DevSecOps for Azure: End-to-end supply chain security for GitHub, Azure DevOps, and the Azure cloud - Paperback

by David Okeyode (Author), Joylynn Kirui (Author), Scott Hanselman (Foreword by)

Gain holistic insights and practical expertise in embedding security within the DevOps pipeline, specifically tailored for Azure cloud environments

Key Features:

- Learn how to integrate security into Azure DevOps workflows for cloud infrastructure

- Find out how to integrate secure practices across all phases of the Azure DevOps workflow, from planning to monitoring

- Harden the entire DevOps workflow, from planning and coding to source control, CI, and cloud workload deployment

- Purchase of the print or Kindle book includes a free PDF eBook

Book Description:

Businesses must prioritize security, especially when working in the constantly evolving Azure cloud. However, many organizations struggle to maintain security and compliance. Attackers are increasingly targeting software development processes, making software supply chain security crucial. This includes source control systems, build systems, CI/CD platforms, and various artifacts. With the help of this book, you'll be able to enhance security and compliance in Azure software development processes.

Starting with an overview of DevOps and its relationship with Agile methodologies and cloud computing, you'll gain a solid foundation in DevSecOps principles. The book then delves into the security challenges specific to DevOps workflows and how to address them effectively. You'll learn how to implement security measures in the planning phase, including threat modeling and secure coding practices. You'll also explore pre-commit security controls, source control security, and the integration of various security tools in the build and test phases. The book covers crucial aspects of securing the release and deploy phases, focusing on artifact integrity, infrastructure as code security, and runtime protection.

By the end of this book, you'll have the knowledge and skills to implement a secure code-to-cloud process for the Azure cloud.

What You Will Learn:

- Understand the relationship between Agile, DevOps, and the cloud

- Secure the use of containers in a CI/CD workflow

- Implement a continuous and automated threat modeling process

- Secure development toolchains such as GitHub Codespaces, Microsoft Dev Box, and GitHub

- Integrate continuous security throughout the code development workflow, pre-source and post-source control contribution

- Integrate SCA, SAST, and secret scanning into the build process to ensure code safety

- Implement security in release and deploy phases for artifact and environment compliance

Who this book is for:

This book is for security professionals and developers transitioning to a public cloud environment or moving towards a DevSecOps paradigm. It's also designed for DevOps engineers, or anyone looking to master the implementation of DevSecOps in a practical manner. Individuals who want to understand how to integrate security checks, testing, and other controls into Azure cloud continuous delivery pipelines will also find this book invaluable. Prior knowledge of DevOps principles and practices, as well as an understanding of security fundamentals will be beneficial.

Table of Contents

- Agile, DevOps, and Azure Overview

- Security Challenges of the DevOps Workflow

- Implementing Security in the Plan Phase of DevOps

- Implementing Pre-commit Security Controls

- Implementing Source Control Security

- Implementing Security in the Build Phase of DevOps

- Implementing Security in the Test and Release Phases of DevOps

- Continuous Security Monitoring on Azure