DevSecOps Practices Catalog

SAST

Beginner

Analyse source code, bytecode or binaries for security defects before the application is built or deployed.

PL
CO
BU
TE
RE
DE
OP
MO

Application

SemgrepSonarQubeCodeQLCheckmarx

View Practice Open Lab

DAST

Intermediate

Probe a running application from the outside to find vulnerabilities that only appear at runtime.

PL
CO
BU
TE
RE
DE
OP
MO

Application

OWASP ZAPBurp SuiteNuclei

View Practice Open Lab

Dependency Scanning

SCA

Beginner

Identify vulnerable, unmaintained or non-compliant third-party dependencies in your builds.

PL
CO
BU
TE
RE
DE
OP
MO

ApplicationSupply Chain

TrivyOWASP Dependency-CheckSnykGrype

View Practice Open Lab

Secret Detection

Beginner

Find credentials, API keys and tokens committed to repositories, history, and CI configuration.

PL
CO
BU
TE
RE
DE
OP
MO

ApplicationIdentity

GitleaksTruffleHogdetect-secrets

View Practice Open Lab

Container Image Scanning

Container Security

Beginner

Scan container images for vulnerable packages and misconfiguration, and harden how images are built.

PL
CO
BU
TE
RE
DE
OP
MO

ContainerSupply Chain

TrivyGrypeClairDocker Scout

View Practice Open Lab

Infrastructure as Code Security

IaC Security

Intermediate

Analyse Terraform, Kubernetes manifests, Helm charts and CloudFormation for insecure configuration before apply.

PL
CO
BU
TE
RE
DE
OP
MO

InfrastructureCloud

CheckovtfsecKICSTerrascan

View Practice Open Lab

SBOM

Intermediate

Generate and publish a machine-readable inventory of every component shipped in a release.

PL
CO
BU
TE
RE
DE
OP
MO

Supply Chain

SyftTrivycdxgen

View Practice Open Lab

Policy as Code

Advanced

Express security and compliance rules as versioned code and enforce them automatically in pipelines and clusters.

PL
CO
BU
TE
RE
DE
OP
MO

GovernanceInfrastructureContainer

Open Policy AgentKyvernoConftestGatekeeper

View Practice Open Lab

Kubernetes Security

Advanced

Secure clusters, workloads, RBAC, network policy, images and runtime behaviour across Kubernetes and OpenShift.

PL
CO
BU
TE
RE
DE
OP
MO

ContainerInfrastructureIdentity

FalcoKyvernoTrivyOpen Policy Agent

View Practice Open Lab

Secrets Management

Intermediate

Store, distribute, rotate and audit credentials without embedding them in code or pipeline configuration.

PL
CO
BU
TE
RE
DE
OP
MO

IdentityCloudInfrastructure

HashiCorp VaultExternal Secrets OperatorAnsible VaultSOPS

View Practice Open Lab

Software Supply Chain Security

Supply Chain Security

Advanced

Protect the path from source commit to deployed artefact against tampering and dependency compromise.

PL
CO
BU
TE
RE
DE
OP
MO

Supply Chain

Sigstore CosignSyftin-totoTrivy

View Practice Open Lab

Artifact Signing

Intermediate

Cryptographically sign build outputs so consumers can verify origin and integrity.

PL
CO
BU
TE
RE
DE
OP
MO

Supply Chain

Sigstore CosignNotationGPG

View Practice

Provenance

Build Provenance

Advanced

Record verifiable metadata describing how, where and from what source an artefact was built.

PL
CO
BU
TE
RE
DE
OP
MO

Supply Chain

in-totoSigstore CosignSLSA GitHub Generator

View Practice

SLSA

SLSA Levels

Advanced

Use the SLSA framework to measure and improve build integrity in graduated levels.

PL
CO
BU
TE
RE
DE
OP
MO

Supply ChainGovernance

SLSA GitHub Generatorin-totoSigstore Cosign

View Practice

Dependency Management

Beginner

Keep dependencies pinned, updated and reviewed so remediation is routine instead of an incident.

PL
CO
BU
TE
RE
DE
OP
MO

Supply ChainApplication

RenovateDependabotTrivy

View Practice

Secure Coding

Beginner

Apply language-level and framework-level practices that eliminate whole vulnerability classes.

PL
CO
BU
TE
RE
DE
OP
MO

Application

SemgrepSonarQubeESLint

View Practice

Code Review

Security Code Review

Intermediate

Apply targeted human review to the changes where automation is weakest: authorisation, business logic and cryptography.

PL
CO
BU
TE
RE
DE
OP
MO

Application

GitHubGitLabSemgrep

View Practice

Secure Coding

Threat Modeling

Intermediate

Identify what can go wrong in a design before it is built, and record the mitigations chosen.

PL
CO
BU
TE
RE
DE
OP
MO

ApplicationGovernance

OWASP Threat DragonMiro

View Practice

Pipeline Security

Advanced

Harden the CI/CD system itself: runner isolation, credential scope, pinned steps and protected branches.

PL
CO
BU
TE
RE
DE
OP
MO

InfrastructureSupply Chain

GitHubGitLabJenkinsSigstore Cosign

View Practice

Build Security

Advanced

Make builds reproducible, isolated and free of untrusted inputs so outputs can be trusted.

PL
CO
BU
TE
RE
DE
OP
MO

Supply ChainInfrastructure

BuildKitKanikoSyft

View Practice

Artifact Security

Intermediate

Control how build outputs are stored, promoted and retrieved from registries and artefact repositories.

PL
CO
BU
TE
RE
DE
OP
MO

Supply ChainContainer

HarborJFrog ArtifactoryTrivySigstore Cosign

View Practice

Security Gates

Intermediate

Define objective, documented criteria that a release must meet before it can progress.

PL
CO
BU
TE
RE
DE
OP
MO

GovernanceApplication

Open Policy AgentGitLabGitHub

View Practice

Approval Controls

Beginner

Require human authorisation for high-impact changes with a clear, auditable trail.

PL
CO
BU
TE
RE
DE
OP
MO

Governance

GitHubGitLabAnsible Automation Platform

View Practice

Terraform Security

Intermediate

Secure Terraform state, providers, modules and plan/apply workflows.

PL
CO
BU
TE
RE
DE
OP
MO

InfrastructureCloud

CheckovtfsecTerraform CloudOPA

View Practice

Ansible Security

Intermediate

Secure Ansible content, credentials and execution across ad-hoc runs and automation platforms.

PL
CO
BU
TE
RE
DE
OP
MO

InfrastructureIdentity

ansible-lintAnsible VaultHashiCorp Vault

View Practice

Configuration Management

Infrastructure Automation Security

Advanced

Secure automation platforms end to end: credentials, RBAC, execution environments and audit logging.

PL
CO
BU
TE
RE
DE
OP
MO

InfrastructureIdentityGovernance

Ansible Automation PlatformHashiCorp Vaultansible-lint

View Practice Open Lab

Configuration Management

Intermediate

Keep system configuration declarative, versioned and continuously reconciled against drift.

PL
CO
BU
TE
RE
DE
OP
MO

Infrastructure

AnsibleOpenSCAPPuppet

View Practice

Docker Security

Docker & Podman Security

Intermediate

Harden container runtime configuration, daemon access and image build practices.

PL
CO
BU
TE
RE
DE
OP
MO

ContainerInfrastructure

Docker BenchPodmanTrivy

View Practice Open Lab

OpenShift Security

Advanced

Apply Security Context Constraints, project isolation and integrated build security on OpenShift.

PL
CO
BU
TE
RE
DE
OP
MO

ContainerInfrastructure

OpenShiftKyvernoTrivyFalco

View Practice

Runtime Security

Advanced

Detect and respond to malicious behaviour in running workloads using kernel-level telemetry.

PL
CO
BU
TE
RE
DE
OP
MO

ContainerOperations

FalcoTetragonTracee

View Practice Open Lab

Cloud Configuration

Cloud Security

Intermediate

Secure cloud accounts, identities, networks and data services across providers.

PL
CO
BU
TE
RE
DE
OP
MO

CloudIdentityInfrastructure

ProwlerScoutSuiteCheckovCloud Custodian

View Practice

CSPM

Intermediate

Continuously assess deployed cloud configuration against benchmarks and remediate drift.

PL
CO
BU
TE
RE
DE
OP
MO

CloudGovernance

ProwlerCloud CustodianScoutSuite

View Practice

IAM

Identity & Access Management

Advanced

Design least-privilege access for humans and workloads with short-lived, auditable credentials.

PL
CO
BU
TE
RE
DE
OP
MO

IdentityCloudGovernance

HashiCorp VaultKeycloakAWS IAMOpen Policy Agent

View Practice

Network Security

Intermediate

Segment workloads, default-deny traffic and encrypt communication in transit.

PL
CO
BU
TE
RE
DE
OP
MO

InfrastructureCloudContainer

CiliumIstioAWS Security Groups

View Practice

Workload Security

Cloud Workload Security

Intermediate

Protect VMs, serverless functions and managed compute with hardening, patching and telemetry.

PL
CO
BU
TE
RE
DE
OP
MO

CloudInfrastructureOperations

OpenSCAPFalcoCloud Custodian

View Practice

Vulnerability Management

Intermediate

Aggregate findings from all scanners, prioritise by real risk and drive them to closure with SLAs.

PL
CO
BU
TE
RE
DE
OP
MO

OperationsGovernance

DefectDojoTrivyProwler

View Practice

SIEM

SIEM & Security Analytics

Advanced

Centralise security-relevant events and detect suspicious activity across the estate.

PL
CO
BU
TE
RE
DE
OP
MO

Operations

Elastic SecurityWazuhSplunk

View Practice

Logging

Security Logging

Beginner

Collect, structure and retain the events required for detection, investigation and audit.

PL
CO
BU
TE
RE
DE
OP
MO

OperationsGovernance

Fluent BitLokiOpenTelemetry

View Practice

Monitoring

Monitoring & Alerting

Beginner

Track security-relevant signals and alert with enough context to act.

PL
CO
BU
TE
RE
DE
OP
MO

Operations

PrometheusGrafanaAlertmanager

View Practice

Monitoring

Security Observability

Intermediate

Correlate metrics, logs and traces so security questions can be answered quickly.

PL
CO
BU
TE
RE
DE
OP
MO

Operations

OpenTelemetryGrafanaTempo

View Practice

Incident Response

Advanced

Prepare, detect, contain, eradicate, recover and learn from security incidents.

PL
CO
BU
TE
RE
DE
OP
MO

OperationsGovernance

PagerDutyElastic SecurityFalco

View Practice

Threat Detection

Threat Detection Engineering

Advanced

Write, test and maintain detections mapped to attacker techniques.

PL
CO
BU
TE
RE
DE
OP
MO

Operations

SigmaElastic SecurityFalco

View Practice

Compliance

Continuous Compliance

Intermediate

Produce control evidence automatically and continuously instead of during audit sprints.

PL
CO
BU
TE
RE
DE
OP
MO

Governance

OpenSCAPOpen Policy AgentProwler

View Practice

Security Policies

Beginner

Write policies and standards that are specific enough to be automated and verified.

PL
CO
BU
TE
RE
DE
OP
MO

Governance

Open Policy AgentGitHub

View Practice

Risk Management

Intermediate

Record, prioritise and periodically review security risks with named owners and decisions.

PL
CO
BU
TE
RE
DE
OP
MO

Governance

DefectDojoJira

View Practice

Audit

Audit & Traceability

Intermediate

Maintain a tamper-resistant record of who changed what, when and with what approval.

PL
CO
BU
TE
RE
DE
OP
MO

GovernanceIdentity

Kubernetes AuditElastic SecurityGitLab

View Practice

Secure Coding

API Security

Intermediate

Protect APIs with strong authentication, per-object authorisation, schema validation and rate limiting.

PL
CO
BU
TE
RE
DE
OP
MO

ApplicationIdentity

OWASP ZAPSemgrepKong

View Practice

Kubernetes Security

Admission Control

Advanced

Validate and mutate Kubernetes resources at creation time to enforce security requirements.

PL
CO
BU
TE
RE
DE
OP
MO

ContainerGovernance

KyvernoGatekeeperSigstore Cosign

View Practice