Securing DevOps

What Hacker News says

1. codybMay 2021
   Tom Aptek’s (security company founder) pitch a few years back was

   Get through ‘A Web Application Hacker’s Handbook’ and ‘Securing DevOps’ and his company would probably give you six figures and a brand new macbook.

   For an extra bonus you could work through their crypto challenges.

   https://cryptopals.com/sets/1

   https://www.manning.com/books/securing-devops

   https://archive.org/details/TheWebApplicationHackersHandbook...

   Show morethread
2. all_usernamesSep 2018
   The discussion about how DevOps is an overloaded term is definitely now meaningless, in that it's been discussed ad nauseam.

   In the meantime, interesting work continues to be done developing the ideas of DevOps and extending them.

   [1] The Site Reliability Workbook, from Google, 2018 https://books.google.com/books?id=fElmDwAAQBAJ

   [2] Securing DevOps, Julien Vehent, 2018 https://www.manning.com/books/securing-devops

   thread
3. yeukhonApr 2017
   Quick sites:

   * PyCon Crypto 101 - https://www.crypto101.io/ (and if you use Python, please use Cryptography library for encryption/decryption please, Python built-in provides sha and hmac already though, and please adopt your framework's security implementation whenever possible).

   * Mozilla Web Security Guidelines - https://wiki.mozilla.org/Security/Guidelines/Web_Security

   * Mozilla Secure Coding Guideline - https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines

   * Mozilla Server Side TLS - https://wiki.mozilla.org/Security/Server_Side_TLS

   * Mozilla Intro to Cryptography (slide: https://april.github.io/crypto-presentation video: https://www.youtube.com/watch?v=bg32spD2mB0)

   * Mozilla Web wiki - https://developer.mozilla.org/en-US/docs/Web (understand CORS, Cookies, CSP, etc)

   * Google's course on security - https://google-gruyere.appspot.com/ (original course page has been taken down by Google already)

   Book recommendations:

   * The Web Application Hacker's Handbook

   * The Tangled Web: A Guide to Securing Modern Web Applications (written by the famous Michał Zalewski working at Google, and lately known for developing the American Fuzzy Loop AFL which has been used for uncovering many new CVE bugs).

   * Hacking: The Next Generation

   * Securing DevOps (to be released soon)

   Publications:

   * USENIX - https://www.usenix.org/ (tons of free high quality conference talks, I like USENIX over ACM)

   * Real World Crypto

   Getting real

   * Go find bug bounty program out there, many well-written posts how one discovered bugs

   * Follow a bunch of security engineers / security-minded folks on Twitter (e.g. @matthew_d_green would be a good start)

   OWASP is a great reference, you read it as an index page. But like others have pointed out, the Wiki is often outdated, but concepts almost always remain the same. Use multiple resources before implementing a solution, and never just copy and paste solution posted by others on Stackoverflow. Sorry for so many Mozilla stuff definitely there's some bias from me but I trust folks running the sec team there.

   Show morethread