Securing DevOps

Part 1. Case study: applying layers of security to a simple DevOps pipeline

In this first part, we’ll build a small DevOps environment to operate a web application with almost no security. Our pipeline is riddled with holes we’ll plug at every level: application, infrastructure, communications, and deployment. The goal is to add security layer by layer while making use of automated testing, as presented in the test-driven security concept from chapter 1.

Security is a journey. The process of building your own pipeline in chapter 2 will highlight various problems organizations commonly run into and provide a starting point to discuss integrating security into the CI/CD pipeline. We’ll first address the application layer in chapter 3 and discuss ...