Summary

In this chapter, we studied the different components of DevSecOps. We learned that DevSecOps is not only about tooling and automation, but also very much about culture: DevOps teams have to collaborate with the security specialists in the enterprise and together, they must be fully committed to embracing and embedding security guidelines into developing and deploying new code. Tools can certainly help in achieving maximum security in DevOps. A larger part of this chapter was about architecting the DevSecOps practice.

Then, we discussed the best practices for DevSecOps in the major public cloud providers; that is, AWS, Azure, and Google Cloud. These practices typically include the use of Docker containers and Kubernetes as container orchestration platforms. We also learned how to scan code and secure the containers before deploying them to a production platform. Important activities include static code analysis and dynamic scanning.

In the last section of this chapter...