Learning DevSecOps

Preface

DevSecOps jobs are abundant, but looking at the requirements for those jobs, it’s quickly evident that there is no agreement on what DevSecOps actually entails. That’s what made this book quite difficult to write. I’ve written books on everything from MySQL to JavaScript to Windows Server to Linux Firewalls. Each of those technologies has a well-defined scope. Writing on Linux firewalls does not require covering several different technologies and skills in the same book. But DevSecOps is not as well-defined. Writing on DevSecOps exposes the fissures in how we define technologies, between the actual hands-on work and the hype. Even the term “DevSecOps” is not as widely used as the term “DevOps.” Granted, “DevSecOps” does not roll off the tongue as easily as “DevOps,” but it’s more than that. Simply lending a voice to the definition of DevSecOps is one of the reasons that I wrote this book.

The goal of this book is not to be a comprehensive step-by-step guide to implementing DevSecOps, whatever the term means. That book is impossible to write because of the rapid changes in tools and the highly customized needs of each organization moving toward DevSecOps. Rather, the goal of this book is to provide patterns of success while also exposing some of the technologies and practices involved in large DevSecOps deployments. The book does not cover every software tool that an organization might use in DevSecOps. This is not an omission, or if it is, the omission is intentional ...