DevSecOps Forensics & Incident Response

Evidence architecture first, then investigation playbooks for pipelines, supply chain, infrastructure and identity, then forensics for AI agents. The incident timeline on the series page is the spine of the playbooks.

1. 01

   Design a delivery system so that an investigation has evidence to work with.

2. 02

   Run a structured investigation of a pipeline, supply-chain, infrastructure or identity incident.

3. 03

   Reconstruct an AI agent’s actions from its session record and say whether it was manipulated.

Défile sur le côté →

1. Partie I

   Evidence architecture

   What to log in a delivery system, where to keep it so that it stays unaltered, and how to document chain of custody.

2. Partie II

   Investigation playbooks: pipeline and supply chain

   Structured investigations of a compromised pipeline or a malicious dependency: detection, timeline, preservation.

3. Partie III

   Investigation playbooks: infrastructure and identity

   Container escape, abused cloud credentials, lateral movement and privilege escalation, with the acquisition steps for each.

4. Partie IV

   AI agent forensics

   Recording agent sessions, the log schema for tool calls, and reconstructing an incident from raw logs.

5. Partie V

   Forensics readiness and governance

   Assessing how ready a delivery organisation is to investigate, legal hold, and fitting readiness into an existing DevSecOps programme.

Ce volume est en cours d’écriture. Laissez votre e-mail et je vous enverrai un seul message quand il sera lisible.