.
  10. Falco (CNCF): Runtime threat detection.
  11. Cortex Cloud by Palo Alto Networks (formerly Prisma Cloud / Twistlock, rebranded Feb 2025): Commercial CWPP/CNAPP.

Infrastructure as Code (IaC) Security Tools

  1. Checkov by Bridgecrew/Prisma: Terraform, CloudFormation, Kubernetes, Dockerfile, ARM, Bicep, Serverless.
  2. KICS by Checkmarx: Open-source IaC scanner.
  3. tfsec (now part of Trivy): Terraform-specific.
  4. Terrascan by Tenable: Multi-IaC static analyzer.
  5. TFLint: Terraform linter with security rules via plugins.
  6. Prowler: AWS/Azure/GCP/K8s posture scanner.
  7. ScoutSuite: Multi-cloud security auditing.
  8. cfn-nag: AWS CloudFormation linter.
  9. OPA Conftest: Policy-as-code for any config format.

Compliance and Governance Tools

Think of policy as code and compliance as code from a DevOps and DevSecOps perspective.

  1. Chef InSpec: Framework for defining and testing security/compliance policies as code.
  2. Open Policy Agent (OPA): General-purpose policy engine for enforcing policies across the stack.
  3. HashiCorp Sentinel: Policy-as-code for HashiCorp products.
  4. AWS Config / Azure Policy / GCP Organization Policy.
  5. OpenSCAP: Auditing compliance with SCAP standards.
  6. Kyverno / Gatekeeper (OPA): Kubernetes admission policy.
  7. Cloud Custodian: Rules engine for multi-cloud governance.

Security Dashboard and Analytics Tools

  1. DefectDojo: Open-source application vulnerability management (ASOC/ASPM).
  2. OWASP Dependency-Track: Continuous SBOM + vulnerability monitoring.
  3. Faraday: Collaborative pentest/vulnerability management.
  4. ArcherySec: Open-source vuln assessment & management.
  5. JFrog Xray: Universal component analysis (vulns + licenses).
  6. ELK / OpenSearch / Grafana Loki: Centralized logging and analytics.

Software Supply Chain / SBOM / Signing

  1. Sigstore (cosign, rekor, fulcio): Keyless artifact signing.
  2. SLSA framework: Supply-chain integrity levels.
  3. in-toto: Supply-chain attestations.
  4. Syft / CycloneDX CLI / SPDX tools: SBOM generation.
  5. Dependency-Track: SBOM consumption and monitoring.
  6. GUAC by OpenSSF: Graph for Understanding Artifact Composition.
  7. Scorecards by OpenSSF: Security posture of OSS projects.