Fortifying the Fort: Defensive Strategies in Kubernetes and Containers
From a pod RCE to production: PSA restricted, RBAC without escalation paths, KMS v2 for Secrets, default-deny NetworkPolicy, IMDS blocking and Falco.
Tag
#devsecops
12 posts with this tag
Practical DevSecOps: Hardening the Supply Chain in the Age of SBOMs
GitHub Actions pipeline: Syft SBOM, Grype gate, keyless signing and attestation with Cosign v3, and admission-time verification with Kyverno.
Hands-On Tutorial: Hardening MLOps – Building a Secure Machine Learning Pipeline with DevSecOps
An ML pipeline with validated, DVC-versioned data, a safetensors model signed with Sigstore, and least-privilege serving on Kubernetes.
Want to Be a DevSecOps Engineer? Then You Need This Tool Stack!
What to run at each pipeline stage (secrets, SAST, SBOM, image, IaC, admission, DAST, runtime), what should block, and a minimal workflow.
Pipeline Hijacking! An Offensive Perspective on CI/CD and the Hunt for Credentials
How attackers steal credentials from a CI/CD runner, and how to shut them out with OIDC, SHA pinning and admission-time verification.
The 7 Critical Mistakes Every DevSecOps Engineer Must Avoid in Their Pipeline
Seven pipeline mistakes and their fixes: Semgrep on the PR, a Snyk gate, CVSS with EPSS and KEV, pinned Actions, gitleaks, OIDC and ZAP in staging.
Reticulum: Advanced Cloud Infrastructure Security Scanner
A comprehensive analysis of Reticulum, an advanced security scanner for Kubernetes Helm charts that identifies exposure levels and security vulnerabilities in cloud infrastructure.
Steampipe: The SQL Swiss Army Knife for Cloud Mischief
Learn how to turn your cloud infrastructure into a SQL playground with Steampipe. From basic queries to advanced CIEM rules, discover how to find security holes, overprivileged resources, and that one EC2 instance running Bitcoin miners (we know you have one).
PCI DSS DevSecOps: Automating Payment Security Compliance in Cloud Environments
Automate PCI DSS compliance with DevSecOps practices in cloud environments. Learn secure payment processing, automated compliance validation, and continuous security monitoring for enterprise payment systems.
SOC2 Type II Automation: Evidence Collection with Infrastructure as Code
Automate SOC2 Type II compliance with Infrastructure as Code evidence collection. Learn continuous compliance monitoring, automated audit trails, and policy enforcement for enterprise compliance automation.
SAST Tools Showdown: SonarQube vs Semgrep vs CodeQL in CI/CD
Comprehensive comparison of SAST tools for DevSecOps pipelines. Analyze performance, accuracy, integration capabilities, and cost-effectiveness of SonarQube, Semgrep, and GitHub CodeQL for enterprise CI/CD security.
Building a Zero-Trust CI/CD Pipeline: From Code to Production
Complete implementation guide for zero-trust security in CI/CD pipelines. Learn to integrate security gates, RBAC, and supply chain attestation with GitHub Actions, GitLab CI, and Azure DevOps for enterprise-grade security automation.