8 items
SecurityEngineers do not need to memorise every control, but they need to know how to map controls to the pipeline and generate evidence automatically. This is a short guide to four common frameworks and compliance-as-code in DevSecOps.
Duy Tran11 min
SecurityA good production image is small, non-root, has no shell, is scanned and is signed. This article covers Docker/OCI image hardening techniques together with a Cosign keyless signing workflow using GitHub OIDC.
Duy Tran9 min
SecurityShift-left is not about dumping work on developers. It is about automating security controls close to where defects are introduced, so teams can fix fast and security becomes a default property of the system.
Duy Tran8 min
SecurityStrong defense needs three things: structured logs, ATT&CK-mapped detection rules and rehearsed IR runbooks. This article summarises how to build a detection-as-code program and blameless post-mortems for DevSecOps teams.
Duy Tran10 min
SecurityStatic image scanning will not catch abnormal behavior at runtime. Combine admission policies (Kyverno) to block non-compliant workloads with runtime monitors (Falco) to detect shell-in-container and lateral movement.
Duy Tran9 min
SecurityBefore talking about DAST, IAST or supply chain, every pipeline needs three basic layers: SAST for code, SCA for dependencies, secret scanning for keys/tokens. Here is how to set them up with Semgrep, Trivy and Gitleaks.
Duy Tran10 min
SecurityAfter xz, npm typosquats and build poisoning, supply chain attacks have become the most common vector. SLSA + SBOM + Sigstore is the open trio of standards that lets you prove where, how and by whom an artifact was built.
Duy Tran10 min
SecurityA threat model does not need to be a 50-page document. A 60-minute session with a level-1 DFD, STRIDE and a risk register is enough to avoid the design flaws that show up repeatedly in audits and pentests.
Duy Tran9 minNo results found