کتاب امنیت به عنوان کد

مقدمه‌ای بر DevSecOps

Before DevOps: The Software Development Life Cycle • What Is DevSecOps? • Introducing Automatoonz • Cloud Infrastructure: Secure by Default • Move Fast, Secure Fast: The Importance of Automation • DevSecOps Culture • Summary

راه‌اندازی محیط شما

What You'll Need • Installing and Verifying Your Setup • Installing the AWS CLI • Installing the Docker Engine • Checking Your Python Version • Installing Git • Installing Kubernetes • Creating Your First Bare-Bones Pipeline • Summary

امن‌سازی زیرساخت شما

What Makes Infrastructure Secure? • Hands Off! Preventing Unwanted Access with IAM Permissions • Detecting Misconfigurations • Identifying a Standard • Threat Modeling • Security Controls • Better Than a Cure: Implementing Preventive Controls • Implementation • Summary

لاگ‌گیری و نظارت

What Are Logging and Monitoring—and Why Do They Matter? • Attack Styles • Advanced Persistent Threat Attacks • Ransomware Strains • Passive and Active Attacks • Log Types • Log Storage • Detecting Anomalies • Remediation with AWS Config • Correlating User Activity with CloudTrail • Network Monitoring with an Amazon VPC • Summary

کنترل دسترسی از طریق خودکارسازی

The Principle of Least Privilege • Fine-Tuning Access Controls • Use a Tagging System • Clarify Team Responsibilities • Prevent and Detect • The IAM Pipeline • Summary

تست تزریق خطا

Distributed Systems • Adaptive Security Controls • The True Cost of Downtime • Methods for Minimizing Downtime • Chaos Engineering • Basic Principles • Advanced Principles • Chaos Engineering in AWS Environments • Chaos Engineering at Automatoonz • AWS Fault Injection Simulator Experiment Examples • Kubernetes Pod Stress Testing • Throttling EC2 API Calls • Stress Testing the CPU on an EC2 Instance • Terminating an EC2 Instance • Removing Ingress and Egress Rules from a Security Group • Detaching an EBS Volume from an EC2 Instance • Summary

افراد و فرآیندها

People: Team Structures and Roles • Security Engineers • Developers • Compliance Team • Product Manager • Team Structure • Processes: Practices and Communication • Communicate to the Right People, Consistently • Make Product Owners Accountable for Their Security Findings • Build Threat Modeling into Your Processes • Build Roadmaps to Reach Your DevSecOps Goals • What Next? • Summary