Techstream DevSecOps Series
Cómo entregan las plataformas reguladas, escrito mientras hago el trabajo. Nada que comprar todavía.
§ 01, Los volúmenes
- Vol. I
DevSecOps: Foundations & Transformation
Shift-left culture, the DevSecOps Maturity Model and security extensions to the DORA metrics
En redacción - Vol. II
Securing CI/CD & the Software Supply Chain
SLSA, SBOM, Sigstore and the pipelines attackers target most
En redacción - Vol. III
Cloud-Native Security for DevSecOps
Zero trust, Kubernetes hardening, IaC security and compliance automation
En redacción - Vol. IV
Release Engineering & DevSecOps Governance
Progressive delivery, GitOps, the DORA metrics at scale and framework governance
En redacción - Vol. V
AI and Agentic Systems Security for DevSecOps
LLM threats, agent authorisation, prompt-injection defence and the OWASP LLM Top 10
En redacción - Vol. VI
DevSecOps Forensics & Incident Response
Evidence architecture, investigation playbooks and AI-agent forensics
En redacción
§ 02, Del manuscrito
Se desplaza de lado →
| Nivel | Lo que debe hacer el build | El control que lo demuestra |
|---|---|---|
| Build L0No guarantees | Nothing is required of the build. | None. There is no provenance to check. |
| Build L1Provenance exists | The build runs from a script, and provenance is generated that says how the artifact was built. | The provenance document, published with the artifact. |
| Build L2Hosted build platform | The build runs on a hosted platform, which signs the provenance it generates. | The signature, verified against the platform's key before deploy. |
| Build L3Hardened build platform | The platform isolates each build in an ephemeral environment and keeps the signing material out of reach of the build steps. | Provenance a tenant cannot forge; a policy check at deploy that refuses anything else. |
§ 03, Cuando se pueda leer