Techstream DevSecOps Series
Como plataformas reguladas entregam software, escrito enquanto faço o trabalho. Nada à venda ainda.
§ 01, Os volumes
- Vol. I
DevSecOps: Foundations & Transformation
Shift-left culture, the DevSecOps Maturity Model and security extensions to the DORA metrics
Em redação - Vol. II
Securing CI/CD & the Software Supply Chain
SLSA, SBOM, Sigstore and the pipelines attackers target most
Em redação - Vol. III
Cloud-Native Security for DevSecOps
Zero trust, Kubernetes hardening, IaC security and compliance automation
Em redação - Vol. IV
Release Engineering & DevSecOps Governance
Progressive delivery, GitOps, the DORA metrics at scale and framework governance
Em redação - Vol. V
AI and Agentic Systems Security for DevSecOps
LLM threats, agent authorisation, prompt-injection defence and the OWASP LLM Top 10
Em redação - Vol. VI
DevSecOps Forensics & Incident Response
Evidence architecture, investigation playbooks and AI-agent forensics
Em redação
§ 02, Do manuscrito
Rola para o lado →
| Nível | O que o build precisa fazer | O controle que prova |
|---|---|---|
| Build L0No guarantees | Nothing is required of the build. | None. There is no provenance to check. |
| Build L1Provenance exists | The build runs from a script, and provenance is generated that says how the artifact was built. | The provenance document, published with the artifact. |
| Build L2Hosted build platform | The build runs on a hosted platform, which signs the provenance it generates. | The signature, verified against the platform's key before deploy. |
| Build L3Hardened build platform | The platform isolates each build in an ephemeral environment and keeps the signing material out of reach of the build steps. | Provenance a tenant cannot forge; a policy check at deploy that refuses anything else. |
§ 03, Quando der para ler