Skip to content

Commit bcf3207

Browse files
D3OneD3One
authored
Update README.md
1 parent 1d4a0bc commit bcf3207

1 file changed

Lines changed: 289 additions & 0 deletions

File tree

‎Glossary/README.md‎

Lines changed: 289 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,290 @@
11

2+
# DevSecOps & AppSec Glossary
3+
4+
**What this is:** a comprehensive, engineering-first glossary for **DevSecOps** and **Application Security** leads. It covers culture, SDLC/SSDF, CI/CD hardening, code/dependency security, container/Kubernetes/cloud, API/web/mobile risks, crypto, identity, testing, observability, and leadership practices.
5+
6+
**How it was compiled:** synthesis of widely adopted sources/frameworks: **NIST SSDF (SP 800-218)**, **NIST CSF 2.0**, **NIST 800-53/61/171**, **OWASP** (Top 10, ASVS, API Top 10, MASVS, SAMM), **SLSA** and **in-toto** (software supply chain), **CIS Benchmarks**, **MITRE ATT\&CK/D3FEND**, **CNCF** security papers, **Kubernetes** Pod Security Standards/NSA hardening, **BSIMM**, **ITIL/SRE** practices, major cloud/IaC docs (AWS/Azure/GCP, Terraform/CloudFormation), and industry guidance on SBOM/attestations (e.g., **Sigstore/Cosign**).
7+
8+
---
9+
10+
## 1) DevSecOps Culture & Operating Model
11+
12+
1. **Shift Left / Shift Everywhere** — bring security into planning, design, coding, and CI/CD while keeping runtime controls; add “shift right” via observability and chaos testing.
13+
*Example:* Threat model at design + policy-as-code gate in CI + eBPF runtime alerts.
14+
15+
2. **Security as Code** — encode policies/controls (lint rules, OPA/Conftest, Sentinel) so they’re versioned, testable, and automated.
16+
17+
3. **Security Champion** — trained engineer embedded in a product team who owns local security practices.
18+
19+
4. **Guardrails vs. Gates** — **guardrails** enable safe defaults (templates, pre-configured pipelines); **gates** stop noncompliant code.
20+
21+
5. **Blameless Postmortem** — focus on systemic fixes and learning after incidents.
22+
23+
6. **Threat-Informed Development** — align backlog with real TTPs (MITRE ATT\&CK) and abuse cases.
24+
25+
---
26+
27+
## 2) SDLC, Requirements & Architecture
28+
29+
7. **SSDF (NIST SP 800-218)** — Secure Software Development Framework; tasks across planning, protecting source, producing, and responding.
30+
31+
8. **Secure SDLC (SSDLC)** — embed security activities (requirements, threat modeling, tests, reviews) throughout the lifecycle.
32+
33+
9. **ASVS (OWASP)** — Application Security Verification Standard; levels (L1–L3) for web app requirements.
34+
35+
10. **Architecture Decision Record (ADR)** — lightweight doc capturing security-relevant design decisions and tradeoffs.
36+
37+
11. **STRIDE / LINDDUN** — threat modeling mnemonics (Spoofing, Tampering… / privacy risks).
38+
39+
12. **Abuse/Misuse Case** — user story describing how an attacker could exploit the system.
40+
41+
13. **Data Flow Diagram (DFD)** — diagram of trust boundaries, data stores, and flows for threat modeling.
42+
43+
---
44+
45+
## 3) Source Control & Code Integrity
46+
47+
14. **Branch Protection** — enforce reviews, status checks, and signed commits on main branches.
48+
49+
15. **Signed Commits / Sigstore** — cryptographically sign commits/tags (GPG/SSH, **Sigstore** “keyless” with OIDC identity).
50+
51+
16. **Pre-commit Hooks** — local checks (secrets scanning, linters) before commits land.
52+
53+
17. **Code Review (PR/MR)** — peer review for logic defects and security pitfalls; require security reviewers for sensitive areas.
54+
55+
18. **Trunk-Based Development** — short-lived branches, frequent integration; reduces long-running risky deltas.
56+
57+
19. **Monorepo vs Polyrepo** — repo topology; security impact on visibility and policy consistency.
58+
59+
---
60+
61+
## 4) Dependency & Supply-Chain Security
62+
63+
20. **SCA (Software Composition Analysis)** — discover third-party components and vulnerabilities (CVE/CVSS), license risks.
64+
65+
21. **SBOM (Software Bill of Materials)** — machine-readable inventory (SPDX/CycloneDX) of components and versions.
66+
67+
22. **SLSA (Supply-chain Levels for Software Artifacts)** — maturity levels (1–4) for build provenance and integrity.
68+
69+
23. **in-toto Attestations** — cryptographically verifiable metadata (who/what/when) for build steps.
70+
71+
24. **Reproducible/Hermetic Builds** — deterministic outputs with pinned, isolated dependencies.
72+
73+
25. **Typosquatting/Dependency Confusion** — malicious packages via naming or namespace tricks; enforce private registries, scoped names.
74+
75+
26. **VEX (Vulnerability Exploitability eXchange)** — declares whether a CVE actually affects a product.
76+
77+
---
78+
79+
## 5) CI/CD & Pipeline Hardening
80+
81+
27. **CI/CD** — continuous integration/delivery; automate build, test, security checks, and deployment.
82+
83+
28. **Ephemeral Runners** — short-lived CI workers per job; reduce persistence for attackers.
84+
85+
29. **OIDC-Based Workload Identity** — short-lived cloud creds for CI jobs (no long-lived secrets).
86+
87+
30. **Secrets Management** — store and inject secrets at runtime (KMS/HSM, Vault), avoid in env vars/logs.
88+
89+
31. **Policy as Code (PaC)** — OPA/Rego, Conftest, Sentinel to enforce org policies in pipelines.
90+
91+
32. **Artifact Signing (Cosign)** — sign container/images; verify signatures at deploy/admission time.
92+
93+
33. **Gates/Quality Bars** — block deploy if SAST/SCA/fuzz/coverage doesn’t meet thresholds.
94+
95+
34. **Canary / Blue-Green / Feature Flags** — progressive delivery patterns to reduce blast radius.
96+
97+
35. **Rollback / Roll-forward** — controlled reversions vs quick fixes with new builds.
98+
99+
---
100+
101+
## 6) Application Security Testing
102+
103+
36. **SAST** — Static Application Security Testing; code analysis for injection, crypto misuse, etc.
104+
105+
37. **DAST** — Dynamic Application Security Testing; black-box tests against running app.
106+
107+
38. **IAST** — Interactive AST; instrumented runtime analysis during tests.
108+
109+
39. **RASP** — Runtime Application Self-Protection; in-process detection/mitigation.
110+
111+
40. **Fuzzing** — randomized input generation to find crashes and logic bugs (coverage-guided fuzzing).
112+
113+
41. **Secrets Scanning** — detect API keys/tokens in code and logs.
114+
115+
42. **Dependency Pinning** — fixed versions and lockfiles (npm/yarn/pip/poetry/Go modules).
116+
117+
43. **Security Unit/Integration Tests** — tests that assert authorization rules, input validation, and crypto invariants.
118+
119+
44. **Test Coverage (Instr./Branch)** — measure to ensure security-critical paths are exercised.
120+
121+
---
122+
123+
## 7) Web & API Security (OWASP)
124+
125+
45. **OWASP Top 10** — common web risks (e.g., Broken Access Control, Cryptographic Failures, Injection, SSRF, XSS).
126+
127+
46. **OWASP API Security Top 10** — API-specific issues (BOLA/IDOR, Broken AuthZ, Excessive Data Exposure, Mass Assignment).
128+
129+
47. **ASVS Controls** — mapped requirements (authn, authz, data validation, logging, crypto).
130+
131+
48. **Rate Limiting / Throttling** — protect endpoints from abuse; per-user/client/IP tokens.
132+
133+
49. **Input Validation / Output Encoding** — whitelist validation at trust boundaries; context-aware encoding for HTML/JS/SQL.
134+
135+
50. **CSRF Protections** — same-site cookies, anti-CSRF tokens, double-submit.
136+
137+
51. **CORS** — restrict cross-origin resource sharing; avoid “\*” with credentials.
138+
139+
52. **Session Management** — secure cookies, rotation, revocation, inactivity/timeouts.
140+
141+
53. **JWT (JSON Web Token)** — stateless tokens; validate **alg**, **aud**, **iss**, signature; handle rotation/expiry.
142+
143+
54. **mTLS / OAuth 2.0 / OIDC** — service/user authn patterns for APIs; scopes/claims for least privilege.
144+
145+
---
146+
147+
## 8) Cryptography & Key Management
148+
149+
55. **KMS/HSM** — managed or hardware modules for key generation, storage, rotation, and access control.
150+
151+
56. **TLS 1.2+/1.3** — transport encryption; disable weak ciphers; prefer PFS suites.
152+
153+
57. **At-Rest Encryption** — disk/db encryption with envelope keys and rotation.
154+
155+
58. **Hashing & Password Storage** — adaptive KDFs (bcrypt/Argon2id/scrypt) with salts and proper parameters.
156+
157+
59. **Nonce/IV Management** — never reuse nonces for AEAD modes (GCM/ChaCha20-Poly1305).
158+
159+
60. **Deterministic vs Randomized Encryption** — tradeoffs for searchability and leakage.
160+
161+
61. **Key Rotation / Revocation** — scheduled rotations; immediate revocation on compromise.
162+
163+
---
164+
165+
## 9) Containers & Image Security
166+
167+
62. **Minimal Base Image** — reduce packages/attack surface (distroless/alpine when appropriate).
168+
169+
63. **User/Rootless Containers** — drop root; run as non-root UID.
170+
171+
64. **Image Scanning** — identify CVEs/misconfigs; fail builds on criticals.
172+
173+
65. **Multi-Stage Builds** — keep build tools out of runtime image.
174+
175+
66. **Read-Only Root FS** — immutable runtime; mount writable volumes only when necessary.
176+
177+
67. **Capabilities** — drop `NET_RAW`, `SYS_ADMIN`, etc.; follow least privilege.
178+
179+
68. **Registry Security** — private registries, signed images, RBAC, network isolation.
180+
181+
---
182+
183+
## 10) Kubernetes & Orchestration
184+
185+
69. **RBAC** — least-privilege roles for users and service accounts; avoid `cluster-admin`.
186+
187+
70. **Network Policies** — pod-to-pod restrictions; default-deny egress/ingress where feasible.
188+
189+
71. **Pod Security (Baseline/Restricted)** — enforce via Pod Security Admission/OPA; block privileged pods, host mounts.
190+
191+
72. **Admission Controllers** — validate/mutate resources (OPA Gatekeeper/ Kyverno) to enforce policies (e.g., image signing).
192+
193+
73. **Secrets Management** — externalize to KMS/Vault; avoid plain base64 in `Secret` objects.
194+
195+
74. **etcd Security** — mTLS, at-rest encryption, access isolation.
196+
197+
75. **Runtime Security (eBPF/Falco)** — detect abnormal syscalls, crypto-mining, container escapes.
198+
199+
76. **Workload Identity** — map K8s service accounts to cloud IAM for least-privilege access.
200+
201+
77. **Horizontal/Vertical Autoscaling (HPA/VPA)** — right-size resources; avoid DoS via resource exhaustion.
202+
203+
78. **Ingress/WAF** — protect north-south traffic; enforce TLS, header security.
204+
205+
---
206+
207+
## 11) Cloud & IaC Security
208+
209+
79. **IaC (Infrastructure as Code)** — Terraform/CloudFormation/Pulumi; versioned infra with reviews.
210+
211+
80. **Static Analysis for IaC** — tools (e.g., Checkov, tfsec) to catch open S3 buckets, wide IAM, public SGs.
212+
213+
81. **CSPM / CWPP / CNAPP** — posture mgmt, workload protection, and converged platforms.
214+
215+
82. **Identity-First Security** — SCPs/Permissions Boundaries/Service Control Policies; JIT elevation.
216+
217+
83. **Private Endpoints** — keep data plane off the public Internet; control egress with NAT/egress gateways.
218+
219+
84. **Key Policies & KMS** — CMKs, key separation, rotation, grants, and least-privilege key use.
220+
221+
85. **Data Residency/Sovereignty** — region choices and cross-border transfer constraints.
222+
223+
---
224+
225+
## 12) Observability, Telemetry & IR Readiness
226+
227+
86. **Structured Logging** — consistent fields (user, request-id, tenant, outcome); avoid secrets/PII.
228+
229+
87. **Distributed Tracing** — trace context (W3C) across services; security correlation.
230+
231+
88. **Metrics/SLIs & SLOs** — availability/latency/error rate; couple with security KRIs (authz denials, token failures).
232+
233+
89. **Audit Logging** — privileged actions, policy changes, key use; tamper-evident storage.
234+
235+
90. **MTTD/MTTR** — detection/response KPIs; feed back into backlog and controls.
236+
237+
91. **Backup/Restore Drills** — periodic, automated tests of recovery (immutable snapshots, cross-region).
238+
239+
92. **Tabletop Exercises (TTX)** — simulate auth failures, key leaks, supply-chain attacks with product + ops.
240+
241+
---
242+
243+
## 13) Governance, Risk & Metrics for AppSec Programs
244+
245+
93. **OWASP SAMM / BSIMM** — maturity models for AppSec practice benchmarking.
246+
247+
94. **Risk Register (Product)** — per-service risks with owners and mitigation plans.
248+
249+
95. **Exception Management** — time-boxed risk acceptances with compensating controls.
250+
251+
96. **Security Debt** — accumulated unresolved vulns/misconfigs; track and pay down.
252+
253+
97. **Policy Waiver** — documented, approved deviation with expiration and monitoring.
254+
255+
98. **KRIs/KPIs** — e.g., “% critical vulns > 30 days,” “p95 time to patch,” “coverage of signed artifacts.”
256+
257+
99. **Service Ownership (You Build It, You Run It)** — Dev teams own uptime and security in production.
258+
259+
---
260+
261+
## 14) Team Practices & Enablement
262+
263+
100. **Runbooks/Playbooks** — step-by-step guides for triage, key rotation, incident roles.
264+
265+
101. **Golden Paths/Templates** — secure starters for services, pipelines, and IaC.
266+
267+
102. **Secure Coding Training** — role-based, language-specific, with labs and local examples.
268+
269+
103. **Champions Program** — incentives, office hours, and PRs co-authored with product teams.
270+
271+
104. **Threat Hunting in CI** — periodic scans for drift (open ports, public buckets, wildcard roles).
272+
273+
105. **Vendor Review (Dev Tools)** — assess SaaS build tools, runners, and webhooks (least privilege, SSO/MFA).
274+
275+
---
276+
277+
## 15) Handy Mini-Examples
278+
279+
* **Policy-as-Code Gate:** “Block merges if Terraform opens 0.0.0.0/0 on port 22 or if S3 lacks bucket policies.”
280+
* **JWT Hardening:** “Reject `alg=none`, check `aud` and `iss`, use short expiries and rotate signing keys.”
281+
* **Supply-Chain Provenance:** “Require Cosign-signed images with SLSA-level attestations before K8s admission.”
282+
* **Secrets Hygiene:** “Use OIDC to fetch short-lived creds at job start; forbid long-lived PATs in CI vars.”
283+
284+
---
285+
286+
## 16) Abbreviation Quick Table (selected)
287+
288+
**ADR, AEAD, API, ASVS, ATT\&CK, BOLA/IDOR, BSIMM, CAB, CI/CD, CNAPP, CORS, Cosign, CVE/CVSS, DAST, DFD, DDoS, DLP, DORA (DevOps Research & Assessment), eBPF, HPA/VPA, HSM/KMS, IaC, IAST, IDP/SSO/MFA, in-toto, IR, JWT, KDF, KMS, MASVS, MTTR/MTTD, OIDC/OAuth2/SAML, OPA/Rego, OWASP Top 10/API Top 10, PaC, PFS, PKI, PR/MR, RASP, RBAC, Rego, RPO/RTO, SBOM, SCA, SDET, SLSA, SMI, SOAR/SIEM, SP 800-218/53/61/171, SPF/DKIM/DMARC, SQLi/XSS/SSRF/CSRF, STRIDE, Trivy/Grype (example scanners), TTX, VEX, WAF, YAML, ZTA/ZTNA.**
289+
290+
---

0 commit comments

Comments
 (0)