Security as Code

Preface
Who Is This Book For?
What Do You Need To Get Started?
What's in This Book?
Conventions Used in This Book
Using Code Examples
O'Reilly Online Learning
How to Contact Us
Acknowledgments

1. Introduction to DevSecOps
Before DevOps: The Software Development Life Cycle
What Is DevSecOps?
Introducing Automatoonz
Cloud Infrastructure: Secure by Default
Move Fast, Secure Fast: The Importance of Automation
DevSecOps Culture
Summary

2. Setting Up Your Environment
What You'll Need
Installing and Verifying Your Setup
Installing the AWS CLI
Installing the Docker Engine
Checking Your Python Version
Installing Git
Installing Kubernetes
Creating Your First Bare-Bones Pipeline
Summary

3. Securing Your Infrastructure
What Makes Infrastructure Secure?
Hands Off! Preventing Unwanted Access with IAM Permissions
Detecting Misconfigurations
Identifying a Standard
Threat Modeling
Security Controls
Better Than a Cure: Implementing Preventive Controls
Implementation
Summary

4. Logging and Monitoring
What Are Logging and Monitoring—and Why Do They Matter?
Attack Styles
Advanced Persistent Threat Attacks
Ransomware Strains
Passive and Active Attacks
Log Types
Log Storage
Detecting Anomalies
Remediation with AWS Config
Correlating User Activity with CloudTrail
Network Monitoring with an Amazon VPC
Summary

5. Controlling Access Through Automation
The Principle of Least Privilege
Fine-Tuning Access Controls
Use a Tagging System
Clarify Team Responsibilities
Prevent and Detect
The IAM Pipeline
Summary