DevSecOps playbook

The DevSecOps playbook provides enterprise software engineers with solutions, capabilities, and code developed to solve real-world problems.

Secure Software Supply Chain

Concept

• Securing Kubernetes release artifacts and workload integrity
• Considerations for building a secure software supply chain

Architecture

• Logical architecture
• Notation-based secure software supply chain for AKS

Improving secrets management

Concept

• Strengthening security by optimizing the secrets management lifecycle
• Practical advice for securing secrets across the SDLC
• Benefits and integration of managed identities
• Understanding the secrets management lifecycle

Infrastructure as Code (IaC)

Architecture

• Reduce errors, improve consistency, and deploy with confidence using codified IaC best practices

Concept

• IaC best practices for Cloud infrastructure provisioning
• Infrastructure as Code testing
• Policy as code

Security engineering

Concept

• Attestations
• Artifact scanning
• Digital signatures
• Software Composition Analysis

For more information about DevSecOps

Concept

• Azure DevOps
• Microsoft Security Engineering
• OWASP DevSecOps Maturity Model
• Lean Security
• DevSecOps - DoD Cyber Exchange