DevSecOps Roadmap with Resouces
A comprehensive collection of DevSecOps learning resources including videos, blogs, tools, and hands-on labs.
1. Git (Version Control System)
DevSecOps relies on Everything as Code (EaC). Git is the most widely used VCS.
2. CI/CD (Continuous Integration & Delivery)
CI/CD pipelines are the backbone of modern DevOps and Cloud-Native systems.
- VIDEO GitLab Beginner Tutorial – Raghav Pal Watch
- VIDEO Introduction to Jenkins, CI/CD, and DevOps – Valentin Despa Watch
- VIDEO Best Practices for Securing CI/CD Pipelines – Victoria Almazova Watch
- VIDEO CI/CD Platform in AWS – Mohamed Labouardy Watch
- VIDEO Continuous Delivery from First Principles – Tom Watch
- VIDEO Let's Build a CI/CD Pipeline – Jean De Klerk Watch
- VIDEO Intro to CI/CD with Python – Chris Arceneaux Watch
- VIDEO GitLab CI/CD – Johan Duran Watch
- VIDEO CI/CD Pipeline in Azure – Benjamin Hodge Watch
- VIDEO Continuous Integration with GitLab CI – Pete Johanson Watch
- VIDEO GitLab Workflow – GitLab Watch
- VIDEO From Dev to Prod with GitLab CI – Stephan Hochdorfer Watch
- VIDEO Scaling Continuous Deployment – Tony Savor Watch
- VIDEO Continuous Delivery with Jenkins – Gianluca Arbezzano Watch
3. Artifact Management
Artifact repositories store and control deployable binaries securely.
- VIDEO Introduction to Artifactory on the JFrog Platform – Melissa Watch
- VIDEO How to Integrate Nexus with Jenkins and Upload Artifacts – Madhu Sudhan Reddy Watch
- VIDEO Six Reasons to Use a Repository Manager Now – Tim O’Brien Watch
- VIDEO Sample DevOps Project: Nexus–Artifactory Uploader Jenkins Pipeline – Madhu Sudhan Reddy Watch
4. Infrastructure as Code (IaC)
Infrastructure is treated like software to enable speed and consistency.
- VIDEO Holistic Configuration Management at Facebook – Chunqiang Tang Watch
- VIDEO SaltStack Is More Than Just Configuration Management – Thomas Hatch Watch
- VIDEO DSC in the Configuration Management Tool World – Ben Gelens Watch
- VIDEO Evolution of Configuration Management in a DevOps World – Marisa Sawatphadungkij Watch
- VIDEO Integrating Configuration Management into Your Ecosystem – Sascha Bates Watch
- VIDEO Configuration Management with SaltStack: Zero to Hero – Wesley Whetstone Watch
- VIDEO Cloud-Native Configuration Management 2020 and Beyond – Eric Sorenson Watch
- VIDEO Puppet Automation Journey: Configuration Management & Cloud – Brendan Rosewarne Watch
5. Cloud Service Provider Platform
Modern development needs elastic, on-demand cloud platforms.
- VIDEO Introduction to AWS Security – Bill Reid Watch
- VIDEO AWS Security by Design – Shafreen Sayyed Watch
- VIDEO Advanced Security Best Practices Masterclass – Ian Massingham Watch
- VIDEO Fundamentals of AWS Cloud Security – Becky Weiss Watch
- VIDEO Security Best Practices: Well-Architected Way – Ben Potter Watch
- VIDEO Introduction to AWS Security Hub – Ely Kahn Watch
- VIDEO Cloud Security Architecture Workshop – Dave Shackleford Watch
- VIDEO Implementing DevSecOps in the Cloud – Jimmy Jenis Watch
6. Threat Modeling
Threat modeling helps quantify and reduce security risks.
7. Static Application Security Testing (SAST)
SAST analyzes source code to identify security vulnerabilities early in the SDLC.
- VIDEO Static Analysis Security Testing for Dummies… and You – Kevin Fealey Watch
- VIDEO Application Security Testing – Semi Yulianto Watch
- VIDEO Static Analysis for Dynamic Assessments – Greg Patton Watch
- VIDEO Static Code Analysis: Scan All Your Code for Bugs – Jared DeMott Watch
- VIDEO Bug Hunting with Static Code Analysis – Nick Jones Watch
- VIDEO SAST with CI/CD Pipelines Using WhiteSource – Mohamad Radwan Watch
- VIDEO GitLab APEX SAST Walkthrough for Salesforce – Lucas C Watch
- VIDEO AST in CI/CD: How to Make It Work – Ofer Maor Watch
8. Dynamic Application Security Testing (DAST)
DAST tests running applications to identify security vulnerabilities from the outside.
- VIDEO Dynamic Security Testing with OWASP ZAP – Omer Levi Hevroni Watch
- VIDEO Practical Dynamic Application Security Testing in the Enterprise – Nicholas Kenney Watch
- VIDEO Baby Steps to Security Testing – Christina Thalayasingam Watch
- VIDEO Automated Static & Dynamic Security Analysis of Mobile Apps – Raveendar & Rajesh Watch
9. Security as Code
Security as Code embeds security controls, policies, and checks directly into code and pipelines.
10. Compliance as Code
If hardening can be done using Infrastructure as Code tools, why can’t compliance be automated as code?
- VIDEOCompliance as Code: Automate Compliance Using Open Source Technology – RedHat
- VIDEOContinuous Assurance and Continuous Compliance via Data, Graph, Query and Code – Erkang Zheng
- VIDEOManaging Compliance as Code: Using Chef InSpec for All Its Possibilities – Chef
- VIDEOCompliance as Code – Lessons Learned From Regulated Organizations – Sergiu Bodiu
- VIDEOCompliance As Code – Webinar – Anitian
- VIDEOException Handling: Compliance as Code – Chef
- VIDEOInfrastructure and Compliance as Code for Universities – Blake Dworaczyk, Adam Mikeal, Nick Rycar
- VIDEODevSecOps Delight with Compliance as Code – Anthony Rees
- VIDEOInSpec Compliance as Code – Kent Picat Gruber