Fortifying the Fort: Defensive Strategies in Kubernetes and Containers
Defensive strategies for securing infrastructure built on Docker containers and Kubernetes orchestration, from the perspective of an offensive cybersecurity expert.
Blog
All articles
51 articles on DevSecOps, reversing, hardware and cloud security. Showing 1–12.
Practical DevSecOps: Hardening the Supply Chain in the Age of SBOMs
A practical guide to hardening the software supply chain using SBOMs, Syft, Grype and Cosign signatures in a DevSecOps pipeline.
Hands-On Tutorial: Hardening MLOps – Building a Secure Machine Learning Pipeline with DevSecOps
A practical guide to building a secure Machine Learning (MLOps) pipeline by integrating DevSecOps, Docker, Kubernetes, DVC and SBOM.
Want to Be a DevSecOps Engineer? Then You Need This Tool Stack!
Essential DevSecOps tools for secure integration into the CI/CD pipeline, including SAST, SCA and IaC security.
Pipeline Hijacking! An Offensive Perspective on CI/CD and the Hunt for Credentials
An offensive analysis of CI/CD pipelines. Learn how attackers hunt for credentials on your runners and how to apply Zero Trust with OIDC.
The 7 Critical Mistakes Every DevSecOps Engineer Must Avoid in Their Pipeline
An in-depth look at the most common mistakes in DevSecOps pipelines and how to avoid them to build secure products.
Reticulum: Advanced Cloud Infrastructure Security Scanner
A comprehensive analysis of Reticulum, an advanced security scanner for Kubernetes Helm charts that identifies exposure levels and security vulnerabilities in cloud infrastructure.
Steampipe: The SQL Swiss Army Knife for Cloud Mischief
Learn how to turn your cloud infrastructure into a SQL playground with Steampipe. From basic queries to advanced CIEM rules, discover how to find security holes, overprivileged resources, and that one EC2 instance running Bitcoin miners (we know you have one).
Advanced Incident Response Automation: From Detection to Remediation in Cloud-Native Environments
Automate incident response from detection to remediation in cloud-native environments. Learn advanced SOAR implementation, threat intelligence integration, and automated forensics for enterprise security operations.
PCI DSS DevSecOps: Automating Payment Security Compliance in Cloud Environments
Automate PCI DSS compliance with DevSecOps practices in cloud environments. Learn secure payment processing, automated compliance validation, and continuous security monitoring for enterprise payment systems.
GDPR/CCPA Compliance in Cloud-Native Applications: Data Privacy by Design
Implement GDPR and CCPA compliance in cloud-native applications with privacy by design principles. Learn automated data governance, consent management, and privacy-preserving architectures for enterprise applications.
SOC2 Type II Automation: Evidence Collection with Infrastructure as Code
Automate SOC2 Type II compliance with Infrastructure as Code evidence collection. Learn continuous compliance monitoring, automated audit trails, and policy enforcement for enterprise compliance automation.