Skip to content
Techstream

Techstream DevSecOps Series

How regulated platforms ship, written while doing the work. Nothing to buy yet.

§ 01, The volumes

  1. Vol. I

    DevSecOps: Foundations & Transformation

    Shift-left culture, the DevSecOps Maturity Model and security extensions to the DORA metrics

    In writing
  2. Vol. II

    Securing CI/CD & the Software Supply Chain

    SLSA, SBOM, Sigstore and the pipelines attackers target most

    In writing
  3. Vol. III

    Cloud-Native Security for DevSecOps

    Zero trust, Kubernetes hardening, IaC security and compliance automation

    In writing
  4. Vol. IV

    Release Engineering & DevSecOps Governance

    Progressive delivery, GitOps, the DORA metrics at scale and framework governance

    In writing
  5. Vol. V

    AI and Agentic Systems Security for DevSecOps

    LLM threats, agent authorisation, prompt-injection defence and the OWASP LLM Top 10

    In writing
  6. Vol. VI

    DevSecOps Forensics & Incident Response

    Evidence architecture, investigation playbooks and AI-agent forensics

    In writing

§ 02, From the manuscript

Scrolls sideways →

Incident response timelineT+0deployevidencedeploy logT+2hanomalyevidencenetflow spikeT+4hdetectionevidenceIDS alertT+6hcontainmentevidencefirewall ruleT+24hrecoveryevidenceRCA reportchain of custodyPrepareplan, runbooksDetect, analyseSIEM, EDR, logsContain, eradicateisolate, patchRecover, reviewrestore, lessonsForensic toolkitmemory, disk image, pcap, audit logLegal and compliancenotification window · evidence hold
An incident timeline with the evidence at each step, from the Volume VI manuscript.
LevelWhat the build must doThe control that proves it
Build L0No guaranteesNothing is required of the build.None. There is no provenance to check.
Build L1Provenance existsThe build runs from a script, and provenance is generated that says how the artifact was built.The provenance document, published with the artifact.
Build L2Hosted build platformThe build runs on a hosted platform, which signs the provenance it generates.The signature, verified against the platform's key before deploy.
Build L3Hardened build platformThe platform isolates each build in an ephemeral environment and keeps the signing material out of reach of the build steps.Provenance a tenant cannot forge; a policy check at deploy that refuses anything else.
SLSA level advancement path, Volume II.

§ 03, When it's readable

I’m writing it. Want to know when the first volume is readable?

One email when it's readable.