Techstream DevSecOps Series
Comment les plateformes réglementées livrent, écrit en faisant le travail. Rien à acheter pour l’instant.
§ 01, Les volumes
- Vol. I
DevSecOps: Foundations & Transformation
Shift-left culture, the DevSecOps Maturity Model and security extensions to the DORA metrics
En cours d'écriture - Vol. II
Securing CI/CD & the Software Supply Chain
SLSA, SBOM, Sigstore and the pipelines attackers target most
En cours d'écriture - Vol. III
Cloud-Native Security for DevSecOps
Zero trust, Kubernetes hardening, IaC security and compliance automation
En cours d'écriture - Vol. IV
Release Engineering & DevSecOps Governance
Progressive delivery, GitOps, the DORA metrics at scale and framework governance
En cours d'écriture - Vol. V
AI and Agentic Systems Security for DevSecOps
LLM threats, agent authorisation, prompt-injection defence and the OWASP LLM Top 10
En cours d'écriture - Vol. VI
DevSecOps Forensics & Incident Response
Evidence architecture, investigation playbooks and AI-agent forensics
En cours d'écriture
§ 02, Tiré du manuscrit
Défile sur le côté →
| Niveau | Ce que le build doit faire | Le contrôle qui le prouve |
|---|---|---|
| Build L0No guarantees | Nothing is required of the build. | None. There is no provenance to check. |
| Build L1Provenance exists | The build runs from a script, and provenance is generated that says how the artifact was built. | The provenance document, published with the artifact. |
| Build L2Hosted build platform | The build runs on a hosted platform, which signs the provenance it generates. | The signature, verified against the platform's key before deploy. |
| Build L3Hardened build platform | The platform isolates each build in an ephemeral environment and keeps the signing material out of reach of the build steps. | Provenance a tenant cannot forge; a policy check at deploy that refuses anything else. |
§ 03, Quand ce sera lisible