Implementing Devsecops Practices Pdf — Upd

Moving security testing earlier in the software development lifecycle (SDLC).

name: DevSecOps Pipeline on: [push]

| Category | Popular Tools | Key Use | |----------|---------------|---------| | SAST | SonarQube, Checkmarx, Semgrep, CodeQL | Find bugs & vulns in source code | | SCA | Snyk, OWASP Dependency-Check, JFrog Xray | Detect vulnerable open-source components | | DAST | OWASP ZAP, Burp Suite, Nikto | Web app runtime testing | | Container security | Trivy, Clair, Aqua Security | Scan images & registries | | Secrets detection | GitLeaks, TruffleHog, detect-secrets | Prevent secrets in code | | IaC scanning | Checkov, tfsec, Terrascan | Misconfigurations in cloud templates | | Pipeline integration | Jenkins, GitLab CI, GitHub Actions, Azure DevOps | Automate all of the above | implementing devsecops practices pdf